Privacy Policy
Effective date: 10 July 2026
Crovos Technologies (Pty Ltd) ("we", "us", "our") operates the Batla platform, which includes the website at batla.co.za and the Batla mobile application (together, the "Service"). We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what your rights are under the Protection of Personal Information Act 4 of 2013 ("POPIA").
Please read this policy carefully. By using the Service or submitting any information through it, you acknowledge that you have read and understood this policy.
1. Who we are
Responsible Party (as defined in POPIA):
Crovos Technologies (Pty Ltd)
Registration number: 2026/514090/07
Email: info@crovostechnologies.co.za
WhatsApp: +27 64 851 6218
Website: batla.co.za
Our Information Officer is responsible for overseeing our compliance with POPIA. You may contact them at the email address above for any privacy-related queries or to exercise your rights.
2. What personal information we collect
We collect personal information in two ways: information you give us directly, and limited technical information collected automatically.
2.1 Information you give us directly
If you join our launch waitlist (the "Notify me" form):
- Your mobile phone number (WhatsApp number)
- The area or suburb you are in — used only to help us decide where to launch next
If you submit a business listing (on the website or in the app):
- Business name
- Owner or contact person's name (optional — website form only)
- WhatsApp phone number for the business
- Business category
- GPS coordinates of the business — captured once, at the moment you choose to capture it, with your permission. We do not track your location in the background or continuously.
- A landmark or "how to find us" description
- Trading hours (optional — app only)
- A photograph of the business (optional)
- A short description of what the business sells (optional)
If your business is outside our current launch area: Batla is launching in stages. If the location you capture when submitting a business listing on the website falls outside the area we are launching in first, we do not publish or store your business details. Instead, we invite you to join our expansion waitlist by giving only your WhatsApp number and the general area you are in, so we can let you know when Batla reaches your area.
If you register or verify a business yourself in the app:
- Your mobile phone number, used to send you a one-time PIN (OTP) by SMS to confirm you control that number. This number is used for verification and account purposes and is not displayed publicly.
2.2 Information collected automatically
On the website (batla.co.za): our web hosting provider and Cloudflare may automatically collect your IP address, browser type and version, pages visited and time of visit, and the referring website. We use this only for security monitoring and to understand how the site is used.
In the app: when the app communicates with our servers, our infrastructure may log IP addresses and request metadata for security purposes such as rate-limiting and abuse prevention. When you open a business listing, we record an anonymous view count (which listing was viewed and when) — we do not record who viewed it.
Map tiles: the map in the app loads its background imagery directly from OpenStreetMap's tile servers. When the map is displayed, your device makes requests to those servers, which necessarily exposes your IP address and the map area requested to the OpenStreetMap Foundation. See Section 9.
2.3 What we do NOT collect
We do not collect:
- National identity numbers (ID numbers)
- Bank account details
- Payment card details
- South African Revenue Service (SARS) numbers or tax information
- Company registration numbers
- Your search queries in the app — searching and filtering happen on your device and are not sent to our servers
- Your position when you use "Near Me" — your GPS position is used on your device only and is never sent to or stored on our servers (see Section 6)
3. Why we collect your information
We collect personal information only for specific, legitimate purposes:
| Information | Purpose |
|---|---|
| Waitlist phone number | To contact you via WhatsApp when the Batla app launches |
| Waitlist area / suburb | To help us plan which areas to launch in next |
| Business name, category, description, trading hours | To create and display your business listing in the Batla directory |
| Owner / contact name (website form) | Internal reference only — not displayed publicly |
| Business WhatsApp number | To display as a contact button on your listing |
| Phone number for OTP verification | To confirm you control the number and are entitled to manage the listing |
| GPS coordinates of the business | To show the business on a map in the app |
| Landmark / directions | To help customers find the business |
| Business photograph | To display with the listing in the app |
| IP address / technical data | Security monitoring, rate-limiting, and abuse prevention |
| Anonymous listing view counts | To show business owners how often their listing is viewed and to order listings in the app |
We will not use your information for any purpose other than those listed above without first notifying you.
4. Lawful grounds for processing
Under POPIA Section 11, we process your personal information on the following lawful grounds:
- Your consent: When you complete and submit our forms, you consent to us collecting and using your information for the purposes stated above. You may withdraw this consent at any time (see Section 11).
- Contractual necessity: Processing your business listing information is necessary to provide the directory service you have requested.
- Legitimate interests: We process limited technical data (IP addresses, server logs) to protect the security and integrity of our platform. This interest does not override your right to privacy.
5. How we store your information
Your personal information is stored electronically in a database operated by Supabase, Inc., a third-party database service provider. Your data is stored on servers located in Ireland, European Union (Amazon Web Services, eu-west-1 region).
We implement the following security measures to protect your information:
- Access to our database is restricted to authorised personnel only.
- Our database is protected by Row Level Security (RLS) policies that prevent unauthorised access.
- All data is transmitted over encrypted HTTPS connections.
- We regularly review our security settings.
No method of transmission over the internet or electronic storage is completely secure. While we take all reasonably practical steps to protect your information, we cannot guarantee absolute security. If a breach occurs that could harm your rights, we will notify you and the Information Regulator as soon as reasonably possible, as required by POPIA.
6. Information stored only on your device
The Batla app is built to work offline and use little data. To do this, it stores certain information locally on your device only. This information is not transmitted to us:
- Listing cache: copies of business listings you have loaded, so the app works without a connection.
- Image cache: business photographs you have viewed.
- Your last known location: if you use "Near Me", your approximate position is kept on your device (for up to 24 hours) so results load faster. It is never sent to or stored on our servers.
- Draft submissions: if you submit a listing while offline, it is queued on your device until a connection is available.
You can clear all of this at any time by clearing the app's storage in your device settings or uninstalling the app. On the website, your browser may similarly hold draft form data in local storage — it never leaves your device.
7. International data transfers
Your personal information is stored on servers in Ireland, European Union, operated by Supabase, Inc. This constitutes an international transfer under POPIA Section 72. Ireland is bound by the EU General Data Protection Regulation (GDPR) — one of the world's strongest data protection frameworks — which we consider adequate protection. We further rely on Supabase's data processing agreement and SOC 2 Type II certification. By using the Service, you consent to this transfer.
8. How long we keep your information
| Information | Retention Period |
|---|---|
| Waitlist phone numbers and expansion-waitlist entries | Until the Batla app launches in your area and the notification is sent, then deleted within a reasonable period after launch |
| Business listings | For as long as your listing is live in the directory. If you request removal, your listing is removed without undue delay |
| Phone numbers used for OTP verification | For as long as your listing or account is active; deleted with your listing on request |
| Server / access logs (including security and rate-limiting logs) | Up to 90 days |
We have no legal obligation to keep your listing information after you ask us to delete it. When your information is no longer needed, we delete or de-identify it so that it cannot be linked back to you.
9. Who we share your information with
We do not sell your personal information to anyone.
We will never voluntarily share your information with:
- The South African Revenue Service (SARS)
- Any bank or financial institution
- Any government department or law enforcement agency
unless we are compelled to do so by a lawful order or a legal obligation that applies to us.
We use the following service providers, who may process limited information on our behalf or as a consequence of how the Service works:
- Supabase, Inc.: Our database and authentication provider, who stores your data on servers in Ireland (EU). Supabase is a data processor acting on our behalf and is contractually bound to protect your information.
- SMS delivery: One-time PINs (OTPs) are sent by SMS through our authentication provider (Supabase) and its SMS delivery partner. Your phone number is processed by them solely to deliver the message.
- Cloudflare Inc.: Our content delivery and DNS provider, who processes network traffic to our website.
- OpenStreetMap Foundation: The map in the app loads tiles directly from OpenStreetMap's servers. When the map is shown, your IP address and the requested map area are visible to the OpenStreetMap Foundation, whose own privacy policy applies.
- WhatsApp / Meta Platforms: Tapping a WhatsApp button on a listing opens the WhatsApp application. Anything you do in WhatsApp is governed by Meta's own terms and privacy policy, not ours. We do not send your information to Meta — you choose to open the conversation.
Law enforcement: If we receive a valid court order, subpoena, or other lawful demand, we may be required to disclose information, and we will comply only to the extent the law requires.
If we ever intend to share your information with any other third party not listed above, we will notify you and obtain your consent first.
10. Business listing information — public visibility
Please be aware that the information you submit in a business listing (business name, category, description, WhatsApp number, trading hours, location, and photograph) is intended to be displayed publicly in the Batla app and on the Batla website. Do not submit any information that you do not want to be publicly visible.
Photographs: once uploaded, your business photograph is stored at a publicly accessible web address (URL). Anyone with that URL can view the photograph, including outside the app. Copies of your listing and photograph may also remain temporarily cached on users' devices after a change or removal, until their caches refresh.
The owner/contact name field on the website form is used for our internal records only and will not be displayed publicly.
11. Your rights under POPIA
POPIA gives you the following rights regarding your personal information:
a) Right to be notified: You have the right to know when we collect your personal information and for what purpose. This policy fulfils that obligation.
b) Right of access: You may request a description of the personal information we hold about you and a copy of that information. We will respond within 30 days.
c) Right to correction or deletion: If your information is inaccurate, out of date, incomplete, or misleading, you may ask us to correct or delete it. We will do so within a reasonable time.
d) Right to object: You may object to us processing your personal information on reasonable grounds. If you object, we will stop processing unless we can demonstrate a compelling legitimate ground that overrides your rights.
e) Right to withdraw consent: You may withdraw your consent to us using your information at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.
f) Right to remove your listing: You may ask us to remove your business listing at any time, with no questions asked. Simply contact us at info@crovostechnologies.co.za or WhatsApp +27 64 851 6218.
g) Right to complain: If you believe we have processed your personal information in violation of POPIA, you may lodge a complaint with the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Email: POPIAComplaints@inforegulator.org.za
- Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
We encourage you to contact us first so we can resolve any concerns directly.
12. Direct marketing
We may use your WhatsApp number to send you a single message when the Batla app launches (if you joined the waitlist). We will not send you unsolicited marketing messages beyond that. You may opt out at any time by replying to the message or contacting us at info@crovostechnologies.co.za.
We will not add you to any third-party marketing lists or share your number with any marketing company.
13. Cookies and tracking
The Batla website does not use advertising tracking cookies or third-party analytics cookies that track you across websites. Your browser may store local data (such as draft form submissions) in its local storage — this data never leaves your device and is not accessible to us.
The Batla app contains no advertising, analytics, or crash-reporting SDKs and sends no usage data to any third-party analytics service.
14. Children's privacy
The Service is intended for adults and business owners. We do not knowingly collect personal information from persons under the age of 18. If we become aware that we have collected information from a child without verifiable parental consent, we will delete it promptly. If you believe a child has submitted information to us, please contact us immediately.
15. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the "effective date" at the top of this page and, where the changes are significant, we will take reasonable steps to notify you (for example, via the website). Your continued use of the Service after the updated policy takes effect constitutes your acceptance of the changes.
16. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:
Crovos Technologies (Pty Ltd)
Email: info@crovostechnologies.co.za
WhatsApp: +27 64 851 6218
Website: batla.co.za
We will respond to your request within 30 days.
This Privacy Policy was last reviewed on 10 July 2026.