Privacy notice
Last updated 8 September 2026. Draft for legal review before first outreach; the substance below reflects how the register actually works today.
Attest Africa (Pty) Ltd ("Attest", "we") operates attest.africa, a register that checks South African trades businesses against the public registers of their licensing bodies and publishes the outcome. This notice explains what personal information we process, why, on what lawful basis under the Protection of Personal Information Act 4 of 2013 (POPIA), and the rights you have.
Who is responsible
Attest Africa (Pty) Ltd, Cape Town, South Africa, is the responsible party. Our Information Officer is Steve Binos, reachable at hello@attest.africa. Company registration details will be published here once registration is complete.
What we process, and where it comes from
| Information | Source | Shown publicly? |
|---|---|---|
| Business name, town, address, phone number, website | Google's public business listing (Google Places API), or the owner once a listing is claimed | Yes |
| Outcome of our check against a licensing register, and the date we checked | Our own verification, one business at a time, against the Plumbing Industry Registration Board (PIRB) public register or the Electrical Conformance Board (ECB) directory | Yes |
| Registration numbers, designations, renewal dates, registered entity names | The same public registers | Only when the owner has claimed the listing and consented |
| Names of registered practitioners linked to a business | The same public registers | No. Held in our ledger, shown only to the business owner on their private preview page |
| Google rating and review count | Google Places API | No. Shown only to the owner on their private preview, attributed to Google, refreshed within 30 days |
| Owner contact details, consent choices, payment references | The owner, when claiming a listing | Contact details only if the owner chooses; payment references never |
| Email delivery events (sent, bounced, opted out) | Our email provider | No |
We do not collect identity numbers, dates of birth, bank details, director details or home addresses, and we do not intend to.
Why, and on what lawful basis
- Publishing the register (business details and the outcome of our check): our legitimate interest, and the public interest, in letting consumers and their AI assistants confirm that a tradesperson is registered before hiring them. The underlying facts are already public at the licensing body; we add a dated, machine-readable check.
- Holding practitioner names and registration details in our ledger: legitimate interest in being able to show what we checked, when, and against which record. These are shown only to the business itself unless it consents to publication.
- Contacting a business about its listing: legitimate interest in informing a business what is published about it and offering it control over that listing. We write to published business addresses, about the business, with a working opt-out in every message.
- Claimed listings and payments: performance of the contract you enter into when you claim a listing.
Sharing
Business details and check outcomes are public on this site and available through our search API, which is what the register is for. Personal information beyond that is shared only with the providers we need to operate: our hosting provider (Vercel), database provider (Neon), email provider (Resend), payment processor (PayFast) and sales-pipeline tool (DealCrux). Some of these providers store data outside South Africa under contractual safeguards. We do not sell personal information.
Retention
Our verification ledger is append-only by design: it records what we found and when, and is kept for as long as the register exists, because the history of checks is what makes an attestation trustworthy. Owner contact details are kept while a listing is claimed and for two years after it lapses, then deleted. Email delivery records are kept for one year. If you ask us to remove a business from the register, the public listing is removed; the ledger keeps a record that a removal was requested and honoured.
Your rights
You may ask us what we hold about you or your business, ask us to correct it, object to its processing, or ask us to remove your business from the register. Every outreach email carries an opt-out link that stops all further email permanently. Write to hello@attest.africa; we respond within ten working days. If you are not satisfied, you may complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.
Security
The register is served over HTTPS. Our ledger cannot be edited or deleted by application code, only appended to. Owner contact details are stored encrypted. Access to the administration system requires staff sign-in with multi-factor authentication, and every change is logged. We will notify the Information Regulator and affected people of any breach as POPIA requires.
Cookies and analytics
The public site sets no cookies and runs no advertising or tracking scripts. Private preview pages are unindexed and reachable only by their link.
Changes
We will update this notice as the register grows. The date at the top tells you when it last changed.