Genious Services Privacy Policy

1. Who we are and scope

1.1 This Privacy Policy is issued by Genious Services (Pty) Ltd, a private company incorporated in the Republic of South Africa (registration number 2021/405092/07), trading as "Genious Services" ("we", "us", "our"). Our place of business is Unit 28, Office 07, 587 Jones Road, Jet Park, Boksburg, Gauteng, 1459. For the purposes of the Protection of Personal Information Act, we are the responsible party for the personal information described in this policy.

1.2 This policy applies to personal information we process when you:

1. visit www.geniousservices.com or any of its pages ("the website");
2. submit a repair or quote request through the website, by email, telephone or WhatsApp;
3. bring a device to, or collect a device from, our workshop;
4. engage us as a business, institutional or insurance-claim client, or as an insurer or assessor acting for a client; and
5. otherwise communicate with us, including complaints, warranty claims and job applications.

1.3 This policy must be read together with our Terms of Service and Warranty Policy, which govern the repair contract itself.

2. Legal framework and definitions

2.1 Section 14 of the Constitution of the Republic of South Africa, 1996, protects the right to privacy. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and its Regulations, and where relevant the Promotion of Access to Information Act 2 of 2000 ("PAIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), the Consumer Protection Act 68 of 2008 ("CPA"), the Cybercrimes Act 19 of 2020, and applicable tax and company law.

2.2 In this policy, the terms personal information, special personal information, data subject, processing, responsible party, operator, consent, direct marketing and Information Regulator have the meanings given to them in section 1 of POPIA. In summary:

• Personal information is information relating to an identifiable, living natural person or an identifiable, existing juristic person (such as a company), for example a name, contact details, identity number, device serial number linked to you, or correspondence.
• Processing means any operation involving personal information, including collecting, recording, storing, using, sharing, and destroying it.
• An operator is a person who processes personal information for us under a contract or mandate, without coming under our direct authority.
• A device means any computer, laptop, MacBook, iMac, tablet, iPad, games console, controller, electronic board or other equipment you entrust to us, together with any storage media and accessories.

3. Information we collect

3.1 Information you give us

3.2 Information collected automatically

When you use the website, we and our service providers may collect technical information: your IP address, browser and device type, operating system, the pages you view, the referring page, and the date and time of your visit. Our repair form uses Google reCAPTCHA, which collects hardware and software information to distinguish people from automated programs (see section 9).

3.3 Information from third parties

We may receive personal information about you from your employer or the organisation that booked a repair for you, from your insurer or assessor in connection with a claim, and from service providers that support the website. We use this information only for the purpose for which it was given to us.

3.4 Special personal information and children

We do not intentionally collect special personal information (such as information about health, religious or philosophical beliefs, race, biometric information or criminal behaviour), nor personal information about children, except as described in sections 6 and 16. Please do not include such information in forms or messages unless it is necessary.

4. How we collect it

We collect personal information directly from you whenever reasonably practicable: through our website repair form, by email and WhatsApp, by telephone, and on our job cards when you drop off or collect a device. We also collect it from the third parties listed in section 3.3, and through automated technologies on the website. Where we collect information from you, we take reasonable steps to make you aware of the matters set out in section 18 of POPIA, including through this policy.

5. Why we process it, and on what legal basis

We process personal information only for specific, explicitly defined and lawful purposes related to our business, and only where one of the grounds in section 11 of POPIA applies.

We will not process your personal information for a purpose that is incompatible with the purpose for which it was collected, unless permitted by section 15 of POPIA. Where we rely on consent, you may withdraw it at any time; this does not affect processing that took place before the withdrawal or processing that relies on another lawful ground.

6. Data on your device, passcodes and data recovery

6.1 Your data remains yours. Devices often contain personal information belonging to you or to others, such as files, photographs, emails and account data. We do not collect this information for our own purposes. Technicians access a device only as far as reasonably necessary to diagnose, repair and test it, or to perform a data recovery or transfer that you have requested.

6.2 Backups are your responsibility. Before handing in a device, you must back up all data you wish to keep, where the device still allows it. Repairs (including board-level work, liquid-damage treatment, storage replacement and operating-system reinstallation) can result in partial or total data loss, even when they are carried out correctly. Where a repair is likely to affect your data, we will tell you before proceeding wherever reasonably possible. Our liability for data loss is governed by our Terms of Service and section 19 of this policy.

6.3 Passcodes. Providing a password, PIN or pattern is voluntary. If you provide one, we use it only to test the repaired device. We record it on the job card only for the duration of the repair and remove or destroy that record when you collect the device. We strongly recommend that you change your passcodes after collection. We do not ask for, and you should not give us, banking passwords, one-time PINs, or your Apple ID or Google account passwords. If you prefer not to share a passcode, you may arrange to unlock the device yourself when we test it.

6.4 Data recovery and transfers. Where you ask us to recover or transfer data, the recovered data is held only for as long as needed to deliver it to you. Any working copy is securely deleted within 30 days of handover, unless you ask us in writing to keep it for longer.

6.5 Replaced parts and storage media. Storage drives and other parts we remove are returned to you on request at collection. Otherwise, storage media are wiped or physically destroyed before disposal or recycling.

6.6 Unlawful content and stolen devices. We do not search devices for content. If, during a repair, we become aware of content or circumstances that we are legally obliged to report — including child sexual abuse material — or have reasonable grounds to believe that a device is stolen, we may retain the device and the relevant information and report the matter to the South African Police Service or another competent authority, as permitted by sections 12(2)(d) and 15(3)(c) of POPIA and required by applicable law.

6.7 Uncollected devices. The treatment of devices that are not collected, including the deletion of their data before disposal, is set out in our Terms of Service.

7. Who we share it with

7.1 We do not sell, rent or trade your personal information. We share it only as follows, and only to the extent necessary:

1. Our staff, who need it to perform their duties and who are bound by confidentiality obligations.
2. Operators who provide services to us, including our website hosting and WordPress platform providers; email and messaging providers (including WhatsApp, when you choose to contact us that way); Google LLC for reCAPTCHA, web fonts and maps; our accounting, invoicing and banking or payment providers; and IT and security support. Section 21 of POPIA requires us to have written agreements with operators requiring them to keep your information confidential and to apply appropriate security measures.
3. Parts suppliers, distributors and manufacturers, limited to device details such as model and serial number, where needed to source the correct parts or to process a manufacturer warranty.
4. Your insurer, broker or assessor, where you have selected an insurance-claim repair or instructed us to share our report. Decisions on claims and replacements are made by the insurer.
5. Your employer or organisation, where it booked or is paying for the repair of a device you use.
6. Professional advisers (such as attorneys, auditors and accountants) under a duty of confidentiality, and debt collectors in respect of invoices that remain unpaid.
7. Regulators, courts, the South African Revenue Service and law-enforcement agencies, where required by law or a court order, or as described in section 6.6.
8. A purchaser or successor of all or part of our business, subject to the same obligations as set out in this policy.
9. Any other person, with your consent.

7.2 Where information is disclosed with your consent, we keep a record of what was disclosed, to whom, why and when.

8. Transfers outside South Africa

Some of our service providers (for example, website hosting, email, WhatsApp and Google services) may store or process personal information on servers outside South Africa. We transfer personal information across borders only where section 72 of POPIA allows it: for example, where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection; where the transfer is necessary to perform our contract with you; or where you have consented.

9. Cookies, reCAPTCHA and website technologies

9.1 Cookies are small text files that a website stores on your device. Our website uses technologies in the following categories:

9.2 You can block or delete cookies in your browser settings. If you block strictly necessary cookies or reCAPTCHA, the repair form may not work; you can still contact us by phone or email.

10. Direct marketing

10.1 Messages about your repair — such as quotes, progress updates, collection notices and warranty matters — are service communications, not direct marketing.

10.2 We send direct marketing by electronic communication (email, SMS or WhatsApp) only in accordance with section 69 of POPIA: either with your consent, or, if you are an existing customer, about our own similar services where you were given the opportunity to object when your details were collected. Every marketing message identifies us and tells you how to opt out. You may opt out at any time by replying "STOP", by using the unsubscribe link, or by emailing [email protected]. We act on opt-outs promptly and free of charge.

11. Security and breach notification

11.1 In accordance with section 19 of POPIA, we take appropriate, reasonable technical and organisational measures to prevent the loss of, damage to, unauthorised destruction of, and unlawful access to or processing of personal information. These measures include:

• HTTPS encryption on the website;
• access to customer records restricted on a need-to-know basis, with access credentials controlled;
• physically secure storage of devices and job cards at our workshop;
• confidentiality undertakings from staff and operators; and
• secure deletion or destruction of information and storage media that are no longer required.

We review these safeguards regularly and update them in response to new risks.

11.2 No method of transmission or storage is completely secure. Information you send us by email or messaging applications travels over networks we do not control. Please do not send sensitive information (such as passwords or identity documents) by these channels unless we ask you to.

11.3 If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22 of POPIA, unless a public body responsible for the prevention, detection or investigation of offences, or the Information Regulator, determines that notification would impede a criminal investigation.

12. How long we keep information

We keep personal information only for as long as necessary to achieve the purpose for which it was collected, unless a longer period is required or authorised by law, is reasonably required for lawful business purposes, or is needed to establish or defend legal claims (section 14 of POPIA).

When the retention period ends, we destroy, delete or de-identify the information in a way that prevents it from being reconstructed. Information may be kept for longer where it has been de-identified, or where it is held for historical, statistical or research purposes with appropriate safeguards.

13. Your rights

13.1 Subject to POPIA and PAIA, you have the right to:

1. be notified that your personal information is being collected, and be notified of any security compromise involving it;
2. establish whether we hold personal information about you, and request access to it (section 23 of POPIA);
3. request the correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to retain (section 24 of POPIA);
4. object, on reasonable grounds, to processing based on legitimate interests (section 11(3)(a) of POPIA);
5. object at any time to processing for direct marketing (section 11(3)(b) of POPIA), and refuse unsolicited electronic marketing (section 69 of POPIA);
6. withdraw your consent, where processing is based on consent;
7. not be subject to a decision based solely on automated processing that has legal consequences for you (we do not make such decisions);
8. submit a complaint to the Information Regulator (section 15 below); and
9. institute civil proceedings regarding an alleged interference with the protection of your personal information (section 99 of POPIA).

13.2 How to exercise your rights. Send your request to our Information Officer at [email protected]. You may use the forms prescribed under the POPIA Regulations (Form 1 for objections; Form 2 for correction or deletion), which are available from the Information Regulator's website. To protect your information, we will verify your identity before acting on a request, and may ask you to provide proof of identity or of your authority to act for someone else.

13.3 We will respond within a reasonable time, and in any event within the periods prescribed by law; for access requests under PAIA, that period is 30 days, subject to any lawful extension. Correction and deletion requests are free. Access requests may attract the fees prescribed under PAIA; if so, we will give you a written estimate before proceeding. We may decline a request, or part of one, on the grounds permitted by POPIA and PAIA. Where we decline, we will give you our reasons in writing.

13.4 Deleting your information does not cancel records we are legally required to keep, such as tax invoices.

14. Information Officer and access to records (PAIA)

14.1 Our Information Officer is responsible for our compliance with POPIA and PAIA, and is registered with the Information Regulator in accordance with section 55 of POPIA. You can reach the Information Officer at:

14.2 Requests for access to records under PAIA must be made on the prescribed form and are dealt with in accordance with PAIA. Information about our records and the PAIA process is available from the Information Officer on request.

15. Complaints

15.1 If you are concerned about how we have handled your personal information, please contact our Information Officer first. We will acknowledge your complaint, investigate it and respond to you in writing. If resolving your complaint reasonably requires us to involve another person, we will share only the information that is necessary for that purpose.

15.2 You may also lodge a complaint with the Information Regulator at any time:

16. Children, job applicants and employees

Our services are intended for adults. Persons under 18 may submit a repair request or hand in a device only with the consent and involvement of a parent or guardian, who acts as the competent person for the purposes of section 35 of POPIA. If we learn that we have collected a child's personal information without that consent, we will delete it, unless the law requires us to keep it.

If you apply for a job with us, we use the information you send only to assess your application. If we employ you, we process your personal information for purposes directly related to your employment, in accordance with POPIA and labour legislation. Retention periods are set out in section 12.

17. Your obligations

You must ensure that the information you give us is accurate, complete and up to date, and that you are entitled to give us any personal information about another person — for example, a staff member whose device you hand in, or the owner of a device you bring on their behalf. By doing so, you confirm that you have informed that person of this policy, or that you are otherwise lawfully authorised to share their information with us.

18. Third-party websites and services

The website links to third-party services, including Google Maps, Google reviews and WhatsApp. These services are governed by their own privacy policies, and we are not responsible for their content or practices. Please review their policies before using them.

19. Limitation of liability

19.1 To the fullest extent permitted by law, we are not liable for any loss or damage arising from:

1. unauthorised access to personal information that occurs despite our compliance with section 19 of POPIA;
2. information you send through channels outside our control, such as email or third-party messaging platforms;
3. the practices of third-party websites and services that we do not control; or
4. loss of data stored on a device, where you did not keep a backup as required by section 6.2.

19.2 Nothing in this policy excludes or limits any liability that cannot lawfully be excluded or limited, including liability for gross negligence, or any right you have under POPIA or the CPA.

20. Changes to this policy

We may amend this policy to reflect changes in the law, our services or our practices. The current version, with its effective date, is always published on this page. Where a change materially affects how we process your personal information, we will take reasonable steps to bring it to your attention — for example, by a notice on the website or a message to customers with an active repair — and will ask for your consent where the law requires it.

21. General provisions

1. This policy is governed by the laws of the Republic of South Africa.
2. If any provision of this policy is found to be invalid or unenforceable, that provision is severed, and the remaining provisions continue in full force and effect.
3. If this policy conflicts with our Terms of Service on a matter concerning personal information, this policy prevails, unless the law requires otherwise.
4. Headings are for convenience only and do not affect interpretation.

22. Contact details