Privacy policy
Last updated 18 August 2026
1. Who we are
WebScheduler (Pty) Ltd, registration number 2026/138798/07, is a South African technology company providing online scheduling, appointment-booking, business listing and related Software as a Service (SaaS) services. We collect, use, store, protect and otherwise process the personal information of individuals who use those services, including the WebScheduler application, the online booking platform and the business listing service.
Company details
- Registered name — WebScheduler (Pty) Ltd
- Registration number — 2026/138798/07
- Contact number — 076 829 7070
- Email address — [email protected]
- Website — webscheduler.co.za
This policy explains what personal information this website — webscheduler.co.za — collects, why, and what you can do about it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
Two things this policy does not cover, because they are separate:
- WebScheduler Local, our public place to find local services, professionals and home industry, has its own policy at listing.webscheduler.co.za/privacy.
- The WebScheduler product itself, which you can run on your own infrastructure or have us host for you. The two arrangements put us in different positions under POPIA — see section 4.
2. What this site collects
Very little. This is a brochure site — there is no account to create and nothing to sign in to.
- Analytics, and only if you accept cookies. We use Google Analytics 4 to see which pages people find useful. Nothing is measured or stored until you press Accept. See our cookie policy.
- Two browser storage entries — one remembering whether you chose light or dark mode, one remembering your answer to the cookie banner so we stop asking. Neither is sent to us; both stay in your browser.
- Standard web server logs kept by our hosting provider, including IP addresses, used to keep the site available and to investigate abuse.
- What you type into the demo request form on our contact page — your name, business name, email address, phone number if you give one, and your message. You send it deliberately, by pressing the button and ticking the consent box; nothing on this site collects any of it otherwise.
3. What happens to a demo request
The form emails your enquiry straight to our own mailbox and keeps no copy on the website. There is no database behind this site and no record of your submission is stored on the web server — once the email is on its way, the only copy is in our inbox, handled as described in sections 6 and 8.
We record the time and the sending IP address alongside the message, purely to trace abuse if the form is used to send spam, and we limit how often the form may be used from one address. If you would rather not use the form at all, email us directly — the address is on the contact page.
We use what you send only to reply to you and to arrange the demo you asked for. We do not add you to a marketing list off the back of it. We do not use advertising cookies, we do not build visitor profiles, and we do not sell or rent personal information to anyone.
4. Where the product runs, and who is responsible for what
WebScheduler can be deployed two ways, and which one you choose decides our position under POPIA. In both cases you remain the responsible party for your own customers' appointment records — what changes is whether we touch them at all.
Self-hosted
WebScheduler runs on your own infrastructure, under your own brand. That has a direct privacy consequence worth stating plainly: your customers' appointment records, contact details and booking history never reach us. They live on servers you control.
For that data you are the responsible party under POPIA, and we are not a processor of it. We cannot read it and we cannot produce it on request — because we never hold it.
Hosted by us
Where you ask us to run the instance for you, it is hosted on the infrastructure described below. Your customers' records do pass through systems we operate, so for that data we act as an operator under POPIA sections 20 and 21 — we process it on your documented instruction, only to provide the service, and not for our own purposes. You stay the responsible party towards your customers.
Hosting and technology infrastructure
Our services are hosted on Amazon Web Services (AWS) infrastructure. Our servers currently run in the AWS Asia Pacific (Mumbai) Region, ap-south-1, so the information you give us is stored and processed outside South Africa. We may change our hosting region, infrastructure or service providers as the platform develops; where such a change materially affects the processing or cross-border transfer of personal information, we will update this page. The platform is built on a PHP-based technology stack:
- Backend — PHP and CodeIgniter 4
- Database — MySQL / MariaDB
- Frontend — JavaScript, Vite, Tailwind CSS and SCSS
- Client-side libraries — Chart.js and Luxon, where applicable
- Authentication — session-based authentication
- Web server — Apache
- Hosting and cloud infrastructure — Amazon Web Services (AWS)
- Security — access controls, application-level authorisation, encrypted connections (HTTPS/TLS), and other appropriate technical and organisational security measures
This stack may be updated, replaced or expanded from time to time as we develop and improve our services.
5. Why we process what we do, and on what basis
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Analytics, to understand which pages are useful | Your consent, which you can withdraw at any time |
| Remembering your theme and cookie choices | Necessary to provide the site as you asked for it |
| Server logs, to keep the site available and investigate abuse | Our legitimate interest in a working, secure service |
| Replying to an enquiry you emailed us | Necessary to take steps you requested |
| Replying to a demo request you sent through the contact form | Your consent, given by ticking the box, and necessary to take steps you requested |
| Rate-limiting the contact form and keeping the sender's IP with the message | Our legitimate interest in preventing abuse of the form |
6. Who else sees it
- Google, for analytics, and only once you have accepted cookies. Google's own privacy policy governs what it does with that data.
- Amazon Web Services, our hosting provider, which necessarily handles the requests your browser makes.
- Our email provider, if you email us or send a demo request through the contact form — the form delivers it as an ordinary email.
- Where the law requires it, such as a valid court order.
Fonts, stylesheets, scripts and images on this site are served from our own domain, so browsing it does not quietly hand your IP address to a content delivery network or a font host.
7. Information leaving South Africa
Google processes analytics data outside South Africa. POPIA section 72 permits this where the recipient is subject to comparable protection; we rely on Google's own contractual and regulatory commitments. If you decline cookies, no analytics data is generated at all.
Hosting is a separate question from analytics. Our servers run in the AWS Asia Pacific (Mumbai) Region, so that processing takes place outside South Africa. POPIA section 72 permits this where the recipient is subject to comparable protection; we rely on AWS's own contractual and regulatory commitments.
Depending on the service involved, the safeguards we rely on may include contractual protections, data-processing terms, applicable regulatory safeguards and other appropriate measures provided by our service providers.
8. How long we keep it
Analytics data is retained for the period configured in our Google Analytics property and is aggregated for reporting. Email correspondence — including demo requests sent through the contact form, which reach us as ordinary email — is kept for as long as it is useful for the enquiry and our records. Server logs are kept on our provider's standard rotation. The two browser storage entries stay until you clear your browser data.
The contact form itself stores nothing, so there is nothing on the website to delete. It does keep small counters for a couple of days to rate-limit submissions; those hold a one-way hash of the sender's address, not the address itself, and no message content.
9. Your rights under POPIA
Subject to applicable legal requirements and limitations, you may:
- Ask us to confirm whether we hold personal information about you;
- Request access to the personal information we hold about you;
- Ask us to correct or update information that is inaccurate or incomplete;
- Ask us to delete personal information where applicable;
- Withdraw a consent you previously gave, where processing is based on consent;
- Object to certain processing activities where applicable; and
- Lodge a complaint about how your personal information is processed.
Withdrawing analytics consent takes one click — open cookie preferences and press Decline. To exercise any other right, use the contact details in section 14.
10. Complaints
If you believe your personal information has been processed unlawfully, or that your privacy rights have not been adequately addressed, contact us first so we can investigate and try to resolve it.
You may also lodge a complaint with the Information Regulator (South Africa) through its official channels — inforegulator.org.za.
11. Security
This site is served over HTTPS and is a set of static pages apart from the single script that sends the contact form. There is no database attached to it, no visitor account to compromise, and no store of past enquiries to breach — the form forwards your message by email and retains nothing. No system is perfectly secure, and we cannot guarantee absolute security.
12. Children
This site is aimed at businesses and is not directed at children. We do not knowingly collect information from anyone under 18.
13. Changes
We may update this policy from time to time to reflect changes to our services, technology, legal requirements or information-processing practices. When we do, we will update the date at the top of this page. Material changes affecting how we use information you have already given us will be described here.
14. Contact us
If you have a question about this policy, want to exercise a privacy right, or have a concern about how your personal information is being processed, contact us:
- WebScheduler (Pty) Ltd, registration number 2026/138798/07
- Privacy requests — [email protected]
- General enquiries — [email protected] or 076 829 7070
- Anything else — our contact page
We will consider and respond to privacy-related requests in accordance with applicable legal requirements.