Privacy Policy

1. Who is responsible for your information?

Doting Darlings is a division of Avaiden Group (Pty) Ltd, a private company registered in South Africa, registration number 2025/296316/07. Avaiden Group is the responsible party for the personal information it processes to operate Doting Darlings under the Protection of Personal Information Act 4 of 2013 (POPIA).

This policy covers our website and connected account, booking and application services. A household or independent provider may have separate responsibilities for information they collect directly for their own service or employment arrangements.

2. What we collect, and where it comes from

We normally collect information directly from you when you create an account, submit a request or application, choose preferences, upload an authorised document or contact us. We collect only the categories relevant to what you choose to do:

• Accounts: your name, email address, account identifier, verification status and account timestamps. Firebase Authentication / Google Identity Platform handles email and password credentials. Google sign-in may provide your basic name, email address and profile photo; it does not give us access to Gmail, Google Drive or contacts.
• Bookings and private introductions: service, area, visit address, dates, times, duration, recurring schedule, practical instructions, request and response history, assigned provider, quotes and status. Full-time requests also include contact details, live-in or live-out preference, working days, proposed salary budget and relevant household needs.
• Service enquiries and follow-ups: the contact name and email address or phone number you provide, requested help and area, enquiry source, necessary contact history, enquiry stage, next follow-up date and relevant internal notes. Authorised staff may record enquiries received by phone, email or WhatsApp in the private lead pipeline.
• Provider applications: relevant skills, experience, service area, availability, work arrangement and a short biography. Where necessary for a specific role, you may choose to supply identity or work-permission documents, relevant qualifications and authorised references through the private document process. File names, type, size, consent records and review notes are also recorded. Authorised staff may record relevant interview or contact notes, follow-up dates and a manual suitability stage. A suitability decision is separate from document review and does not certify identity or background checks.
• Invoices and received payments: the customer name and contact email, agreed fee descriptions, quantities and amounts in rand, due date, relevant enquiry or request reference, invoice number and status, and necessary manual payment records such as amount received, date and transaction reference. We record which authorised team account made a change. These records support the agreed service, accounting and resolution of payment queries; they do not connect us to your bank account.
• Messages and preferences: booking-related conversations, support enquiries, reminder choices and, if you provide it, a WhatsApp contact number and opt-in record.
• Technical and security records: access and activity records needed to run and protect the service. Our infrastructure providers may process IP addresses, browser/device information, request details and security logs.

When you use Google sign-in, Google supplies the account information you authorise. A relevant household or provider may supply necessary information in a shared booking conversation; authorised staff may add necessary enquiry, matching, support, application-review or accounting records. Internal notes must be practical and relevant to the service, rather than a place to collect unrelated sensitive information. Please have a lawful basis and any necessary permission before sharing another person's details, including a referee's contact information.

Fields marked required are needed for the requested account or service. You may decline optional information, Google sign-in, documents or WhatsApp reminders. If necessary contact, scheduling or location information is missing, we may be unable to arrange the request. You can browse public service information without creating an account.

3. Why we use information

We use relevant information to authenticate accounts; respond to and follow up service enquiries; arrange private matches, requests and bookings; communicate practical instructions and changes; assess relevant provider applications; manage support and complaints; prevent misuse; record agreed fees and received payments; keep necessary service and accounting records; resolve payment queries; and meet applicable legal obligations. We do not collect information simply because it might be useful later.

Depending on the activity, processing is necessary to take steps at your request or perform an agreement, comply with a legal obligation, pursue legitimate interests in a safe and reliable service, or act on specific consent where required. We do not treat acceptance of the Terms as blanket consent to unrelated processing. Optional document collection and review, and WhatsApp preferences, have their own choices. You can withdraw consent through the contact above; this does not undo lawful processing already carried out or prevent processing required on another lawful basis.

We use contact details for relevant service and account communications. We do not use enquiry, booking or invoice information to build advertising profiles or sell marketing lists. Contacting us, being added to the service-enquiry pipeline or receiving an invoice does not itself give consent to advertising or electronic direct marketing. Any future electronic direct marketing would require a lawful basis and a way to refuse or stop it; it is not a condition of booking.

4. Children, care information and screening documents

Accounts are intended for adults aged 18 or older. Please describe practical childcare or care needs without submitting a child's full identity, detailed medical records or other unnecessary sensitive information. Where a service genuinely requires children's or special personal information, we must first establish an appropriate lawful basis and obtain consent from the competent person where required. Do not upload passwords, card details, bank login credentials, PINs, one-time codes, fingerprint records or biometric templates. General notes and payment-reference fields should contain only practical service information or the necessary transaction reference; do not add bank statements, identity documents or unnecessary sensitive payment evidence.

Document collection consent is requested before an upload, and review consent is separate. Uploaded files are stored privately and may be accessed by authorised staff for the stated process; selecting a file is not a promise that it is verified. Only supply a document that is necessary for the role and that you are authorised to share.

Police-clearance uploads and criminal-record review are currently paused. Do not submit criminal-history information in another document category or by email as a substitute. Any future criminal-record screening for clients requires its lawful process and any applicable prior authorisation to be confirmed first. Existing restricted records, if any, are handled through the privacy contact. Ordinary file review is not automated identity verification or a criminal-background check.

5. Who receives information

We do not sell, rent or trade personal information. Necessary sharing is limited to the purpose of the service:

• Relevant booking details, visit addresses and practical instructions are available to the assigned Darling, the household and authorised team members. Linked participants can access their booking conversations and relevant history. Actual Darling application profiles and screening documents are not a public directory; screening files are not available for general browsing by families.
• Private enquiry follow-ups, internal suitability notes and the invoice ledger are restricted to authorised team members for the work they perform. They are not a public directory or available to unrelated households or providers.
• Google Cloud provides website/API hosting, database and private document storage; Firebase Authentication / Google Identity Platform provides account services. Cloudflare routes and protects website traffic. Google Fonts supplies website fonts and receives the technical information needed for those requests. These providers process relevant information to deliver their services, rather than as purchasers of our customer data.
• We may disclose information when required by law, a lawful order or a regulator, or where lawfully necessary to establish, exercise or defend legal rights or address a genuine security or safety issue.

Service-provider access must be limited to the work they perform and subject to appropriate confidentiality, security and processing arrangements. We do not authorise providers to use your booking information for their unrelated marketing.

If you choose our WhatsApp support link, you open a separate service operated by WhatsApp/Meta; information you send there is also subject to that provider's terms and privacy practices. Automated WhatsApp notification delivery, online payment collection and external screening providers are not connected to the current platform. The team can separately keep manual invoices and necessary records of payments already received through an agreed method. Recording an invoice or receipt does not charge you, connect to your bank or independently verify a transfer. We do not request card numbers, bank login credentials, PINs or one-time codes through the current forms or document process. We will explain relevant data handling before introducing online payment collection.

6. Storage, international processing and security

Our core production website, API, database and private document storage use Google Cloud's Johannesburg region. Authentication, network delivery and other provider operations may involve processing outside South Africa. This policy does not promise that all information remains in South Africa. International transfers must meet POPIA section 72, including an applicable adequate-protection, binding-agreement, consent or other permitted basis. Contact the privacy team for information about the providers and safeguards relevant to your request.

We use reasonable technical and organisational safeguards appropriate to the information, including encrypted connections, authenticated accounts, access controls and private document storage. We restrict administrative access and take reasonable steps to protect information handled by operators. No online service can guarantee absolute security. If a security compromise requires notification, we will notify the Information Regulator and affected people as required by POPIA.

Web sign-in uses per-tab browser storage; request drafts may be kept in memory while you complete the form. Native account sessions, where used, rely on device secure storage for refresh credentials. Google sign-in and third-party services may use their own necessary cookies or storage. Our app does not include advertising tracking pixels. Sign out on shared devices, keep your credentials private and tell us if you suspect account misuse.

7. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, an active arrangement, applicable record-keeping duties, a justified dispute or lawful retention requirement. We must delete, destroy or de-identify information that no longer has a lawful retention basis. Retention depends on the type of record and the circumstances; there is no promise of an indefinite archive.

Account closure and deletion requests currently go through the privacy team. There is no automatic self-service account deletion. We may need to retain particular service, invoice, received-payment or security records lawfully and will explain relevant limits. Recovery copies and backups can remain for a limited recovery cycle, with access restricted; deleting an active file does not instantly erase every backup. A privacy request does not itself cancel a booking or end a separate service or employment agreement.

8. Your rights and how to complain

Subject to POPIA and applicable procedures, you may ask whether we hold your personal information, request access, request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, object to applicable processing on reasonable grounds, withdraw consent, and complain about interference with your rights. You may also object to direct marketing at any time.

Email theteam@dotingdarlings.co.za for Motsholane Sebola / the privacy team. Describe your request and the account concerned without sending unnecessary identity documents. We may need proportionate identity or authority checks before releasing or changing private records. Confirmation of whether we hold personal information is free; access requests and any permitted fees follow the applicable statutory process. We will explain a lawful refusal or retention restriction and the available complaint route.

You may complain directly to the Information Regulator (South Africa): complaint procedures and forms, POPIAComplaints@inforegulator.org.za, telephone 010 023 5200. You do not need our permission to contact the Regulator or use another remedy available by law.

9. Policy changes

We publish the current policy and effective date here. We will bring material changes to your attention where appropriate and obtain fresh consent where the law requires it. A policy update does not authorise unrelated use of information already collected. Read our Terms of Service for the booking and introduction arrangements.