Office Care Systems

Privacy

Privacy Policy

Last updated: 12 October 2026

In short: we collect what we need to talk to you, to show you what we build and to do the work; we do not use tracking or advertising cookies; we never sell your information; and you can ask us to show, correct or delete it, or to stop contacting you, at any time.

1. Who we are

Office Care Systems (Pty) Ltd is a software and automation studio based in South Africa that works with clients worldwide. We are the responsible party (under South Africa's POPIA) and the controller (under the EU and UK GDPR) for the personal information described here. Our Information Officer is Marc Legrix. For anything about your information, write to marc@officecaresystems.com.

This policy covers this website, our client portal, the demo links we send to prospective clients, our business email and outreach, and the internal tools we use to run the business. Our Bridgedeck apps have their own policy.

2. What we collect

Visiting this website

We use Vercel Web Analytics to count page views. It does not use cookies and does not identify you; it records the page, the referring site, and your country, device type and browser in aggregate. Our hosting provider also keeps short-lived server logs, which include your IP address and browser details, for security and to keep the site running.

Contacting us

If you use the contact form we receive what you type: your name, business name, email, phone number, a description of your business and goals, your timeline and any questions. If you email us, we receive your message and whatever it contains.

Business outreach

We contact businesses we think we can help. For that we hold business contact details — name, job title, company, business email address and phone number — gathered from public sources such as company websites, business directories and professional networks, together with a record of the emails we have sent and any replies. Every outreach email tells you how to ask us to stop.

Opening a demo we sent you

When we send you a link to a demo we have built, our demo site records each time it is opened or unlocked: the date and time, which demo, the name the link was issued to, your device type and browser (from your browser's user-agent), and your IP address, from which an approximate location (country and city) can be inferred. We use this to know whether the demo reached you, to follow up at a sensible time, and to protect the demo from misuse. The demo site sets no cookies and stores nothing on your device.

Using the client portal

If you are a client with a portal account, we hold your email address and the sign-in details our authentication provider needs, plus the project information we share with you there.

Working with us

For clients and suppliers we keep what any business keeps: contact details, agreements, quotes, invoices, payments and correspondence.

3. Cookies

We do not use advertising or tracking cookies, and we do not sell or share information for advertising. The only cookies and browser storage we use are the ones needed for something you asked for — keeping you signed in to the client portal. Because nothing else is set, there is no cookie banner.

4. Why we use it, and on what basis

  • To answer you and to do the work — enquiries, quotes, projects, invoices and support. Basis: taking steps at your request before a contract, and performing the contract.
  • To find and follow up with potential clients — outreach emails and demo follow-up. Basis: our legitimate interest in offering our services to businesses, balanced against yours; you can object at any time and we will stop.
  • To run, secure and improve our website and demos. Basis: legitimate interest.
  • To keep accounting and tax records. Basis: legal obligation.

5. Google sign-in in our internal tools

Our internal business console ("OCS Console") uses Google sign-in only for our own staff, so that a receipt photographed on a phone can be saved into the company's own Google Drive. It asks only for the drive.file permission, which lets it see and manage the files it creates and nothing else in the Drive. It does not read, collect or share anyone else's Google data, and nothing it handles is used for advertising or to train AI models.

Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Who processes it for us

We do not sell personal information. We use a small number of service providers who process it on our instructions:

  • Vercel — hosting for this website, our demos and our internal tools, and website analytics.
  • Google — business email, documents and file storage (Google Workspace and Drive), the contact-form spreadsheet, and the client portal (Firebase).
  • Neon — the database behind our internal business console.
  • Anthropic — AI assistance we use when drafting and organising our own work.
  • Our accountants and tax advisers, for bookkeeping and tax filings.

Some of these providers are outside South Africa, the UK and the EU, mostly in the United States. Where information leaves your country we rely on the safeguards the law requires, such as the providers' standard contractual clauses.

7. How long we keep it

  • Client, supplier and accounting records: for the relationship and then five years, as South African company and tax law requires.
  • Enquiries that do not become work: up to two years after our last contact.
  • Outreach records and demo-access records: up to two years after our last contact with you.
  • If you ask us not to contact you again, we keep only your email address and that request, so that we never contact you again.

8. Your rights

Wherever you are, you can ask us what we hold about you, to correct it, to delete it, or to stop using it. You can object to marketing at any time — reply to any email or write to marc@officecaresystems.com and we will stop. We answer within 30 days and do not charge for it.

If you are not satisfied, you can complain to a regulator: in South Africa, the Information Regulator; in the UK, the Information Commissioner's Office; in the EU, the data protection authority of your country (for example the Data Protection Commission in Ireland or the AEPD in Spain).

9. Security, children and changes

Access to our systems is limited to the people who need it and protected by sign-in. Our services are for businesses and are not directed at children. If we change this policy we will update the date at the top of this page; significant changes will also be shown here.