Privacy Policy

This Policy explains what personal information 2 Green Maintenance & Landscaping (“2Green”, “we”, “us”) collects, why we hold it, who we share it with and what you can ask us to do about it. We are the responsible party for that information under the Protection of Personal Information Act, 2013 (POPIA).

It describes how our client portal at 2green.co.za actually works. If something here does not match what you experience, tell us and we will correct the Policy or the system.

1. What we collect, and why

Account and contact details. Your name, email address, mobile number, and optionally a company name and the address of the property we work at. We need these to identify you, reach the site, bill you and contact you. Your email address is required because it is the key that links your portal account to your invoices.

Before you are a client. If a member of our team invites you to the portal, we store the name, email address, mobile number and company on that invitation as soon as it is created, whether or not you accept it.

Work and billing records. Quote requests including the job description and the site-visit time you choose, priced quotes, invoices and their line items, shop orders, and payment records. We are required to keep financial records for a period set by South African law.

Payment details.We never see, transmit or store your card number, expiry date or CVV. Those are entered on PayFast's own secure page. If you choose to save a card, all we hold is a reference token issued by PayFast that lets us charge that card again, plus the word “Card”. Removing the card in your portal deletes that token.

Messages. We keep a record of the emails and WhatsApp messages we send you and that you send us, including the message content, so that we have one accurate history of what was communicated. For invitation emails specifically, our email provider tells us whether the email was delivered, opened or clicked.

Photographs. Our team photographs gardens and work sites. Those photographs may incidentally include people, vehicles or neighbouring property. Some are marked visible to you in your portal and some are internal working records.

Account security. Your password is stored only as a salted hash, so nobody at 2Green can read it. Sign-in sessions are stored as hashed tokens. For staff sign-ins to our business portal we also record the IP address and browser, successful or not. We do not record IP addresses for client portal sign-ins.

Activity history. Your portal shows a log of things that happened on your account, such as invoices raised, payments taken and profile changes. Our staff can also write internal notes about your garden which are not shown to you.

2. Who we share it with

We do not sell your personal information and we do not share it for anyone else's marketing. We use the following operators to run the service, and share only what each one needs:

• PayFast (South Africa), to take payments and to hold your saved card securely on our behalf.
• Xero, our accounting system, which holds your contact details, invoices and payments.
• Neon and Vercel, which host our database and website.
• Resend, which delivers our email, and Meta, which delivers WhatsApp messages.
• Plausible, a privacy-focused analytics service that records page views. It runs on every page of this site, including the pages inside your portal. It sets no cookies, assigns you no identifier and collects nothing that identifies you personally. We serve it from our own domain, so your browsing is not sent to a third party as you move around the site. Plausible is hosted in the European Union.

Several of these providers are outside South Africa, so your information may be processed abroad. We rely on this being necessary to perform our agreement with you, and we use established providers who undertake to protect it.

We will also disclose information where the law requires it, or to establish or defend a legal claim.

3. Marketing, and how to stop it

We may send you occasional emails or WhatsApp messages about our services. Service messages about your own quotes, invoices, payments and orders are not marketing and will continue for as long as you are a client.

Our marketing messages do not currently carry an unsubscribe link. To stop them, email us at info@2green.co.za or reply to any WhatsApp message and say so, and we will remove you from those lists. We would rather tell you that plainly than point you at a button that does not exist yet.

4. Notifications

Your portal shows notifications about invoices, payments and orders. If you allow it, we also send browser push notifications. If you want push notifications to stop, revoke the notification permission for 2green.co.za in your browser or phone settings, as there is currently no switch for this inside the portal.

5. Your rights under POPIA

You are entitled to:

• ask what personal information we hold about you, and get a copy;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete information we no longer have a lawful reason to keep;
• object to processing on reasonable grounds; and
• complain to the Information Regulator of South Africa if you are not satisfied with how we have handled a request.

There is no self-service button for these in the portal. You can change your own name, company, phone number and address on your profile, but changing your email address, closing your account or requesting a copy of your data needs to go through us. Email info@2green.co.za and we will respond as soon as we reasonably can.

Two honest limits. We cannot delete invoices, quotes and orders on request, because we are obliged to keep financial records. And information already shared with an operator, for example an invoice in our accounting system, has to be removed there as well, which we will do where we are able to.

6. How long we keep it

We keep your account, work and message records for as long as you are a client and for as long afterwards as we need them to deal with queries or claims. Financial records are kept for the period South African law requires. Invitations, activity logs and message history are currently kept indefinitely, and we are working towards defined limits for these.

7. Security

We take reasonable technical and organisational steps to protect your information. Passwords are salted and hashed and never stored in readable form. Session and password-reset tokens are stored only as hashes, and reset links expire after an hour. Payment notifications from PayFast are signature-checked and independently verified before any invoice is marked paid. Access to the business portal is limited by role.

One thing you should know. Photographs uploaded to your record are stored with our hosting provider at long, unguessable web addresses. They are not listed or searchable, but anyone who obtains the exact address could open the image without signing in. If you would prefer that we do not photograph parts of your property, tell us and we will not.

No system is completely secure. If a breach occurs that puts your information at risk, we will notify you and the Information Regulator as POPIA requires.

8. Cookies and analytics

We set two cookies, both strictly necessary, and neither is used to track you. The first is a sign-in cookie that keeps you logged in to the portal. It cannot be switched off while you are using the portal, because it is what keeps you signed in. The second is set only if you follow an unsubscribe link from one of our emails: it carries the link’s token for half an hour so that the page can act on it, and it exists so the token never has to sit in the address bar. Both are readable only by our server, not by scripts on the page.

Our analytics does not use cookies at all. Plausible counts page views without storing anything on your device and without assigning you an identifier, so there is no analytics cookie to accept or refuse. We also serve it from our own domain rather than loading it from an outside server, which means your browsing on this site is not handed to a third party page by page. We run no advertising, no remarketing and no cross-site tracking of any kind.

9. Children

Our service is for property owners and occupiers and is not directed at children. We do not knowingly collect the personal information of a child.

10. Changes to this Policy

If we change how we handle personal information we will update this Policy and the date at the top of the page.

11. Contact us

For any privacy question or request, including access, correction and deletion, contact our Information Officer at info@2green.co.za or on 083 227 1080. Our address is Val de Vie 1084, Paarl, 7626, Western Cape.

You can also lodge a complaint with the Information Regulator (South Africa). See also our Terms & Conditions.