Privacy Policy for CraneView (Pty) Limited

Last updated: July 2026

Introduction and Application

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use Our Services and tells You about Your privacy rights and how the law protects You.

This Privacy Policy applies to you when you visit Our Website, register and use Our Platform, use our social media platforms, or make use of our Services as a customer, Contractor, Client or Subcontractor, or in respect of Personal Information from suppliers/service providers and/or from individuals in relation to recruitment or if you are an employee of the Company.

You agree to the collection and use of Your information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Authorised Representative means a natural person designated by a Contractor, Client or Subcontractor to act on the relevant User's behalf on the Platform, including persons designated to manage Account settings, set up and administer Projects, assign or execute tasks, capture attendance and daily updates, or raise, respond to, review or close RFIs, Snags, Site Instructions or Variations through the Platform. An Authorised Representative may be a Contractor Manager, a Supervisor, a Store Manager or an Admin.

Client means a natural or juristic person for whom construction works are performed under a Project managed through the Platform, and who provides oversight and approvals and may raise RFIs, Snags, Site Instructions and Variations. A Client may operate inside the Platform as a registered User or externally (off-platform), in which case the relevant Contractor Manager logs the Client's interactions on the Platform.

Company (referred to as either "the Company", "CraneView", "We", "Us" or "Our" in this Policy) refers to CraneView (Pty) Limited with registration number 2026/405159/07 and registered address situated at 11 Middle Road, Sunrella, Lanseria 1748, South Africa.

Contractor refers to a natural or verified juristic person (including a construction company) that manages construction projects, supervisors, teams, subcontractors and client interactions through the Platform and is registered as such on Our Platform.

Contractor Manager means a natural person designated by a Contractor who owns Project setup and governance on the Platform, controls workflows and communication, reviews submissions from Supervisors, manages Client interactions, and handles RFIs, Snags, Site Instructions and Variations.

Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.

Country refers to: South Africa.

Device means any device that can access the Services such as a computer, a cellphone or a digital tablet.

Person means natural person or a juristic person.

Personal Information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:

• information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
• information relating to the education or the medical, financial, criminal or employment history of the person;
• any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person; the biometric information of the person ('biometrics' means a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition);
• the personal opinions, views or preferences of the person;
• correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
• the views or opinions of another individual about the person; and
• the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

Platform means the Company's secure construction project management and site operations platform for Contractors, Clients and Subcontractors, designed to manage setup, execution, communication, control and governance across construction projects.

Platform Services has the meaning given to it in the CraneView Terms of Service, being the technology-enabled project management and site operations services We provide through Our Platform. For purposes of this Privacy Policy, any reference to 'Services' shall mean the Platform Services.

POPI Act means the Protection of Personal Information Act (Act 4 of 2013).

Processing means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) dissemination by means of transmission, distribution or making available in any other form; or (c) merging, linking, as well as restriction, degradation, erasure or destruction of information.

Project means a construction project set up and administered by a Contractor on the Platform, including its tasks, attendance records, daily updates, RFIs, Snags, Site Instructions, Variations, assets, cost records and related documents.

Special Personal Information means personal information concerning (a) the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a person or, if applicable, entity or (b) the criminal behaviour of a person to the extent that such information relates to either the alleged commission by such person of any offence or any proceedings in respect of any offence allegedly committed by the person subject or the disposal of such proceedings.

Subcontractor means a natural or juristic person engaged by a Contractor to perform part of the works on a Project, including any Subcontractor Manager or Subcontractor Supervisor designated by it to use the Platform.

Supervisor means a natural person designated by a Contractor or a Subcontractor as a mobile-first operational user of the Platform who handles daily execution on site, captures attendance and daily updates, executes assigned tasks, and responds to RFIs, Snags and Site Instructions.

Website refers to the CraneView website, accessible from www.craneview.africa.

You means the person accessing or using the Services, including a Contractor, Client or Subcontractor or their respective employees and representatives, or if applicable Your parent or legal guardian, or the company, or other legal entity on behalf of which such person is accessing or using the Services, as applicable, and includes a reference to Contractors/Clients/Subcontractors/suppliers/service providers/ and/or employees.

Our Role Under POPIA

We Process Personal Information through the Platform in two different capacities, depending on the category of Personal Information concerned.

CraneView as Responsible Party

We act as the Responsible Party in respect of Personal Information for which We determine the purpose and the means of Processing. This includes, without limitation:

• Personal Information We collect when You register an Account on the Platform, including identity information, contact and address details, organisation details, and billing details provided for the purpose of subscription and payment processing through the Platform;
• Personal Information generated by Your interaction with the Platform, including device and IP information, login records, usage analytics, communications with Us, and any feedback submitted through the Platform;
• Personal Information used by Us in aggregated, anonymised or derived form for Platform improvement, research, fraud prevention, regulatory reporting, and the training, validation and operation of Our artificial intelligence systems; and
• Personal Information of Our employees, suppliers, service providers, and recruitment applicants.

CraneView as Operator

We act as an Operator within the meaning of POPIA in respect of Personal Information that a Contractor, Client or Subcontractor uploads to, or causes to be Processed through, the Platform for purposes of executing and controlling a Project. This includes, without limitation:

• Personal Information of Supervisors, workers, employees and other authorised representatives of the Contractor or the Subcontractor (for example names, contact details, identity information, attendance records captured on site, and activity records generated through the mobile application);
• Personal Information contained in daily updates, site photographs, task records, RFIs, Snags, Site Instructions, Variations, and other Project content submitted through the Platform (for example images in which individuals appear, signatures, and contact details recorded in Project documents);
• Personal Information of Clients and their representatives recorded by a Contractor Manager on the Platform, including logged interactions with off-platform Clients and supporting documents attached to such records; and
• Any other Personal Information that a Contractor, Client or Subcontractor makes available through the Platform in order to execute and control a Project.

In respect of Personal Information for which We act as Operator:

• the Contractor, Client or Subcontractor that uploads or causes the Personal Information to be Processed is the Responsible Party for that information, and is responsible for ensuring that it has a lawful basis for the Processing, that the relevant data subjects have been duly informed, and that any required consents have been obtained;
• We will Process the Personal Information only for the purposes of providing the Platform Services and as instructed by the Responsible Party through the Platform or in accordance with the CraneView Terms of Service;
• We will maintain reasonable technical and organisational security measures designed to protect such Personal Information against loss, unauthorised access and unlawful Processing, as contemplated by section 19 of POPIA; and
• We will treat the Personal Information as confidential and will not disclose it except as permitted by this Policy, the CraneView Terms of Service, applicable law, or with the consent of the Responsible Party.

Where there is any doubt as to the category into which a particular item of Personal Information falls, the matter shall be determined by reference to who, in substance, determines the purpose and the means of the relevant Processing.

Collecting and Using Your Information

Collection of and Types of Data Collected

Should You:

• use Our Services,
• register as a Contractor, Client or Subcontractor,
• act as Our service provider or
• apply for a position with the Company,
• be an employee of the Company.

We may ask You to provide Us with certain Personal Information or You may, of your own accord, provide Us with Personal Information.

We may also collect Personal Information about You:

• directly from You;
• in the course of any agreement that we may have concluded with You;
• in the course of providing Services to You;
• from publicly available information;
• when You visit/or interact with Our Website, Our Platform or any of Our social media platforms;
• when You visit Our offices;
• when You communicate with Us via email or other means;
• from third parties who are authorised to provide Us with Your Personal Information.

The Personal Information collected from You or in respect of You, may include, but is not limited to:

First name and last name, title, company name, company registration number, phone number, address, email address, photograph, demographic information, gender, date of birth, Identity Number, Passport Number, nationality, language preferences, agreements with third parties, employee or employer details, records of any interactions with Us, billing and payment details such as bank account numbers, data relating to visits to our Website, Our Platform and social media platforms, device types which access our Website and social media platforms, IP address, location details and other technical communications information.

If we need to Process any of Your Special Information, we shall only do so for a legitimate purpose, in accordance with applicable law.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our Services and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyse Our Services. The technologies We use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Services. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.
• Flash Cookies. Certain features of our Service may use local stored objects (or Flash Cookies) to collect and store information about Your preferences or Your activity on Our Services. Flash Cookies are not managed by the same browser settings as those used for Browser Cookies.
• Web Beacons. Certain sections of our Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.

We may use both Session and Persistent Cookies for the purposes set out below:

Categories of Personal Information We Process

In addition to the general categories of Personal Information described above, the operational nature of the Platform means We Process the following specific categories of Personal Information. Where indicated, We Process particular categories in Our capacity as Operator on behalf of the relevant Responsible Party (as described under "Our Role Under POPIA").

Account and Registration Data. We collect identity information when You register an Account, including names, contact details, addresses, company registration information, user role assignments, authentication credentials, and billing details. Capacity: CraneView as Responsible Party.

Operational and Project Data. We collect and generate data relating to Your use of the Platform, including Project setup records, tasks and task assignments, daily updates, RFIs, Snags, Site Instructions, Variations, review and approval records, comments, attachments, status histories, and the audit trail of user actions and timestamps generated by the Platform. Capacity: CraneView as Responsible Party in respect of Platform-generated metadata; CraneView as Operator in respect of Project content uploaded by Contractors, Clients and Subcontractors.

Attendance and Workforce Data. We Process attendance records and related workforce information captured by Supervisors on site, including worker names, identification details, attendance timestamps, and team assignments. Capacity: CraneView as Operator on behalf of the Contractor or the Subcontractor. The Contractor or Subcontractor is responsible for obtaining all required consents from its workers and employees prior to making their Personal Information available on the Platform.

Site Imagery and Evidence Data. We Process Personal Information contained in photographs, videos and other evidence submitted through the Platform, including images captured in daily updates, snag evidence, task completion evidence and supporting documents, in which individuals may incidentally appear, together with signatures and contact details recorded in Project documentation. Capacity: CraneView as Operator on behalf of the Contractor, Client or Subcontractor that submits the content.

Location and Device Data. We Process device information, IP addresses, login records and, where enabled, location metadata associated with mobile capture of attendance, daily updates and site evidence (such as geotags and timestamps). Location data is used for record integrity, auditability, dispute evidence and Platform security. Capacity: CraneView as Responsible Party in respect of Platform metadata; CraneView as Operator in respect of location data embedded in Project content.

Commercial and Cost Data. We Process information relating to Project financials tracked at category level on the Platform, including income, actual cost, anticipated cost and the cost impact of Variations, as well as subscription and billing information relating to Your Account. Capacity: CraneView as Responsible Party in respect of subscription and billing information; CraneView as Operator in respect of Project cost content uploaded by Contractors.

Communications Data. We Process records of communications made through the Platform (including comments, queries, review notes, notifications and support requests), as well as records of off-platform Client interactions logged by a Contractor Manager and any feedback You submit. Capacity: CraneView as Responsible Party in respect of the records of communication; the content of in-User communications is treated as confidential, subject to this Policy and the CraneView Terms of Service.

Compliance, Risk and Fraud-Detection Data. We Process Personal Information to identify, prevent and investigate fraud, regulatory non-compliance, and breaches of the CraneView Terms of Service or this Policy. This may include IP and device intelligence, usage-pattern analysis, and information shared with Us by competent authorities. Capacity: CraneView as Responsible Party.

Marketing and Communications Preferences Data. Where You have given consent or where We rely on a legitimate-interest basis, We Process contact details and engagement records to send You service updates, transactional notices, and marketing communications about features similar to those You have used. Capacity: CraneView as Responsible Party.

Purpose of Processing and Legal Basis for Processing

The Company will Process Your Personal Information in the ordinary course of the business and in relation to providing the Services. We will primarily use Your Personal Information only for the purpose for which it was originally or primarily collected. We may use your Personal Information for a further purpose only if such purpose constitutes a legitimate interest and is closely related to the original or primary purpose for which the Personal Information was collected. Your Personal Information may be Processed for, without limitation, the following:

• to provide and maintain the Services, including to monitor the usage of our Services and to contact you in relation to the Services.
• to enter into or perform in terms of an agreement to which You are a party.
• to comply with any legislation, regulation, policy and/or directive in relation to the Company, including fraud prevention.
• to protect Your legitimate interests;
• to pursue a legitimate interest of the Company or a third party to whom the Personal Information is supplied;
• transfer to or share with Our employees, service providers, agents, other companies within Our group and other third parties for the purposes as set out in this Policy;
• to provide You with news, special offers and general information about other services which we offer that are similar to those that you have already purchased or enquired about unless You have opted not to receive such information;
• to manage Your requests: To attend and manage Your requests/instructions to Us.
• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of liquidation, business rescue or similar proceedings, in which Personal Information held by Us is among the assets transferred.
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve Our Services. We may also disclose Your Personal Information for any other purpose with Your consent.

Automated Decision-Making, Profiling and Artificial Intelligence

We use automated systems, including artificial intelligence (AI) and machine-learning models, to support the operation, security and improvement of the Platform. The principal automated processes that may affect You include:

• (a) Workflow enforcement: automatically applying blocking rules and workflow controls set out in the Platform, for example preventing the closure of a task while linked RFIs, Snags or Site Instructions remain unresolved;
• (b) Notifications and escalations: automatically flagging overdue submissions, outstanding workflow items, missing daily updates and open RFIs and Snags, and escalating these through the notification centre and dashboards;
• (c) Risk and fraud detection: identifying suspicious behaviour, anomalous use of the Platform, and potential breaches of the CraneView Terms of Service;
• (d) Access and suspension: automatically restricting or suspending access to specific Platform features or full Account access where automated thresholds set out in the CraneView Terms of Service are met or breached.

Where an automated decision produces a legal effect on You or significantly affects You — for example, the suspension of an Account — You have the right under section 71 of POPIA to request that the decision be reviewed by a natural person. To exercise this right, please contact Our Information Officer using the details at the end of this Policy. The review will be conducted in accordance with the appeal mechanism set out in the CraneView Terms of Service.

We may also use Personal Information in aggregated, anonymised or derived form to train, validate, test and improve Our AI and machine-learning models. Where We do so, the data is processed in a form that does not identify any individual data subject. We will not use Special Personal Information for AI training without a separate lawful basis and, where required, prior authorisation from the Information Regulator.

Aggregation, Anonymisation and Data Licence

We routinely transform Personal Information collected through the Platform into aggregated, anonymised or derived datasets, in a form that does not identify any individual data subject. We use these datasets, and the CraneView Terms of Service grant Us a non-exclusive, royalty-free, worldwide, sublicensable licence to use them, for the following purposes:

• (a) operating, maintaining, improving and developing the Platform and the Services;
• (b) training, validating, testing and operating Our artificial intelligence and machine-learning models, as further described under "Automated Decision-Making, Profiling and Artificial Intelligence";
• (c) generating analytics, business intelligence, market research, industry reports and insights for use internally and externally;
• (d) sharing aggregated, anonymised or derived insights, statistics, benchmarks or research outputs with Our customers, partners, regulators, industry associations and other third parties, including for the purposes of advancing construction and project management industry knowledge and supporting Our commercial activities;
• (e) fraud detection, risk management, compliance and security monitoring across the Platform; and
• (f) any other purpose that is consistent with applicable data protection laws and that does not adversely affect the rights or freedoms of data subjects.

The aggregation and anonymisation process is designed to ensure that data subjects cannot be identified, directly or indirectly, from the resulting datasets. Once Personal Information has been validly aggregated or anonymised, the resulting datasets do not constitute Personal Information for purposes of POPIA and may be used and disclosed in accordance with the purposes set out above, subject to applicable law.

By accessing or using the Platform, You acknowledge the aggregation, anonymisation and derived-data uses described in this section and grant the licence set out in the CraneView Terms of Service in respect of any Personal Information You upload to, or that is generated through Your use of, the Platform.

We will not sell Personal Information in identifiable form. We will not share Personal Information in identifiable form with third parties for those parties' own marketing purposes without Your separate consent.

Your Choices. You may object to the Processing of Your identifiable Personal Information for the purposes described in this section at any time, by contacting Our Information Officer using the details set out at the end of this Policy. We will give effect to Your objection in accordance with the rights set out under "Retention and Storage" below, subject to the following:

• (i) We are unable to retract Personal Information that has already been validly aggregated or anonymised before the date of Your objection, because such data no longer constitutes Personal Information identifying You and cannot be re-associated with You;
• (ii) where Your Personal Information is necessary for the operation of the Platform, the performance of a contract with You, or compliance with a legal obligation, We may not be able to give effect to the objection in respect of that Processing while the relevant purpose subsists; and
• (iii) where We rely on Your consent for any Processing in this section, You may withdraw Your consent at any time, and such withdrawal will not affect the lawfulness of any Processing carried out before the withdrawal.

Retention and Storage of Your Personal Information and Your Rights

The Company will retain Your Personal Information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Retention Periods by Data Category

In addition to the general retention principles set out above, We retain the categories of Personal Information described in "Categories of Personal Information We Process" for the following indicative periods, except where a longer or shorter period is required by law:

• Account and Registration Data: for the duration of the User's Account, plus 5 (five) years thereafter for purposes of compliance with POPIA and tax legislation.
• Operational and Project Data: for the duration of the User's Account, plus 5 (five) years thereafter for purposes of accounting, tax, audit and dispute-resolution records, recognising that Project records may serve as evidence in construction-related disputes.
• Attendance and Workforce Data: for the duration of the relevant Project, plus 5 (five) years thereafter for compliance, dispute and audit purposes.
• Site Imagery and Evidence Data: for 5 (five) years from completion or closure of the relevant Project.
• Location and Device Data: for 12 (twelve) months in operational form, and thereafter for up to 5 (five) years in aggregated, anonymised or record-linked form for dispute, audit and analytics purposes.
• Commercial and Cost Data: for the duration of the User's Account, plus 5 (five) years thereafter for accounting, tax and audit purposes.
• Communications Data: for 3 (three) years from the date of the relevant communication or feedback.
• Compliance, Risk and Fraud-Detection Data: for 5 (five) years from the date of collection, or longer where required by applicable law or where the data is subject to an active investigation.
• Marketing and Communications Preferences Data: until You withdraw consent or object, and for a reasonable period thereafter to maintain suppression records.

After the applicable retention period, Personal Information will be permanently deleted, destroyed or aggregated, except to the extent that We are required to retain it under applicable law or to defend Our legal interests in actual or threatened legal proceedings.

You have the following Rights in relation to Your Personal Information:

• Right to, upon having provided adequate proof of identification, request the Company to confirm, free of charge, whether or not the Company holds Personal Information about You;
• Right to request the record or a description of Your Personal Information (including information about the identity of third parties or categories of third parties who have or have had access to Your Personal Information), at a prescribed fee, within a reasonable time, in a reasonable manner and format, and in a form that is generally understandable;
• Right to, in the prescribed manner, request the correction of Your Personal Information;
• Right to, in the prescribed manner, request the destruction or deletion of Your Personal Information, subject thereto that the Company is no longer entitled/required to retain Your Personal Information.
• Right to object to the processing of Your Personal Information, at which time this consent will be retracted and which retraction will not affect previous collection and/or processing of Your Personal Information up until the retraction of the consent and/or Processing which does not per se require consent.
• Right to lodge a complaint to the Information Regulator, in the prescribed manner and form.

The details of the Information Regulator are as follows:

We will use our best endeavours to keep Your Personal Information that we collect accurate, complete and up to date.

You can exercise Your Rights by contacting the Information Officer at the email address provided for the Information Officer in this Policy.

Transfer of Your Information

Your Personal Information is primarily Processed and stored in South Africa. However, We may Process and transfer Personal Information across borders in the ordinary course of providing the Services. Specifically:

• (a) Personal Information collected from or generated by Users may be Processed in South Africa, where Our support teams and administrative functions are located, including in respect of Contractors operating Projects outside of South Africa;
• (b) Personal Information may be transferred between countries where required for the execution and control of a Project involving Users, Subcontractors or Clients located in different countries; and
• (c) Personal Information may be transferred to third-party Service Providers located outside of South Africa, including cloud hosting providers, payment processors, AI and analytics providers, and compliance vendors.

Each cross-border transfer is made subject to one or more of the following lawful bases under section 72 of POPIA:

• (i) Your consent provided by acceptance of this Policy;
• (ii) the transfer is necessary for the performance of a contract between You and Us, or for steps taken at Your request prior to entering into such contract;
• (iii) the transfer is necessary for the performance of a contract concluded in Your interest between Us and a third party; or
• (iv) the transfer is to a country, organisation or person that is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA.

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

We will ensure that our hosting service provider(s) attend to hosting of our server(s), Website, Platform and other applications that uses firewalls and other applicable security measures to prevent interference and unauthorised access to Your Personal Information.

Authorisations to access Your Personal Information will be limited to those who are required to access such Personal Information for the purposes as set out in this Policy. Within the Platform, role-based access controls ensure that Users can only access the Personal Information appropriate to their role on a Project.

Links to Other Websites

Our Services may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on Our Website, Our Platform and social media platforms and by way of communication, whether by email or otherwise of the new policy to You.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on our Website and/or provided to You.

Contact Us

Details of the Company Information Officer

If you have any questions about this Privacy Policy, You can contact the Information Officer using the details above.