Privacy Policy

1. Introduction

Big Boss Tree Felling (“we,” “us,” or “our”) is committed to protecting your privacy and complying with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) (“POPIA”) and all applicable South African data protection legislation. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our tree felling and arboriculture services in Gauteng, South Africa.

By engaging our services, visiting our website, or providing us with your personal information, you consent to the practices described in this Privacy Policy.

2. Information Regulator Contact Details

This Privacy Policy is prepared in accordance with POPIA. If you have concerns about how we process your personal information, you may contact the Information Regulator:

3. Definitions

4. Responsible Party Details

Big Boss Tree Felling is the Responsible Party in terms of POPIA for all personal information collected and processed through our business operations.

5. Personal Information We Collect

We collect personal information necessary to provide our tree felling services, respond to enquiries, and fulfil our legal and contractual obligations. The types of personal information we may collect include:

5.1 Contact Information

• Full name and surname
• Physical address (property location for service delivery)
• Postal address
• Email address
• Telephone and mobile numbers
• WhatsApp contact details

5.2 Property and Service Information

• Property ownership details or tenant authorization
• Property photographs showing trees and surrounding structures
• GPS coordinates and location data for service delivery
• Tree species, size, condition, and location on property
• Service requirements and project specifications
• Site access requirements and restrictions
• Proximity to power lines, structures, and neighbouring properties

5.3 Financial Information

• Billing and payment information
• Banking details for refunds (where applicable)
• Payment history and transaction records
• Quotation and invoice details

5.4 Communication Records

• Email correspondence
• WhatsApp and SMS communications
• Telephone call recordings (where legally permitted and notice is provided)
• Social media interactions and messages
• Website contact form submissions

5.5 Identity Verification Information

• Identification documents (when required for contractual purposes)
• Company registration details (for commercial clients)
• VAT registration information (for commercial transactions)

5.6 Technical Information (Website Users)

• IP address and device identifiers
• Browser type and version
• Operating system
• Referring website and pages viewed
• Date and time of website visits
• Cookies and similar tracking technologies

5.7 Photographic and Video Records

• Before, during, and after photographs of work performed
• Video footage for safety documentation and training purposes
• Marketing and promotional images (only with explicit consent)

6. How We Collect Personal Information

We collect personal information through various channels:

• Direct Collection: When you request a quotation, book our services, communicate with us via phone, email, WhatsApp, or social media, or provide information during site visits
• Website Forms: Through contact forms, quotation request forms, and appointment scheduling tools on our websites
• Third-Party Platforms: Through Google Business Profile, Facebook, WhatsApp Business, and other platforms where you may contact us
• Automatic Collection: Through cookies and analytics tools when you visit our websites
• Physical Site Visits: During property assessments, quotation preparation, and service delivery
• Third-Party Referrals: When referred by estate agents, property managers, insurance companies, or other service providers

7. Purpose of Processing Personal Information

We process your personal information for the following lawful purposes in accordance with Section 11 of POPIA:

7.1 Service Delivery (Contractual Necessity)

• Providing tree felling, pruning, stump removal, and related arboriculture services
• Preparing accurate quotations and cost estimates
• Scheduling appointments and coordinating service delivery
• Conducting site assessments and safety evaluations
• Communicating about service progress and completion
• Managing customer relationships and service quality

7.2 Legal and Regulatory Compliance

• Complying with POPIA and other data protection legislation
• Meeting tax obligations and financial record-keeping requirements
• Complying with Health and Safety legislation
• Maintaining insurance records and claims documentation
• Responding to legal processes, court orders, and regulatory requests
• Complying with municipal and environmental regulations

7.3 Financial Management

• Processing payments and managing accounts
• Issuing invoices and receipts
• Managing credit arrangements
• Debt collection (where necessary)
• Financial auditing and accounting

7.4 Marketing and Business Development (With Consent)

• Sending promotional materials and special offers
• Distributing newsletters and service updates
• Conducting customer satisfaction surveys
• Requesting reviews and testimonials
• Marketing our services through social media and digital advertising

7.5 Safety and Risk Management

• Documenting work performed for safety and liability purposes
• Maintaining records for insurance claims
• Conducting safety training and quality assurance
• Investigating accidents or incidents
• Managing risk and preventing fraud

7.6 Website Operation and Improvement

• Operating and maintaining our websites
• Analyzing website usage and improving user experience
• Troubleshooting technical issues
• Enhancing website security and preventing fraud

7.7 Legitimate Business Interests

• Improving service quality and customer satisfaction
• Developing new services and business strategies
• Managing business operations and administration
• Protecting business assets and intellectual property
• Establishing, exercising, or defending legal claims

8. Legal Basis for Processing

We process your personal information based on the following lawful grounds under POPIA:

• Consent: You have given explicit consent for us to process your personal information for specific purposes (such as marketing communications)
• Contractual Necessity: Processing is necessary to fulfill our contractual obligations to provide tree felling services
• Legal Obligation: Processing is required to comply with South African laws, including tax, health and safety, and environmental legislation
• Legitimate Interest: Processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms

9. Disclosure and Sharing of Personal Information

We may share your personal information with third parties under the following circumstances:

9.1 Service Providers and Contractors (Operators)

We may share personal information with operators who assist in delivering our services:

• Subcontractors performing specialized tree work
• Equipment rental companies
• Waste removal and disposal services
• Payment processing service providers
• IT service providers and website hosting companies
• Marketing and communications service providers
• Cloud storage providers

All operators are contractually bound to process personal information only as instructed and to maintain appropriate security measures.

9.2 Legal and Regulatory Bodies

• The South African Revenue Service (SARS) for tax compliance
• Law enforcement agencies when required by law
• Courts and legal representatives in connection with legal proceedings
• The Information Regulator when required
• Municipal authorities for compliance verification
• Environmental authorities when required

9.3 Insurance Companies

• Our liability insurance providers for claims management
• Your insurance company if you file a claim related to our services

9.4 Business Partners

• Estate agents and property managers (with your consent)
• Landscape designers and architects
• Construction companies

9.5 Business Transfers

In the event of a merger, acquisition, sale of assets, or other business transaction, personal information may be transferred to the acquiring entity, subject to the same privacy protections.

10. Cross-Border Data Transfers

Some of our service providers (such as website hosting, cloud storage, and email services) may store or process data in servers located outside South Africa. When we transfer personal information across borders, we ensure:

• The recipient country has adequate data protection laws as determined by the Information Regulator, or
• Appropriate safeguards are in place through contractual agreements that meet POPIA requirements, or
• We obtain your explicit consent for the transfer

You have the right to object to cross-border transfers of your personal information.

11. Security of Personal Information

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect against unauthorized access, alteration, disclosure, or destruction. These measures include:

11.1 Technical Security Measures

• Secure Sockets Layer (SSL) encryption for website communications
• Encrypted storage of sensitive financial information
• Firewalls and intrusion detection systems
• Regular software updates and security patches
• Secure password policies and multi-factor authentication
• Regular data backups with encryption
• Antivirus and anti-malware protection

11.2 Organizational Security Measures

• Limiting access to personal information to authorized personnel only
• Employee confidentiality agreements and training
• Regular security awareness training
• Documented information security policies and procedures
• Secure physical storage of paper records
• Visitor access controls at business premises
• Regular security audits and risk assessments

11.3 Third-Party Security

• Contractual obligations requiring service providers to maintain security standards
• Regular review and assessment of third-party security practices
• Due diligence before engaging new service providers

12. Retention of Personal Information

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Our retention periods are based on:

12.1 Legal Requirements

• Financial Records: 5 years after the last transaction (as required by the Income Tax Act)
• Contracts: Duration of the contract plus 3 years (as prescribed by the Prescription Act)
• Employee Records: As required by labor and employment legislation
• Health and Safety Records: As required by the Occupational Health and Safety Act

12.2 Business and Operational Needs

• Customer Service Records: Retained for 3-5 years to manage warranty claims and service history
• Marketing Records: Until you withdraw consent or request deletion
• Quotation Records: 2 years from date of quotation
• Website Analytics: 26 months (standard Google Analytics retention period)

12.3 Secure Destruction

When personal information is no longer required, we securely destroy or permanently delete it using methods appropriate to the format:

• Digital records: Secure deletion and overwriting of data
• Physical records: Secure shredding and disposal
• Backup systems: Removal from regular backup cycles

13. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights regarding your personal information:

13.1 Right to Access (Section 23)

You have the right to request confirmation of whether we hold personal information about you and to access that information. We will provide you with:

• A description of the personal information we hold
• The purposes for processing
• Details of third parties who have access to your information
• Available information about the source of the information

13.2 Right to Correction (Section 24)

You have the right to request correction, destruction, or deletion of your personal information if it is:

• Inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or
• Obtained unlawfully or
• No longer necessary for the purpose for which it was collected

13.3 Right to Object (Section 11(3))

You have the right to object, on reasonable grounds, to the processing of your personal information. This includes:

• Objecting to direct marketing communications (opt-out)
• Objecting to automated decision-making
• Objecting to processing that affects you adversely

13.4 Right to Erasure (“Right to be Forgotten”)

You may request deletion of your personal information, subject to our legal obligations to retain certain records.

13.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format for transfer to another service provider.

13.6 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

13.7 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Regulator if you believe your rights under POPIA have been infringed.

13.8 How to Exercise Your Rights

To exercise any of these rights, please contact us using the details provided in Section 4. We will respond to your request within a reasonable period, generally within 30 days. We may require proof of identity before processing your request.

We do not charge a fee for requests unless they are manifestly unfounded, excessive, or repetitive. In such cases, we may charge a reasonable administrative fee or refuse the request.

14. Cookies and Tracking Technologies

Our websites use cookies and similar tracking technologies to enhance user experience and analyze website performance.

14.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and improve functionality.

14.2 Types of Cookies We Use

• Essential Cookies: Required for website functionality and security
• Performance Cookies: Collect anonymous information about website usage
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Track your activity for targeted advertising (only with consent)

14.3 Third-Party Cookies

We may use third-party services that set cookies, including:

• Google Analytics for website analytics
• Facebook Pixel for advertising
• Google Ads for marketing campaigns

14.4 Managing Cookies

You can control cookies through:

• Our cookie consent banner on first visit
• Your browser settings (most browsers allow you to refuse or delete cookies)
• Third-party opt-out tools (such as Google’s ad settings)

Note: Disabling certain cookies may affect website functionality.

15. Marketing Communications

We may send you marketing communications about our services, special offers, and promotions if:

• You have provided consent to receive such communications, or
• You are an existing customer and the communication relates to similar services (soft opt-in)

15.1 Opt-Out Rights

You have the right to opt out of marketing communications at any time by:

• Clicking the “unsubscribe” link in our emails
• Replying “STOP” to SMS messages
• Contacting us directly via phone or email
• Adjusting your communication preferences through our website

15.2 Processing After Opt-Out

After you opt out, we will:

• Stop sending marketing communications within 7 business days
• Continue to send service-related communications (such as appointment confirmations and invoices)
• Retain your contact information to honor your opt-out request

16. Children’s Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors without parental or guardian consent. If you are a parent or guardian and believe your child has provided personal information to us, please contact us immediately so we can delete such information.

17. Third-Party Websites and Services

Our websites may contain links to third-party websites, including:

• Social media platforms (Facebook, Instagram, WhatsApp)
• Payment processing services
• Review platforms (Google, Facebook)
• Supplier and partner websites

We are not responsible for the privacy practices of these third-party sites. We encourage you to review their privacy policies before providing any personal information.

18. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or significantly affects you. Any analysis of customer data for business improvement purposes is conducted with human oversight and does not result in automated decisions about service provision or pricing.

19. Photography and Media Consent

We may take photographs or videos of our work for the following purposes:

• Documenting work performed for quality assurance
• Safety and training purposes
• Insurance and liability records
• Marketing and promotional materials (only with explicit consent)

If photographs or videos include identifiable individuals or private property beyond what is necessary for service documentation, we will obtain separate written consent before using such media for marketing purposes. You have the right to withdraw consent and request removal of your images from our marketing materials.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will:

• Update the “Effective Date” at the top of this policy
• Notify existing customers via email or prominent website notice
• Seek fresh consent where required by law

We encourage you to review this Privacy Policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

21. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your personal information, please contact us:

We will acknowledge receipt of your enquiry within 5 business days and provide a substantive response within 30 days.

22. Complaints and Dispute Resolution

If you are not satisfied with our response to your privacy concern or believe we have breached POPIA, you may:

22.1 Internal Complaint Process

1. Submit a written complaint to the contact details provided above
2. We will investigate and respond within 30 days
3. If you remain unsatisfied, request escalation to senior management

22.2 Lodge a Complaint with the Information Regulator

You have the right to lodge a complaint directly with the Information Regulator using the contact details provided in Section 2 of this policy.

22.3 Legal Action

You retain the right to institute civil proceedings in respect of any alleged infringement of your rights under POPIA, in addition to lodging a complaint with the Information Regulator.

23. Language and Interpretation

This Privacy Policy is drafted in English. If translated into other languages and there is any conflict between the English version and the translation, the English version shall prevail.

24. Acknowledgment and Consent

By using our services or providing personal information to Big Boss Tree Felling, you acknowledge that:

• You have read and understood this Privacy Policy
• You consent to the collection, processing, and use of your personal information as described
• You understand your rights under POPIA
• You understand how to exercise those rights or lodge complaints

For specific consent requirements (such as marketing communications or photographic use), we will obtain separate, explicit consent as required by law.