POPIA Compliance

1. Our Commitment to POPIA

Omni Field Pro (Pty) Ltd is fully committed to complying with the Protection of Personal Information Act 4 of 2013 (POPIA), which has been in full effect since 1 July 2021.

As a field service management platform that processes personal information on behalf of South African businesses, we recognise our dual responsibility as both a responsible party (for our own subscribers' data) and an operator (processing data on behalf of our subscribers for their clients).

This POPIA Compliance Statement outlines how we meet our obligations under the Act.

2. Information Officer

In compliance with Section 55 of POPIA, we have designated an Information Officer:

Role: Information Officer
Email: privacy@omnifield.africa
Phone: +27 79 350 8544
Address: Cape Town, Western Cape, South Africa

Our Information Officer is responsible for encouraging compliance with POPIA within the organisation, handling data subject access requests (DSARs), working with the Information Regulator regarding investigations or complaints, and ensuring the organisation's POPIA compliance manual is available.

3. The 8 Conditions for Lawful Processing

POPIA establishes eight conditions for the lawful processing of personal information. Here is how Omni Field satisfies each:

Condition 1: Accountability

We take full responsibility for the personal information in our possession. Our Information Officer ensures that all processing activities comply with POPIA, and we maintain comprehensive records of our processing activities.

Condition 2: Processing Limitation

We process personal information only with the data subject's consent, or where processing is necessary for performing a contractual obligation (providing the Service), compliance with a legal obligation, protecting a legitimate interest of the data subject, or pursuing our legitimate business interests where these do not override the rights of the data subject. We collect only the minimum personal information necessary for the stated purpose.

Condition 3: Purpose Specification

Personal information is collected for specific, explicitly defined, and lawful purposes, including providing field service management software functionality, processing payments and managing subscriptions, communicating service-related information, ensuring platform security, and complying with legal obligations (e.g., tax records for SARS). We do not process personal information for purposes incompatible with those for which it was originally collected.

Condition 4: Further Processing Limitation

We do not use personal information for secondary purposes that are incompatible with the original purpose of collection. Any new use will be communicated to data subjects and, where necessary, fresh consent will be obtained.

Condition 5: Information Quality

We take reasonable steps to ensure that personal information is complete and accurate, not misleading, and updated where necessary. Subscribers are responsible for the accuracy of data they enter into the platform, including client records and job information. We provide tools for data correction and updating.

Condition 6: Openness

We are transparent about our data processing activities through this POPIA Compliance Statement, our Privacy Policy, our Terms of Service, and making our Information Officer accessible for enquiries.

Condition 7: Security Safeguards

We implement robust security measures to protect personal information:

Technical measures: TLS/SSL encryption, encryption at rest, Row Level Security (RLS) for multi-tenant data isolation, role-based access controls, automated backups
Organisational measures: Access restricted to authorised personnel, staff awareness of data protection obligations, incident response procedures
Third-party safeguards: All service providers (operators) are contractually bound to maintain appropriate security standards

Condition 8: Data Subject Participation

Data subjects can exercise their rights by contacting our Information Officer. We facilitate access to personal information held about the data subject, correction or deletion of inaccurate or outdated information, objection to processing on reasonable grounds, and withdrawal of consent.

4. Special Personal Information

In terms of Sections 26-33 of POPIA, special personal information includes data about religious beliefs, race, ethnicity, trade union membership, political affiliation, health, sexual orientation, biometric information, and criminal behaviour.

Omni Field does not require or intentionally collect special personal information. We advise subscribers to avoid entering special personal information into the platform unless absolutely necessary for their service delivery. Where such information is entered by subscribers, it is subject to the same security safeguards as all other data.

5. Field Service Industry Considerations

As a platform serving field service businesses, we address several industry-specific privacy considerations:

5.1 GPS and Location Tracking

Location tracking of field agents is enabled only with informed consent
Tracking operates only during configured working hours
Subscribers can configure tracking frequency and opt-out policies
Field agents are notified when tracking is active
Location data is retained according to our data retention schedule

5.2 On-Site Data Collection

Photographs and documents captured on-site are stored securely and associated with the relevant job
Field agents should obtain verbal consent before photographing occupied properties or individuals
Subscribers are responsible for informing their clients about data collection practices

5.3 Client Data Managed by Field Agents

Field agents access client data on a need-to-know basis, limited to information relevant to their assigned jobs
Role-based permissions restrict data visibility in the mobile application
Subscribers should ensure their field agents understand their data protection obligations

5.4 Client Portal Data

The client portal displays only information relevant to the specific client
Client portal access is secured through invitation-based authentication
Clients can view their own job history, invoices, and documents only

6. Data Subject Access Request (DSAR) Process

If you wish to exercise your rights under POPIA, follow this process:

Step 1: Submit Your Request

Email privacy@omnifield.africa with your full name and contact details, a description of the information you are requesting or the right you wish to exercise, and sufficient detail to identify the personal information in question.

Step 2: Identity Verification

We will verify your identity using reasonable means, which may include confirming your email address matches our records, requesting a copy of your South African ID or passport, or asking security questions related to your account.

Step 3: Processing

We will acknowledge receipt of your request within 5 business days, provide a substantive response within 30 days as required by Section 18 of POPIA, and if we cannot comply, provide written reasons for refusal.

Step 4: Fees

We may charge a reasonable fee for access requests as permitted by POPIA. We will inform you of any applicable fees before processing your request.

7. Data Breach Notification

In accordance with Section 22 of POPIA, in the event of a data breach that compromises personal information:

Notification to the Information Regulator

We will notify the Information Regulator as soon as reasonably possible after becoming aware of the breach. Notification will include the nature of the breach, estimated number of data subjects affected, measures taken to address the breach, and recommendations for data subjects.

Notification to Affected Data Subjects

We will notify affected data subjects as soon as reasonably possible. Notification will be made by email and, where email is unavailable, by prominent notice on our website. We will provide clear information about the breach, potential consequences, and steps data subjects can take to protect themselves.

Breach Response

We maintain an incident response plan for data breaches. Root cause analysis is conducted for every breach. Remedial measures are implemented to prevent recurrence.

8. Operator Agreements

We use the following third-party service providers (operators) in terms of Section 21 of POPIA:

Operator	Purpose	Data Processed	Safeguards
Paystack	Payment processing	Transaction data, email	PCI-DSS compliant, operator agreement in place
Resend	Email delivery	Email addresses, email content	Data processing agreement, encrypted transmission
Supabase	Cloud infrastructure	All platform data	SOC 2 Type II compliant, encryption at rest and in transit
Mapbox	Mapping and geocoding	Addresses, GPS coordinates	Privacy-focused API, minimal data retention

All operators are contractually required to process personal information only on our instructions, implement appropriate security measures, notify us promptly of any security breaches, and delete or return personal information upon termination of the agreement.

9. Complaints

If you believe your personal information has been processed in violation of POPIA:

Step 1: Contact Us

Email privacy@omnifield.africa with details of your complaint. We aim to resolve all complaints within 30 days.

Step 2: Escalation to the Information Regulator

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

Email: enquiries@inforegulator.org.za
Phone: 010 023 5200
Website: www.justice.gov.za/inforeg
Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

For comprehensive information about our data practices, please also review:

This POPIA Compliance Statement is reviewed and updated regularly to ensure ongoing compliance with the Protection of Personal Information Act 4 of 2013.