Easetech

Privacy Policy

Last updated: 10 October 2026

1. Introduction

This Privacy Policy explains how Pritster Holdings (Pty) Ltd trading as Easetech (“Easetech”, “we”, “us”, “our”) collects, uses, stores, discloses and protects Personal Information when you use:

  • the public website at https://easetech.co.za and any subdomains (the “Website”); and
  • the login-based wayleave and AOI tools accessed via the Website (the “Platform”).

It applies to visitors, customers, and Authorised Users (people who use the Platform on behalf of an organisation).

We process Personal Information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable data protection laws.

This Policy should be read with our Terms of Use. If you do not agree with this Policy, you must not use the Website or Platform.

2. Who we are

  • Responsible party: Pritster Holdings (Pty) Ltd t/a Easetech
  • Registration number: 2017/033918/07
  • Registered / postal address: 7 Fulham Road, Bakoven, Western Cape, 8005, South Africa
  • Support: support@easetech.co.za
  • Telephone: (010) 745-4941
  • WhatsApp: +27 82 699 6888

Information Officer: Gareth Brown, Director. Privacy requests can be sent to support@easetech.co.za, marked "For the attention of the Information Officer".

We are the responsible party (controller) for Personal Information we process to operate the Website and Platform. Independent third parties (for example Google, in respect of your Google Account) are responsible parties for the processing they carry out under their own policies.

3. Personal Information we collect

The types of Personal Information we may process include:

3.1 Identity and contact details

  • First name and last name
  • Email address
  • Telephone / mobile number
  • Job title or position (where you provide it)
  • Profile photograph, only if you upload one. If you sign in with Google we may receive a Google profile-photo URL in Google’s token; we do not currently store that photograph on your Easetech profile

3.2 Organisation and account details

  • Organisation (the tenant / operator you register under, for example an Easetech, Fibertime or other branded portal)
  • Company name, address, company email, company phone, VAT number and company registration number (collected at company registration, or inherited if a Manager invited you to an existing company)
  • User role / profile type. Self-registration always creates a Client. Any other role (Agent, Manager, government, service provider, and similar) is assigned afterwards by a Manager
  • Which portal you use (wayleave or AOI)

The same email address may exist under more than one organisation. Each organisation’s data is held separately.

3.3 Authentication and security data

  • Password hash (accounts created with email and password only). We never store your password in reversible form
  • Google Sign-In accounts have no local password. We do not receive or store your Google password
  • Session records (see section 12): refresh-token identifiers, trusted-device identifiers (stored as hashes), login one-time-code challenge records (stored as hashes, never the code itself)
  • Browser / device information used for security (for example user agent on a trusted device)

3.4 Platform content you submit

  • Wayleave / AOI application and project information
  • Location, map geometry and service-area information
  • Stakeholder, applicant and authority details you enter
  • Documents, drawings and signatures you upload
  • Support and other communications with us

3.5 Billing and payment records

  • Quotations, invoices and records of application-fee payments (amount, reference, status)
  • Card and bank details are entered on PayFast's own payment page and are never received or stored by us. We receive only a notification that a payment succeeded or failed

3.6 Technical and usage data

  • IP address, browser type, device type, and similar technical data
  • Usage logs (pages viewed, actions in the Platform, error logs)
  • Cookie and local-storage identifiers described in section 12

3.7 Marketing / CRM data

  • Name, email, phone and organisation, sent to HubSpot when you register (see sections 8 and 13)

We do not intentionally collect special personal information (as defined in POPIA) unless you include it in documents you upload. Please do not upload health, biometric or similar data unless a wayleave process strictly requires it.

4. How we collect Personal Information

We collect Personal Information:

  1. Directly from you, when you:
    • create an account (email/password or Google);
    • complete company registration (including contact phone, if it was not collected earlier);
    • submit applications, maps, documents or messages;
    • contact us by email, phone, WhatsApp or the Website;
  2. From Google, if you use Sign in with Google or Sign up with Google (section 5);
  3. From other users in your organisation, for example a Manager who creates or links a user profile, or colleagues who add you to an application;
  4. Automatically, through cookies, local storage, logs, Google Tag Manager, FullStory, Mapbox and similar technologies (section 12);
  5. From service providers who process data on our behalf (section 9), where that is necessary to provide the Services.

5. Google Sign-In and Sign-Up

We offer Sign in with Google and Sign up with Google as an alternative to email and password.

If you choose this option:

  • Google authenticates you and sends us a short-lived ID token. We verify that token with Google.
  • The token typically includes your email address, given name, family name, and whether Google has verified the email. It may also include a profile-photo URL, which we do not currently save on your profile.
  • We use that information to find an existing account in the organisation whose site you are using, or to create a new Client account if none exists and registration is allowed.
  • We do not receive your Google password and we do not get access to your Gmail, Drive or other Google data. The scopes we request are limited to OpenID, email and profile.
  • If Google has not verified the email, we will not treat it as confirmed. We may send our usual confirmation email instead of signing you in.
  • A new Google account has no Easetech password. You cannot log in with email/password until you set one via Forgot password.
  • If your account already exists, we may record that you last authenticated via Google.

Google’s own processing of your Google Account is governed by Google’s Privacy Policy. You can review and revoke third-party access in your Google Account. Revoking Google access does not by itself delete your Easetech account; contact us if you want the Easetech account closed.

You cannot complete Sign up with Google until you have ticked that you agree to our Terms of Use and this Privacy Policy. That is the same consent we require for password registration.

6. Legal basis for processing (POPIA)

We process Personal Information only where a lawful ground applies. In practice:

  • Contract (necessary to conclude or perform a contract with you or your organisation) — creating and managing your account; signing you in; providing the Platform; processing wayleave / AOI applications; sending transactional email (confirmation, password reset, login verification codes).
  • Consent — the Terms / Privacy tick at registration; marketing communications (section 13); non-essential cookies and analytics once a consent banner is in place. You may withdraw consent as set out in section 11.
  • Legitimate interests — securing the Platform (2FA, trusted devices, single active session, logs, fraud and abuse prevention); improving reliability; understanding how the product is used, in a manner that does not override your rights.
  • Legal obligation — where we must retain or disclose information to comply with law, a court order, or a regulator.

Where you act for an organisation, you warrant that you are authorised to provide Personal Information of other people (colleagues, applicants, landowners, officials) and that any required notices or consents have been given.

7. Purposes of processing

We process Personal Information to:

  • provide, operate and support the Website and Platform;
  • create and manage user accounts and company records;
  • authenticate you (password, Google, and email one-time codes for Agent and Manager roles);
  • keep you signed in, and recognise a browser you have asked us to trust for 14 days;
  • enforce one active session per user (a new login ends other open sessions);
  • send transactional messages (email confirmation, password reset, login verification codes, application notices);
  • submit and process wayleave / AOI applications, including maps and stakeholder lists;
  • verify and share information with authorities, utilities and other parties where that is part of the service you asked us to perform;
  • sync a new registration to HubSpot so we can administer the relationship (section 13);
  • host maps and location tools (Mapbox);
  • maintain security, prevent abuse, debug errors, and improve the Platform;
  • send service updates and, where permitted, marketing (section 13);
  • comply with law and protect our legal rights.

We do not sell Personal Information.

8. HubSpot (CRM)

When you register (password or Google), we send HubSpot:

  • first name, last name, email, mobile number (if we have it), and organisation.

For known organisation portals this is submitted to that organisation’s HubSpot form. Completing registration currently also records agreement to the Terms of Use and Privacy Policy against the relevant HubSpot subscription. This is not a separate marketing tick on the form. If you do not want marketing messages, opt out using the link in those emails or contact support@easetech.co.za.

HubSpot is operated by HubSpot, Inc. and related companies. Their processing is described in HubSpot’s Privacy Policy. The Website also loads HubSpot’s tracking script for visitors.

9. Who we share Personal Information with

We share Personal Information only as needed for the purposes above.

9.1 Operators (service providers)

These parties process information on our instructions, or provide infrastructure we use:

  • DigitalOcean — cloud hosting of the Website, Platform, databases, file storage and backups, in its data centre in Amsterdam, the Netherlands
  • Google — Google Sign-In / Sign-Up (Identity); Google Tag Manager and related measurement on the Website; Google Workspace for our internal documents
  • HubSpot — CRM, registration forms, marketing lists, Website tracking script
  • Mailgun — transactional email delivery
  • Mapbox — maps, geocoding and drawing tools (location and geometry you enter are processed by Mapbox to render the map)
  • FullStory — product analytics and session replay on the Website and Platform
  • PayFast — online payment of application fees (section 3.5)
  • Microsoft — our company email (Microsoft 365), including support correspondence; and the Office Online viewer, which receives a Word, Excel or PowerPoint document when you preview it in the Platform
  • Calendly — meeting booking widget on the marketing Website
  • IT and software development providers (for example GitHub, and AI-assisted development tools from Anthropic), which may incidentally see limited Personal Information, such as an email address in an error log, while we build, support and fix the Platform

Each operator’s own terms and privacy policy apply to the services they provide.

9.2 Your organisation and counterparties

  • Administrators and other Authorised Users in your organisation, according to their roles
  • Authorities, municipalities, utilities, landowners and other stakeholders when you (or your organisation) use the Platform to submit or process an application

9.3 Legal and corporate

  • Professional advisers (attorneys, auditors) under confidentiality
  • A purchaser or successor if we transfer the business, on notice where required
  • Courts, regulators or law enforcement where required by law or to protect rights, safety or the Platform

We require operators who process Personal Information for us to do so in line with POPIA and only for the purposes we specify, so far as we can impose that by contract.

10. Cross-border transfers

Easetech is a South African company, but the Website and Platform, including their databases, files and backups, are hosted outside South Africa, in DigitalOcean's data centre in Amsterdam, the Netherlands. The Netherlands is in the European Union, whose data protection law (the GDPR) provides protection substantially similar to POPIA.

Several operators also process data outside South Africa, in particular in the United States and the European Union:

  • Mailgun (email delivery) and FullStory (analytics) — United States;
  • HubSpot (CRM) — European Union;
  • Google, Mapbox, Microsoft and Calendly — may process Personal Information on servers in several countries.

Where we transfer Personal Information outside South Africa we take reasonable steps to ensure an adequate level of protection, including contractual arrangements with operators, in accordance with POPIA (including section 72).

By using the Website or Platform, or by ticking acceptance of this Policy at registration, you acknowledge that such transfers may occur.

11. Your rights

Subject to POPIA and any lawful limits (for example, we may keep records that your organisation still needs for a wayleave file), you may request to:

  • access the Personal Information we hold about you;
  • correct or update inaccurate or incomplete information;
  • delete Personal Information, or object to processing, where POPIA allows;
  • withdraw consent where processing is based on consent (this will not affect processing already carried out, or processing we still need for contract or law);
  • object to direct marketing at any time (section 13);
  • lodge a complaint with the Information Regulator (South Africa): https://inforegulator.org.za, POPIAComplaints@inforegulator.org.za.

How to exercise these rights: email support@easetech.co.za, for the attention of our Information Officer (section 2), from the email address on your account, and tell us which organisation / portal the account belongs to. We may need to verify your identity.

Closing a Google connection is done in your Google Account. To close the Easetech account itself, email us. There is no self-service delete button in the Platform today.

12. Cookies, local storage and similar technologies

We use cookies and similar technologies. Some are strictly necessary for login and security. Others are used for analytics and marketing.

There is not yet a cookie-preference banner on the Website. Necessary cookies are set when you use login and security features. Analytics tools (Google Tag Manager and FullStory) currently run when you visit the Website or Platform. You can limit some third-party cookies in your browser, and you can ask us to stop marketing (section 13). A consent banner is planned; when it ships, this section will be updated.

Browser settings will not block our httpOnly session or trusted-device cookies. Those are required for the Platform to function securely.

12.1 Cookies and storage we set

  • refreshToken (httpOnly cookie) — Strictly necessary. Keeps you signed in; used to issue a new access token. Not readable by JavaScript. Typical lifetime: 1 day of inactivity, or 14 days if you choose “Remember me”, subject to a 30-day maximum from login.
  • trustedDevice (httpOnly cookie) — Strictly necessary (security). After a successful email login code, remembers this browser so Agent / Manager accounts can skip the code for 14 days, if you opted in. Typical lifetime: 14 days (does not extend on use).
  • adminTrustedDevice (httpOnly cookie) — Strictly necessary (security). Same idea for the Strapi administration panel; kept separate from the Website cookie. Typical lifetime: 14 days.
  • userToken (browser local storage) — Strictly necessary. Short-lived access token (about 60 minutes) sent with Platform requests. Typical lifetime: until you log out or the token expires.
  • refreshTokenExpiresAt (local storage) — Functional. Reminder of when the session is expected to lapse; the cookie and server remain authoritative. Typical lifetime: until cleared.
  • register-result, register-email (local storage) — Functional. Completing registration / email-confirmation screens. Typical lifetime: until cleared.
  • cookie_consent_analytics (cookie) and trackingConsent (local storage) — Analytics. Records whether analytics was treated as granted. Today this is set automatically so FullStory can load. Typical lifetime: up to 1 year if granted.

We also use session records on our servers (hashed refresh tokens, hashed trusted-device tokens, hashed one-time-code challenges). Expired or used challenges and devices are cleaned up on a daily schedule.

12.2 Third-party cookies and scripts

Google (Sign-In button and Tag Manager), HubSpot, FullStory, Mapbox and Calendly may set their own cookies or similar identifiers when their scripts or maps load. Their lifetimes and purposes are described in those providers’ policies.

12.3 Email one-time codes (not a cookie)

For Agent and Manager roles, after a correct password or Google sign-in we email a one-time code (valid for 10 minutes, limited attempts and resends). We store only a hash of the code. We do not issue a session until the code is verified, unless this browser is already a trusted device.

13. Direct marketing

We may send you information about Easetech products, services and events:

  • where you have consented; and/or
  • where POPIA otherwise permits (for example certain existing-customer communications), always with an opt-out.

Registration currently results in a HubSpot contact and a communications subscription tied to agreement with the Terms and this Policy (section 8).

You may opt out at any time via the unsubscribe link in the message, or by emailing support@easetech.co.za. Transactional messages (security codes, password reset, application notices) are not marketing and will continue as needed to provide the service.

14. Children

The Website and Platform are not intended for anyone under 18. We do not knowingly collect Personal Information from children. If you believe we have, contact us and we will delete it unless we are required to keep it.

15. Data retention

We keep Personal Information only as long as needed for the purposes in section 7, including legal, tax, audit and dispute needs of your organisation’s wayleave records.

Indicative periods for authentication data:

  • Access token — about 60 minutes
  • Refresh session — 1 day idle / 14 days with Remember me; absolute maximum 30 days from login
  • Trusted device — 14 days, then a new email code is required
  • Login verification code — 10 minutes; hashed record removed after expiry or use
  • Password-reset token — 1 hour

Account, company, application, document and correspondence records are kept for the life of the relevant organisation’s arrangement with us, and thereafter as required by law or the Master Agreement (if any). When we no longer need Personal Information we delete or de-identify it where practicable.

16. Security

We implement organisational and technical measures appropriate to the risk, including:

  • an information security policy, with a named Information Security Officer, and confidentiality obligations for everyone with access;
  • TLS encryption in transit;
  • databases and internal services that are not reachable from the internet;
  • hashing of passwords, login codes and trusted-device tokens;
  • httpOnly, SameSite cookies for refresh and trusted-device tokens;
  • short-lived access tokens;
  • role-based access inside the Platform;
  • single active session per user;
  • email verification codes for Agent and Manager logins;
  • daily removal of expired authentication challenges and trusted-device records;
  • daily backups of Platform data, stored privately.

No method of transmission or storage is completely secure. You must keep your password (if any), email account, and devices confidential, and notify us of unauthorised use.

If we have reasonable grounds to believe that your Personal Information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22 of POPIA.

17. Third-party websites and services

The Website and Platform may link to third-party sites or load third-party services (including those in section 9). We do not control those parties. Your use of them is subject to their terms and privacy policies. This Policy applies only to Personal Information we process as described here.

18. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date will change, and the new version takes effect when it is posted on the Website.

Where a change materially affects your rights, we will try to give reasonable notice on the Website or by email to account holders, where practicable. If you continue to use the Website or Platform after the effective date, you accept the updated Policy — except that we will not treat silence as consent for a new processing purpose that POPIA requires consent for.

19. Contact and complaints

For privacy requests, questions or complaints:

Easetech
7 Fulham Road, Bakoven, Western Cape, 8005
support@easetech.co.za
Tel: (010) 745-4941

Please include the email on the account, the organisation / portal (for example easetech.co.za vs a white-label subdomain), and a description of the request.

If we cannot resolve a complaint, you may contact the Information Regulator (South Africa):

© Pritster Holdings (Pty) Ltd t/a Easetech. All rights reserved.

Follow uson LinkedIn
© 2026 easetech. All Rights Reserved
Navigation
Wayleave guide
Our Services
Contact us
Phone:
082 699 6888
010 745 4941