1. Introduction
This Privacy Policy explains how Ratestrack ("Ratestrack", "we", "us", "our") collects, uses, discloses, and safeguards personal information when you use our website and online services at https://ratestrack.co.za (the "Site") and related tools. We prepared this policy to comply with the Protection of Personal Information Act, 2013 ("POPIA").
By using the Site, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Site.
2. Who We Are (Responsible Party) and Contact Details
Ratestrack is a data analytics platform that provides analytics solutions that allow users to track and monitor their municipal rates and expenses of supported municipalities such as the City of Cape Town and City of Johannesburg municipal invoices.
Responsible Party: Ratestrack Information Officer: Ratestrack Information Officer Email: [email protected] Website: https://ratestrack.co.za
3. What Personal Information We Collect
We collect personal information that you provide directly and information collected automatically when you use the Site. The categories we process include:
3.1 Information You Provide
- Account registration data: first name, last name, phone number, email address and password.
- Additional profile data (optional): We may now or in the future allow users to provide additional data such as property related data to provide enhanced service related to the tracking and monitoring of their expense. These may include the data such as expenses related to their properties' additional expenses, bond expenses, and other miscellaneous expenses.
- Communications: email address, phone number (optional, if provided), and the content of your messages when you contact support.
- Additional property related data inputs: property type, building size, construction value, location (e.g., suburb/area), and other inputs you provide to generate expenses. We treat these inputs as customer-submitted content and process them to deliver the requested expenses and improve our tools.
We do not intentionally request South African ID numbers, financial account numbers, or special personal information (e.g., health, religious beliefs). Please avoid submitting such information to us. If you do, we will take reasonable steps to delete or minimise it.
3.2 Information Collected Automatically
- Usage and event data: pages viewed, referring/exit pages, timestamps, feature interactions (e.g., use of the property details page and related prompts), and basic performance metrics.
- Device and technical data: IP address, approximate location (derived from IP), browser type, operating system, device type, and screen resolution.
- Cookies and similar technologies: We use cookies and similar technologies to operate the Site, keep you signed in, remember preferences, measure performance, and understand feature usage. See Section 11 below.
- Metadata associated with invoice data extraction, which is conducted through rigorous removal of any PII and other sensitive personal data prior to the extraction process.
3.3 Information from Third-Party Sources
- Authentication providers: If you choose to sign in using an external identity provider (e.g., a social login), we receive limited profile information (such as your verified email and name) from that provider.
- Analytics, diagnostics, and error monitoring providers: We use service providers to help us understand how the Site is used, identify problems, and improve reliability. These providers receive usage, event, and technical data described above.
- Invoice data within the extraction process, which is conducted through rigorous removal of any PII and other sensitive personal data prior to extraction.
4. How We Use Personal Information
We use personal information for the following purposes:
- Provide and maintain the Site and services, including account creation, authentication, access control, and delivery of dashboards, tools, and estimates.
- Understand usage and improve the Site, including analysing feature adoption and performance, and developing new functionality. We rely on aggregated and de-identified analytics wherever feasible.
- Communicate with you about the Site, including service messages, policy updates, and responses to support requests.
- Ensure security, prevent abuse, detect fraud, debug, and investigate errors or outages.
- Marketing with consent: where you opt in, we may send you product updates and promotional messages; you can opt out at any time via the message footer or by contacting us.
- Comply with legal obligations and enforce our terms.
5. Our Analytics and Diagnostics Practices (What is Collected)
To keep this section transparent and tailored to how the Site works today:
- Page views and navigation: When you visit pages, we record a page view event and the current URL. Where possible, we avoid putting sensitive information in URLs. Please do not include personal or sensitive data in query parameters.
- Feature usage events: We record events related to feature interactions (e.g., viewing or acting on conversion prompts, dismissals, and certain estimator interactions) to measure effectiveness and guide improvements.
- Error and performance telemetry: We collect error reports, stack traces, performance timing, and basic device/browser metadata to diagnose issues and improve reliability.
- Session replays for quality and debugging: From time to time, we may capture anonymised session replays to reproduce issues. We configure our tooling to mask on-screen text and block media by default and to sample only a portion of sessions (with a higher sampling rate when an error is encountered). Session replays are used only for quality assurance, support, and safety/security purposes and are not used for behavioural advertising.
We strive to minimise personal data in analytics, which we collect anonymously. We do not use analytics to infer sensitive characteristics, and we do not sell personally identifying information.
6. Legal Grounds for Processing (POPIA)
We rely on the following justifications under POPIA:
- Consent: for non-essential cookies/analytics and marketing communications where required.
- Performance of a contract: to create and manage your account and deliver the services you request.
- Legitimate interests: to maintain and improve the Site, ensure security, prevent fraud/misuse, and measure service performance, balanced against your rights and expectations.
- Legal obligations: to comply with applicable laws and enforce our terms.
7. Sharing and Disclosure
We do not sell any personally identifying information. We share personal information with:
- Service providers (operators) under contract who process data on our behalf, including hosting and infrastructure, authentication, analytics and diagnostics, error monitoring, email and communications, customer support tools, and (in future) payment and subscription management. These providers are bound by confidentiality and data protection obligations and may only process personal information per our instructions.
- Professional advisers (legal, accounting) subject to confidentiality obligations.
- Authorities, courts, and regulators where required by law or to protect rights, safety, or property.
- A successor entity in connection with a merger, acquisition, or corporate reorganisation, subject to appropriate safeguards and notice where required.
8. Cross-Border Transfers
Your personal information may be transferred to and processed in countries outside South Africa (for example, where our service providers host systems or provide support). Where we transfer personal information cross-border, we ensure that the recipient is subject to a law, binding corporate rules, or binding agreements that provide an adequate level of protection substantially similar to POPIA, or we obtain your consent where appropriate. Additionally we go to great length to remove any personally identifiable data that may be present in the invoices before sending any cross-border transfers of the data for hosting or processing services.
9. Security
We implement technical and organisational measures appropriate to the risk, including:
- Encryption in transit (TLS) and, where supported by our providers, encryption at rest.
- Access controls, least-privilege permissions, and audit logging for administrative access.
- Segregation of environments and defensive monitoring for abuse and fraud.
- Secure authentication and session management through reputable identity services.
- Regular reviews of security controls and practices.
- Programmatic removal of any personally identifiable information from the invoices submitted by users.
No method of transmission or storage is fully secure. If we become aware of a security compromise that is likely to result in real risk of harm, we will notify affected individuals and the Information Regulator as soon as reasonably possible, in line with POPIA.
10. Retention
We keep personal information only as long as necessary for the purposes described in this policy or as required by law. In general:
- Account data is retained for the life of the account and deleted or irreversibly de-identified within a reasonable period after closure, subject to legal holds.
- Communications and support records are kept for up to 24 months, unless we need them longer for legal or operational reasons.
- Analytics, diagnostics, and session replay data are retained for a limited period suitable for troubleshooting and trend analysis (typically not more than 24 months) and may be aggregated/de-identified for longer-term metrics.
Backups may retain data for additional limited periods. Where deletion is not immediately possible, we will securely store and isolate data from further processing until deletion occurs.
11. Cookies and Similar Technologies
We use:
- Strictly necessary cookies: required for core functions such as authentication, security, and load balancing. These cannot be switched off in our systems.
- Analytics and performance cookies: help us measure usage, diagnose problems, and improve features. These are set only where permitted by law and your settings.
Your choices:
- Browser controls: you can block or delete cookies via your browser settings. Blocking some cookies may affect Site functionality.
- Marketing preferences: you can opt out of marketing emails via unsubscribe links or by contacting us.
12. Your Rights Under POPIA
You have the right to:
- Be notified that personal information about you is being collected.
- Request access to personal information we hold about you.
- Request correction of personal information that is inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained.
- Request deletion of personal information where POPIA allows.
- Object to or restrict certain processing, including direct marketing.
- Withdraw consent where processing is based on consent (this will not affect processing carried out before withdrawal).
To exercise your rights, contact [email protected]. We may verify your identity before actioning your request and may refuse a request where a POPIA exception applies. You also have the right to lodge a complaint with the Information Regulator (South Africa). See https://inforegulator.org.za for current contact details.
13. Children
The Site is not directed at persons under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us so we can delete it immediately.
14. Automated Decision-Making
We do not use solely automated decision-making that has legal or similarly significant effects on individuals. We do however have robust programmatic methodologies for stripping personal data before any extraction process.
15. Third-Party Links
The Site may contain links to third-party sites or services. We are not responsible for their privacy practices. We encourage you to review their privacy notices.
16. Changes to This Policy
We may update this policy from time to time. The updated version is effective when posted, as indicated by the "Last Updated" date above. Material changes will be notified via the Site or by email where appropriate.
17. Contact Us
Questions, requests, or complaints regarding this policy or our processing of personal information can be sent to [email protected]. You may also contact the Information Regulator (South Africa) via https://inforegulator.org.za.