CrewRoutes
CrewRoutes Operator Agreement (POPIA)
This agreement is accepted electronically. When the owner of a business ticks "I accept" in the CrewRoutes app, CrewRoutes records the business name, the owner's name and login, the date and time, and this version number. That record counts as the signature of both parties.
1. Parties and background
This agreement is between:
- Andreas van Tonder, trading as CrewRoutes (also trading as Alpha Nexus Solutions) ("CrewRoutes", the operator); and
- the business that accepts this agreement in the CrewRoutes app, represented by the owner who accepts it ("the Business", the responsible party).
1.1 The Business uses CrewRoutes, an online app, to keep its client list, plan routes, record visits, keep track of payments and staff, and send reminders to its staff.
1.2 To provide the app, CrewRoutes stores and processes personal information on the Business's behalf. Under the Protection of Personal Information Act 4 of 2013 (POPIA), the Business is the responsible party and CrewRoutes is its operator.
1.3 Sections 20 and 21 of POPIA require a written contract between a responsible party and its operator. This agreement is that contract. It forms part of, and takes priority over anything inconsistent in, the CrewRoutes subscription terms.
2. Definitions
Words defined in POPIA have the same meaning here. In particular:
- Personal information means information about an identifiable person, as defined in section 1 of POPIA.
- Processing means anything done with personal information, including collecting, storing, using, changing, sending and deleting it.
- Client means a customer of the Business whose details are kept in CrewRoutes.
- Staff user means an owner or team member of the Business who has a CrewRoutes login.
- Worker means a person the Business employs whose attendance and pay the Business records in CrewRoutes, whether or not they have a login.
- Sub-operator means another company CrewRoutes uses to run the app, listed in Schedule A.
- Security compromise means any reasonable belief that personal information has been accessed or acquired by someone not authorised to do so.
3. What is processed, whose, and why
| Whose information | What information | Why it is processed |
|---|---|---|
| Clients of the Business | Name, contact person, phone number, email, street address, map location, service day, frequency and preferred time, team, notes entered by the Business (for example gate codes or pets), visit dates and job start and finish times, price per visit, payment terms and payment records. For dog care businesses: the dog's name and details, and bookings. | To plan routes, show staff where to go and what to know on arrival, record completed visits, remind staff of upcoming visits, and show the Business what each client owes and has paid |
| Staff users | Name, email, password (stored scrambled, never readable), role, team, reminder time, phone notification details | To give each person a login, show them the right work, and send them reminders |
| Workers | Name, phone number, daily rate, days at work, absent, on leave or home early, money borrowed, and weekly pay records | To let the Business keep its own attendance and pay records |
3.1 CrewRoutes processes this information only to provide, support, secure and improve the app for the Business, and for no other purpose.
3.2 CrewRoutes does not sell, rent or share personal information for marketing, and does not use the Business's client information to contact its clients.
3.3 The Business decides what information is entered. CrewRoutes does not ask for special personal information (such as health, religion or race) and the Business agrees not to enter it.
4. CrewRoutes' duties as operator
4.1 Instructions only. CrewRoutes processes personal information only with the knowledge or authorisation of the Business (section 20(a) of POPIA). Using the app as designed, and any written request from the Business, counts as an instruction.
4.2 Confidentiality. CrewRoutes treats all personal information as confidential and does not disclose it, unless the law requires it or the Business agrees (section 20(b)). If the law requires disclosure, CrewRoutes tells the Business first where it is allowed to.
4.3 People with access. Only people who need access to support or run the app may see the Business's information. Each of them is bound to keep it confidential. CrewRoutes will not sign in to the Business's account to look at client information unless the Business asks for help, or it is needed to fix a fault or a security problem. Every such support session is logged.
4.4 No other use. CrewRoutes does not combine the Business's client information with other businesses' information, and does not use it to build profiles of clients.
5. Security measures
CrewRoutes keeps reasonable technical and organisational measures in place to protect personal information against loss, damage and unauthorised access (section 19, required by section 21(1)). These include:
- Separation between businesses. The database itself checks every request, so one business can never see or change another business's information.
- Role-based access. Team members see only their own team's work; only owners can manage clients, prices, payments, staff records, settings and logins.
- Encryption in transit. All traffic between phones and the app uses HTTPS.
- Secure logins. Passwords are stored scrambled (hashed) and cannot be read by anyone, including CrewRoutes.
- Phones. Information saved on a phone for offline use is cleared when the user signs out.
- Secret keys for outside services are kept on the server, never in the app.
5.1 CrewRoutes reviews these measures regularly and updates them as risks change (section 19(2)).
5.2 The Business is responsible for keeping its own logins safe, removing logins of staff who leave, and storing any backups it downloads somewhere private.
6. Data breaches
6.1 If CrewRoutes has reasonable grounds to believe the Business's personal information has been accessed or acquired by an unauthorised person, it tells the Business immediately, and in any case within 24 hours of becoming aware (section 21(2)).
6.2 The notice goes to the Business's main contact, and says what is known: what happened, which information was affected, what CrewRoutes has done about it, and what the Business should do.
6.3 CrewRoutes takes reasonable steps straight away to stop the breach and limit the harm, and keeps the Business updated as it learns more.
6.4 Under section 22 of POPIA, the Business must notify the Information Regulator and the affected clients. CrewRoutes helps the Business do so, including with the information needed for those notices.
7. Sub-operators and storage outside South Africa
7.1 The Business agrees that CrewRoutes may use the sub-operators listed in Schedule A to run the app. CrewRoutes only uses sub-operators that commit to security and confidentiality at least as strong as this agreement, and remains responsible to the Business for their work.
7.2 CrewRoutes gives the Business at least 30 days' written notice before adding or replacing a sub-operator that handles client information. The Business may object on reasonable grounds; if the parties cannot agree, the Business may end its subscription without penalty.
7.3 Some personal information is stored or passes through servers outside South Africa, mainly the main database in London, United Kingdom. Under section 72 of POPIA such a transfer is allowed where the recipient is bound by a law, binding agreement or binding corporate rules giving protection substantially similar to POPIA. CrewRoutes relies on the data protection laws of the countries concerned (such as the UK GDPR) and on each sub-operator's data processing terms.
7.4 The Business agrees to these transfers and will mention in its privacy notice to clients that information is stored with a secure cloud provider, including outside South Africa.
8. Helping the Business
8.1 Client requests. Clients have the right to ask what information is held about them, and to have it corrected or deleted (sections 23 to 25). The Business can do most of this itself in the app: view, edit or delete a client, or export the client list. Where it cannot, CrewRoutes helps within 10 working days of a written request.
8.2 If a client contacts CrewRoutes directly, CrewRoutes passes the request to the Business and does not answer it on the Business's behalf unless asked to.
8.3 The Information Regulator. CrewRoutes co-operates with the Business, and with the Information Regulator, in any enquiry or investigation about the Business's information.
8.4 Information about compliance. On reasonable request, and not more than once a year unless there has been a breach, CrewRoutes gives the Business a written summary of how it meets this agreement.
9. The Business's duties
As the responsible party, the Business remains accountable for its clients' and workers' information (section 8). The Business agrees to:
- Have a lawful reason for each piece of information it enters. For providing the service a client has agreed to, this is performance of a contract (section 11(1)(b)).
- Tell its clients, in a short privacy notice, what information it keeps, why, and that it is stored in an online app run by a service provider (section 18).
- Get a client's consent before sending them marketing messages, and honour any request to stop.
- Keep information accurate and up to date, and delete clients it no longer serves when it no longer needs their records.
- Register its information officer with the Information Regulator.
- Give logins only to people who need them, and remove them when staff leave.
10. Ending the agreement
10.1 This agreement runs for as long as the Business uses CrewRoutes, and ends when the subscription ends.
10.2 Export. For 30 days after the subscription ends, the Business can sign in and download a full backup of its information. CrewRoutes will send a copy on request in that period.
10.3 Deletion. Within 60 days after the subscription ends, CrewRoutes permanently deletes the Business's personal information from the app, unless the law requires it to be kept longer. Any copies in the database provider's automatic backups are overwritten in the normal course, within a further 30 days.
10.4 On request, CrewRoutes confirms in writing that the deletion has been done.
10.5 Sections 4 (confidentiality), 6 (breaches) and 10 continue to apply after the agreement ends, for as long as CrewRoutes holds any of the Business's information.
11. General terms and acceptance
11.1 Liability. Each party is responsible for its own failure to meet this agreement or POPIA. CrewRoutes' total liability under this agreement is limited to the subscription fees the Business paid in the 12 months before the claim, except for breaches of confidentiality or wilful misconduct.
11.2 Changes. Changes to this agreement must be in writing and accepted by both parties. A new version is accepted by the owner ticking "I accept" in the app. A change POPIA or the Information Regulator requires may be made by CrewRoutes on 30 days' notice.
11.3 Electronic acceptance. The parties agree that accepting this agreement in the app is a valid signature under the Electronic Communications and Transactions Act 25 of 2002. The owner who accepts confirms that they may bind the Business.
11.4 Governing law. This agreement is governed by the law of the Republic of South Africa.
11.5 Contacts. CrewRoutes: Andreas van Tonder, andreas@alphanexusolutions.com. The Business's information officer: the owner who accepts this agreement, unless the Business tells CrewRoutes otherwise in writing.
Schedule A: Sub-operators
CrewRoutes updates this list as described in section 7.2.
| Sub-operator | What it does for CrewRoutes | Information it handles | Where |
|---|---|---|---|
| Supabase | Main database, logins, reminder server | All client, visit, payment, staff-user and worker information | London, United Kingdom |
| Cloudflare | Hosts and delivers the app | App files and business logos; no client records are stored | Global network |
| OpenStreetMap Foundation (Nominatim) | Finds map locations from addresses | Address text, sent when a client is added or an address changes | Europe |
| HeiGIT (OpenRouteService) | Road distances for route planning | Map locations only, no names | Germany |
| Google, Apple and Mozilla push services | Deliver reminder notifications to phones | The reminder text: client names and addresses for the day, and for owners, which clients have payments due | Per provider, mainly United States |
| Resend (only if email reminders are switched on) | Sends reminder emails | Staff email address and the reminder text | United States |