Privacy notice
Last updated 1 October 2026.
Attest Africa (Pty) Ltd ("Attest", "we") operates attest.africa, a register that checks South African professionals against the public registers of their licensing bodies and publishes the outcome. The register is published on this site, through a search API, and through a connector that AI assistants such as Claude can call. This notice explains what personal information we process, why, on what lawful basis under the Protection of Personal Information Act 4 of 2013 (POPIA), and the rights you have.
Who is responsible
Attest Africa (Pty) Ltd (registration number 2026/728595/07), Cape Town, South Africa, is the responsible party. Our Information Officer is M. Dawson, reachable at hello@attest.africa.
What we process, and where it comes from
| Information | Source | Shown publicly? |
|---|---|---|
| Business name, town, address, phone number, website | Google's public business listing (Google Places API), or the owner once a listing is claimed | Yes |
| Trading name, town and directory link of a sole-trader electrician listed with the ECB but with no Google business listing | The Electrical Conformance Board (ECB) directory, where the electrician chose to publish it. A sole trader is a person, so this is personal information | Yes. We show no contact details of our own for them; the listing links to their ECB directory page |
| Outcome of our check against a licensing register, and the date we checked | Our own verification, one business at a time, against the Plumbing Industry Registration Board (PIRB) public register, the City of Cape Town Plumber's Register, or the ECB directory | Yes |
| What each municipality's water by-law requires of a plumbing Certificate of Compliance, and the date we read it | The municipality's published by-law | Yes. This is about the municipality, not about any person |
| Registration numbers, designations, renewal dates, registered entity names | The same public registers | Only when the owner has claimed the listing and consented |
| Names of registered practitioners linked to a business | The same public registers | No. Held in our ledger, shown only to the business owner on their private preview page |
| Google rating and review count | Google Places API | Yes, on the listing page and in search and connector results, attributed to Google with the date we read it. Not shown once that reading is more than 30 days old |
| Owner contact details, consent choices, payment references | The owner, when claiming a listing | Contact details only if the owner chooses; payment references never |
| Name and email address of someone who suggests a business, and how they know it | That person, through the “Submit a business for listing” form | No |
| Email delivery events (sent, bounced, opted out) | Our email provider | No |
| A record of each search: a one-way hash of the caller's IP address (never the address itself), the first six characters of any API key, what was searched for (profession, town, area, province, status), which businesses were returned and how many were not shown, whether the search came from this site, the API or the connector, and the kind of software that made it (a browser, an AI assistant, a search-engine crawler or a script; the software’s identifying string itself is not kept) | Anyone searching this site, the API or the connector, including an AI assistant searching on someone's behalf | No |
We do not collect identity numbers, dates of birth, bank details, director details or home addresses, and we do not intend to.
AI assistants and the connector
When an AI assistant uses the Attest connector, it sends us only what it is searching for: a profession and a place, and optionally an area, province or outcome. We never receive your conversation with the assistant, your name or your account. What we return is what this site publishes: business details, the outcome of each check with its source and date, and the local rule on plumbing Certificates of Compliance. We never return practitioners' names or any identity number, and we return registration numbers only where the owner has claimed the listing and chosen to publish them. The town you search for is recorded as typed, so please search by town or suburb, not by a street address.
Why, and on what lawful basis
- Publishing the register (business details and the outcome of our check): our legitimate interest, and the public interest, in letting consumers and their AI assistants confirm that a tradesperson is registered before hiring them. The underlying facts are already public at the licensing body; we add a dated, machine-readable check.
- Holding practitioner names and registration details in our ledger: legitimate interest in being able to show what we checked, when, and against which record. These are shown only to the business itself unless it consents to publication.
- Contacting a business about its listing: legitimate interest in informing a business what is published about it and offering it control over that listing. We write to published business addresses, about the business, with a working opt-out in every message.
- Claimed listings and payments: performance of the contract you enter into when you claim a listing.
- Business suggestions: your consent, given on the form. We use your name and email address only to check the business you suggested and to tell you the outcome.
- Recording searches: legitimate interest in showing that results are presented fairly. We promise that every business in an area gets a fair share of appearances, and the search record is how we check that promise. It also shows us which searches found nothing, so we know where to add businesses.
Sharing
Business details and check outcomes are public on this site and available through our search API and connector, which is what the register is for. AI assistants that call the connector receive the same public results. Personal information beyond that is shared only with the providers we need to operate: our hosting provider (Vercel), database provider (Neon), email provider (Resend), payment processor (PayFast) and sales-pipeline tool (DealCrux). Some of these providers store data outside South Africa under contractual safeguards. We do not sell personal information.
Retention
Our verification ledger is append-only by design: it records what we found and when, and is kept for as long as the register exists, because the history of checks is what makes an attestation trustworthy. Owner contact details are kept while a listing is claimed and for two years after it lapses, then deleted. Email delivery records are kept for one year. The name and email address of someone who suggested a business are kept for one year after we reply, then deleted. Search records are kept for 90 days, then deleted. If you ask us to remove a business from the register, the public listing is removed; the ledger keeps a record that a removal was requested and honoured.
Your rights
You may ask us what we hold about you or your business, ask us to correct it, object to its processing, or ask us to remove your business from the register. Every outreach email carries an opt-out link that stops all further email permanently. Write to hello@attest.africa; we respond within ten working days. If you are not satisfied, you may complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.
Security
The register is served over HTTPS. Our ledger cannot be edited or deleted by application code, only appended to. Owner contact details are stored encrypted. Access to the administration system requires staff sign-in with multi-factor authentication, and every change is logged. We will notify the Information Regulator and affected people of any breach as POPIA requires.
Cookies and analytics
The public site sets no cookies and runs no advertising or tracking scripts. Private preview pages are unindexed and reachable only by their link.
Changes
We will update this notice as the register grows. The date at the top tells you when it last changed.