Privacy Policy
In short: we keep the account details you give us and the certificates, photos and customer details you upload, only to run EZ COC for you. You are responsible for your customers' details and we act as your operator. We use no advertising trackers, and Google Analytics runs only if you accept it. Your files are stored in the USA. You can ask for access, correction or deletion at any time at privacy@ezcoc.com.
This page has not been reviewed by an attorney.
1. Who we are
EZ COC is operated by its owner ("we", "us"). Our full company details, including our registered name and number, will be published on this page before general launch.
EZ COC is a web app at https://ezcoc.com and an Android app. Electricians use it to file Certificates of Compliance (COCs), attach site photos with descriptions, find them again and generate a PDF.
We are the responsible party (POPIA) and controller (GDPR) for your account information. Our Information Officer's name will be published on this page before general launch. For any privacy or data request, write to privacy@ezcoc.com.
2. Your customers' details: roles
When you file a COC you may include your customer's name, address, COC number and photos of their premises. For that information you (or your company) are the responsible party under the Protection of Personal Information Act (POPIA), and EZ COC acts as your operator under sections 20 and 21. We process it only on your instructions, to provide the service, and we keep it confidential. Our operator commitments are in our Terms.
You must have a lawful basis to upload your customers' details and you must tell them how you use them. Do not upload details you are not entitled to share. If a customer asks us about their details, we will refer them to you.
3. What we collect
Account data, which you give us or which we create when you sign up and use the service:
- email address, and your password stored only as a bcrypt hash (we cannot read it)
- full name and company name
- the terms version you accepted and the time you accepted it
- the time you verified your email
- your paid access period (start and end dates)
- a failed-login counter and lockout time, used to block password guessing
- sign-in session tokens, stored hashed, valid for 30 days, with the IP address used at sign-in
- one-time 6 digit email codes for email verification and password reset, stored hashed and expiring after 15 minutes
- access code redemptions, logged with your account and IP address
Content you upload, for each COC:
- your customer's name and address, and the COC number
- the COC document (PDF or image)
- site photos, each with a section and a description, which may show a customer's premises and sometimes people
- PDFs you generate in EZ COC
Photos can carry hidden location data (EXIF). We do not remove it, so strip it yourself if you do not want it stored.
Payment data: you pay by bank transfer (EFT). We keep a record of payments received and of the access code issued to you. If card payments through Paystack are added later, Paystack will handle card details and we will update this policy first.
Staff and security logs: our admin tools show account emails, names, companies, access dates and COC counts. Admin actions are logged with the staff member's IP address. Our hosting provider also keeps standard request logs, which include IP address and browser type.
Analytics: only if you accept analytics on ezcoc.com, Google Analytics 4 collects usage data such as pages visited, device and browser. See our Cookie Policy.
Source: we collect this from you. Your customers' details come from you, not from them.
The free demo uses sample data, collects no personal data and saves nothing on our servers.
4. Why we use it
| Purpose | Lawful basis |
|---|---|
| Create and secure your account, verify your email, reset passwords, limit failed logins | Contract, and legitimate interest in keeping accounts secure |
| Store, search and assemble your COCs, photos and PDFs | Contract, and your instruction as the responsible party (we are your operator) |
| Take payment by EFT, issue and log access codes, and manage your access period | Contract, and legal obligation to keep financial records |
| Send service emails (verification, reset and admin codes) | Contract |
| Record that you accepted our Terms | Legitimate interest in proving agreement |
| Keep the service secure, investigate abuse, log admin actions, fix faults | Legitimate interest |
| Understand how the website is used (Google Analytics) | Consent, which you can refuse or withdraw at any time |
| Comply with law and lawful requests | Legal obligation |
We do not sell or share personal information for advertising. We do not use it for marketing, profiling or automated decisions.
5. Browser storage and cookies
EZ COC sets no cookies itself. It stores a few items in your browser, and the Android app keeps your sign-in token in on-device storage. The full list is in our Cookie Policy. Google Analytics cookies (_ga and _ga_ followed by an ID) are set only after you accept analytics.
6. Who we share it with
These providers act as our operators and may use the data only to provide their service to us:
- Vercel Inc.: website hosting, serverless functions and private file storage for uploaded files. Files are reachable only through short-lived signed links (valid for 1 hour) issued to signed-in members of the owning company.
- Neon: our Postgres database.
- Resend: sends our service emails (verification, reset and admin codes), so it sees your email address and the message.
- Cloudflare: DNS only. It routes requests to ezcoc.com and does not store your content.
- Google (Google Analytics 4): only if you accept analytics.
Everyone in your company account can see the COCs and files the company has uploaded. We may disclose information where the law requires it. We share it with no one else.
7. Transfers outside South Africa
Your data is processed outside South Africa. Vercel hosts and stores files in the USA (Washington DC region, iad1). Neon stores the database in the USA (AWS us-east-1). Resend and Google may also process data outside South Africa.
Under section 72 of POPIA, personal information may leave South Africa only if the recipient is bound by law, a binding agreement or binding corporate rules that give a similar level of protection, or you consent, or the transfer is needed to perform your contract. We rely on the data processing terms of each provider, which commit them to protect the data. For people in the EU or UK, we rely on the standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework. Contact us for copies or more detail.
8. Retention and deletion
- Account and COC data: kept while your account is active and for 12 months after your access ends, then deleted.
- Earlier deletion: ask at privacy@ezcoc.com and we will delete your account and files, unless the law requires us to keep something longer.
- Payment records: kept as long as financial and tax law requires.
- Backups: deleted data rolls off our backups within 30 days.
- One-time email codes: expire after 15 minutes. Sessions expire after 30 days.
- Hosting and security logs: kept for a limited period set by the provider.
9. Your rights
Under POPIA, and under the GDPR for people in the EU or UK, you may:
- ask whether we hold personal information about you and get a copy (access, portability)
- ask us to correct or complete it
- ask us to delete it
- object to, or ask us to restrict, how we process it
- withdraw consent where we rely on it, without affecting what happened before
- not be subject to a decision made only by automated means (we make none)
- not be treated worse for using these rights
Write to privacy@ezcoc.com. We aim to reply within 30 days. We may ask you to prove who you are. If a request is about your customer's details in a COC, we may refer it to you, because you are the responsible party.
You may complain to the Information Regulator of South Africa at https://inforegulator.org.za. If you are in the EU or UK you may also complain to your local data protection authority.
10. Security
We use encrypted connections, hashed passwords, hashed session tokens and email codes, lockout after failed logins, private file storage with short-lived signed links, company-level separation of data, and logging of admin actions. No system is perfectly secure, and we cannot guarantee absolute security. Keep your password private. If we have reasonable grounds to believe your information was accessed without authority, we will tell you, and the Information Regulator where the law requires it.
11. Children
EZ COC is for working electricians and is not directed at children under 18. If we learn we hold a child's personal information, we will delete it.
12. Changes to this policy
If we change this policy we will update the version and date above. For material changes we will ask you to accept the new terms again before you continue.
13. Contact
Privacy and data requests: privacy@ezcoc.com. Company details and the Information Officer's name will be published on this page before general launch. See also our Terms of Service and Cookie Policy.