Privacy Policy

Last updated: 13 November 2026

lungro is a South African service. We treat your information with care, and we only collect what the service actually needs to work. This policy explains what we collect, why, and the rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).

Who we are

lungro is operated by LUNGRO (PTY) LTD, a private company incorporated in South Africa with registration number 2026/889556/07. You can contact us at contact@lungro.co.za.

What we collect

• Account details: your email address, company name and password (stored securely).
• Profile details: your name and contact details, if you add them.
• Data you enter: client names, contact details, addresses and VAT numbers, activities, timesheets, invoices, and any banking details you add for invoices.
• Support messages: the content of messages you send us and your contact details.
• Usage and security data: technical information such as your IP address and account activity, used to operate and protect the service.

How we collect it

We collect information directly from you when you create an account, use the service or contact us; automatically when you use the service, such as technical and security data; and from service providers that help us run the service.

Why we collect it

• To run the service you asked for: store your records, generate invoices and keep your account secure.
• To send service messages: billing notices, security alerts and updates you need.
• To meet legal duties, such as retaining tax records.

We do not sell your personal information, and we do not use it for third-party advertising.

Why we are allowed to process it

We process personal information only where POPIA permits us to: to perform our agreement with you, to comply with legal obligations, and for our legitimate interests in operating and securing the service. Where we rely on consent, you may withdraw it at any time.

If you enter information about your own clients

When you use lungro to manage your clients, you are the responsible party for their personal information under POPIA, and lungro processes it on your instructions as your operator. This means you decide what is entered and why, and you must have a lawful basis to share it with us. Our Terms of Service record this arrangement.

Cookies and similar technologies

We use essential cookies to keep you signed in and protect our forms, and we remember your cookie choice in your browser. We do not currently use analytics or advertising cookies. See our Cookie Policy for the full list and how to change your choice.

Who we share it with

We use a small number of service providers (operators) that process information on our behalf:

• Hosting and database providers that store the service data.
• Email delivery providers that send verification, password-reset and support emails.
• A security provider that protects the sign-up form from abuse. Your IP address may be sent to it to verify you are a person.
• Content-delivery providers that serve fonts and stylesheets to your browser. These providers receive your IP address when your browser loads them.

Online card payments are not live yet, so subscription payment is arranged directly with our team.

Some of these providers may process information outside South Africa. Where that happens, we rely on the safeguards in section 72 of POPIA, such as contractual protections and the provider's own privacy commitments. We do not sell your personal information to anyone.

How long we keep it

• Active accounts: for as long as your account is open.
• Tax records: at least five years after the relevant tax period, as SARS requires.
• Security and audit logs: kept only for as long as needed for security and auditing, then deleted.
• Backups: deleted information may remain in backups for a limited period until those backups are replaced.

When you close your account, we delete or anonymise your personal information unless the law requires us to keep it. You can close your account by emailing contact@lungro.co.za.

How we protect it

We use appropriate technical and organisational measures to protect personal information, including access controls, encryption in transit, and monitoring. No method of storage or transmission is perfectly secure, so we cannot promise absolute security.

Your rights under POPIA

You may ask for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, object to processing, or withdraw consent where consent is the basis for processing. You can do this at any time by emailing contact@lungro.co.za. We respond within the time frames POPIA requires, usually within 30 days. Some requests may be limited by our legal duty to keep tax records.

If you are not satisfied with how we have handled a request, you may complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; complaints.IR@justice.gov.za; 010 023 5200; inforegulator.org.za.

Security breaches

If a security breach compromises your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

Children

lungro is a business tool and is not intended for anyone under 18. We do not knowingly collect personal information from children.

Changes

If this policy changes, we will update this page and, where the change is material, tell you by email before it takes effect.

How to reach us

Questions about this policy or your data? Contact our Information Officer, DLUDLA, LUTHANDO, at contact@lungro.co.za.

Our registered address is 2 Punters Way, Kenilworth, Cape Town, Western Cape, 7708, South Africa.