Legal

Privacy Policy

Last updated: 23 October 2026

Download PDF

Legal

Cookie Policy

Acceptable Use

POPIA

PAIA

Have a question?

1. About this notice

This Privacy Notice tells you how WRDO (Pty) Ltd, trading as WRDO™ (“WRDO”, “we”, “us”, “our”) collects, uses, shares and protects your personal information. We publish it to comply with section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”) and we treat your personal information in accordance with the eight conditions for lawful processing set out in POPIA. If you do not agree with how we handle your personal information described in this notice, please do not provide your personal information to us. If you have already done so and want us to stop or change anything, contact our Information Officer using the details in section 14.

2. Who we are

WRDO (Pty) Ltd is a private company incorporated in the Republic of South Africa with Enterprise Number 2026/095904/07, trading as WRDO™. WRDO connects people with the businesses and people who provide goods and services near them, on WhatsApp, on the web and in the WRDO app, together with the website at https://wrdo.co.za (together, “the Service”). WRDO is the responsible party for the personal information described in this notice, as that term is defined in POPIA. Our registered address is Val de Vie Estate, R301 Jan van Riebeeck Drive, Paarl, 7646, South Africa. Our statutory information is set out in our PAIA Manual, which is available at wrdo.co.za/paia or on request from [email protected].

3. What personal information we collect

We may collect the following categories of personal information about you. The exact information collected depends on how you use WRDO. If you message WRDO on WhatsApp before tapping Let's chat, we answer local questions; your message passes through our service providers (some outside South Africa, mostly the USA), and we keep that chat for 24 hours only so follow-ups make sense, then delete it automatically, with no memory or profile kept. Saying STOP, tapping Not now or asking WRDO to forget you deletes it at once, and tapping Let's chat makes it part of your WRDO conversation.

Your WRDO account: one account ID that links your phone number, WhatsApp number or WhatsApp username, email address and any social or app logins, so that you are the same person to WRDO on WhatsApp, the web and the app.

Identification and contact details: name, surname, email address, telephone/WhatsApp number, postal or physical address and, where needed for payouts or verification, ID or passport number and date of birth.

Using WRDO: your area, what you ask WRDO for, your chats with WRDO, quotes, bookings, orders, tips, reviews you give, Diggies and referrals.

Memory: WRDO remembers things that help it help you, such as your area, your preferences and past bookings. You can ask WRDO what it remembers and have it deleted at any time.

Payments: card payments, including weekly card holds, are processed by our payment processor. Your card details go to our payment processor only; WRDO never sees or stores your full card number. If you choose to open or pay from a MyMoolah wallet, we share the details MyMoolah needs to open and run your wallet, and MyMoolah handles them under its own terms and privacy policy. We keep the transaction record: the amount, date, what it was for, the reference and its status.

Businesses and the people who work for them: name and contact details, business details and profile (services, prices, photos), reviews received and transaction history. To pay out a business or person, we collect the name, ID number and bank account or card details of the person or business being paid. These are validated through our payment processor, and afterwards WRDO keeps only a masked number. Anyone being paid can instead choose to be paid into a linked MyMoolah wallet.

Verification: for the “Verified on WRDO” badge, a verification partner checks identity (an ID document and a face check). For the “Registered business” badge, WRDO checks a company’s registration with CIPC. We keep the outcome of those checks.

Corporate and professional: job title, employer, role in your organisation. Financial: VAT and tax numbers, where required to invoice or pay you. Communications: emails, messages and voice notes you send us. Website usage: IP address, browser type, device, referring URL, pages visited, cookie identifiers, approximate geographic location. Marketing preferences: whether you have consented to receive marketing.

Sensitive (“special”) personal information: a face check involves biometric information, which POPIA treats as special personal information. It is done by our verification partner only with your consent and only to confirm your identity. Criminal-record checks are done only after any prior authorisation POPIA requires from the Information Regulator, and only with the person’s consent. Any other special personal information you provide will be processed only for the purpose for which you supplied it and only with your consent or as authorised by POPIA.

4. How we collect your personal information

We collect personal information: directly from you when you use WRDO on WhatsApp, the web or the app, contact us, fill in a form on our website, send us an email, sign a contract, or apply for a role; automatically through cookies and analytics when you visit our website (see section 8); from our payment processor when it processes payments and validates bank accounts; from MyMoolah, if you open or use a MyMoolah wallet through WRDO; from our verification partner, when you ask to be verified; from public sources such as CIPC, SARS, the Information Regulator and public business listings (for businesses WRDO shows as “found online”); and from other third parties where the law or our agreement with you authorises us to do so.

5. Why we process your personal information

We process personal information for the following purposes and on the following legal bases under POPIA:

Running the WRDO Service (keeping your one account across channels, getting quotes, facilitating bookings, orders, tickets, tips and household payments, remembering your preferences, running Diggies and referrals, and communicating with you): performance of a contract (s11(1)(b)) and legitimate interest (s11(1)(f)). Verification (identity, face and company checks for WRDO’s badges): consent (s11(1)(a)). Payouts and fraud prevention (validating bank accounts, and checking for bank-name mismatches, bank-account changes, unusually large amounts and repeated disputes): legal obligation (s11(1)(c)) and legitimate interest (s11(1)(f)).

Complying with the law (Companies Act, Tax Administration Act, FICA, POPIA, PAIA, including record-keeping and reporting): legal obligation (s11(1)(c)). Engaging service providers (procuring software, professional services, banking, payment processing): performance of a contract. Managing investors and shareholders (holding records of beneficial owners and corresponding with them): legitimate interest (s11(1)(f)) and statutory record-keeping. Recruitment and employment (considering applicants, employing staff, paying salaries, complying with labour law): performance of a contract or legal obligation.

Marketing (sending you information about WRDO with your consent; you may opt out at any time): consent (s11(1)(a)). Website analytics and security (understanding visitor patterns, detecting abuse, securing the website): legitimate interest (s11(1)(f)). Responding to requests, complaints and legal claims (including PAIA requests, data-subject access requests and regulator queries): legitimate interest or legal obligation.

Business directory: listing businesses we found in public sources so people nearby can find them, and so owners can take over their listing. Legitimate interest (POPIA section 11(1)(f)). Sources: open map data (Overture Maps, licensed CDLA-Permissive-2.0) and the business’s own website or Facebook Page. Shown publicly: business name, category, town or suburb, hours and the business’s own links. Never shown: phone numbers, WhatsApp numbers or email addresses. A street address only shows once the owner has claimed the listing. To object or correct a listing, tap ‘Remove or correct this’ on it, or email [email protected]. We deal with every objection within 24 business hours. Kept while the business appears in the open map data; if it drops out, we hide it straight away and delete it within 90 days.

6. Whether you are required to provide your personal information

In most cases providing your personal information to us is voluntary. However, if you choose not to provide certain information we may not be able to enter into or perform a contract with you, respond to your enquiry, give you access to our services, or comply with a legal obligation that requires us to record certain information.

Where the law requires us to collect specific personal information (for example, for FICA, tax or labour-law purposes), that collection is not voluntary.

7. Who we share your personal information with

We share personal information only where there is a lawful basis to do so. Categories of recipients include: the businesses you deal with through WRDO (a business sees what it needs to quote, deliver and get paid, such as your name, area and job or order details; you see the business’s profile, reviews and verification status); our payment processor, to process payments, refunds and payouts and to validate bank accounts; our verification partner, for people and businesses who ask to be verified; our service providers (“operators” in POPIA terms), meaning cloud, IT, hosting, messaging, AI and analytics providers bound by written processing agreements; business systems you or a business choose to connect, on your instruction; our external auditors, accountants, tax advisors and legal counsel; government and regulatory bodies (SARS, CIPC, the Information Regulator, courts, the South African Police Service) where required by law or in the exercise or protection of a right; banks and FICA-accountable institutions where necessary to receive or make payments; any party to whom we sell or transfer parts of our business, limited to what is reasonably needed; and any other party to whom you have given us consent to disclose your personal information.

We do not sell your personal information.

8. Cookies, WhatsApp, AI and automated processing

Our website uses cookies and similar technologies to make the site work and to remember small choices, like light or dark mode. Analytics and ad cookies load only if you agree in the cookie banner, and you can change your choice at any time. Framer, which hosts our website, also counts page visits without using cookies. Cookies stay on your device for no longer than 24 months. Our Cookie Policy at wrdo.co.za/cookies explains the details.

When you chat with WRDO on WhatsApp, your messages are also processed by WhatsApp/Meta under their own terms and privacy policy, including on servers outside South Africa. We do not control WhatsApp’s own processing.

WRDO uses automated systems, including AI models run by our service providers, to read and answer your messages, understand what you need, prepare quotes and bookings, and remember your preferences. To do this, the content of your messages and the account details needed to answer them (such as your area and preferences) are sent to those providers, some of which process data outside South Africa under the safeguards described in section 9. Our providers may not use your personal information to train their own models. WRDO does not make decisions that have legal effect on you based solely on automated processing: when an automated check flags a payment or payout, a person reviews it.

If you don’t want your messages handled this way, you can email [email protected] to deal with a person instead, ask WRDO to forget what it remembers about you, or delete your data at any time (see section 11).

9. Cross-border transfers

Some of the cloud, IT, messaging and AI service providers we rely on (including WhatsApp/Meta) operate data centres outside the Republic of South Africa. A current list of these providers and the countries in which they store personal information is available on request from our Information Officer (see section 14). We store your information with service providers in the European Union (Sweden, Germany, Finland and Belgium), where data-protection law gives at least the same protection as POPIA. Where your personal information is transferred outside South Africa, we will only do so where one of the conditions in section 72 of POPIA is met, which generally means that the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection.

10. How we keep your personal information secure

We have implemented reasonable technical and organisational measures to protect personal information against loss, unauthorised access or unlawful processing. These include: strong passwords and multi-factor authentication on administrative accounts; encryption of personal information in transit (TLS) and at rest where technically feasible; role-based access controls and the principle of least privilege; anti-virus, anti-malware and endpoint protection; regular backups and a documented restore procedure; written processing agreements with operators; and an internal incident-response procedure aligned with section 22 of POPIA. Card details are handled only by our payment processor, and WRDO hides bank details typed in the chat.

No system is 100% secure, but we work to maintain a level of protection appropriate to the risk.

11. How long we keep your personal information, and deleting it

We keep personal information only for as long as we have a lawful purpose to do so. Records the law requires us to keep, for example under the Companies Act, the Tax Administration Act and FICA, are kept for the periods those laws set. Account, chat, booking and memory records are kept while your account is active and for a reasonable period afterwards to resolve disputes, unless you delete them sooner. Website analytics and log files are kept only as long as needed for their purpose or for a security investigation. Marketing data is kept until you opt out, plus a reasonable suppression period.

Deleting your data: say “delete my data” in the WRDO chat and WRDO erases your personal information. The only exception is money records the law requires us to keep, for example under the Tax Administration Act: we keep those only for as long as the law requires, use them for nothing else, and then delete them. When a retention period ends and we are not otherwise required to keep the information, we delete or de-identify it.

12. Your rights

Under POPIA you have the right: to be notified that we are collecting personal information about you; to request access to your personal information (section 23); to request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete or unlawfully obtained (section 24); to object, on reasonable grounds, to the processing of your personal information (section 11(3)); to object at any time, free of charge, to processing for direct marketing purposes, in which case we will stop immediately on receipt of your objection (sections 11(3) and 69(3)); to withdraw consent for direct marketing by unsolicited electronic communications at any time (section 69); to not be subject to a decision based solely on automated processing that has legal effect on you (section 71); and to lodge a complaint with the Information Regulator (see section 13).

To exercise any of these rights, contact our Information Officer (section 14) or simply ask WRDO in the chat. We will respond to access and correction requests within the time PAIA and POPIA allow. A formal access request may attract a fee prescribed under PAIA; our PAIA Manual explains how.

13. Complaints

If you believe we have not handled your personal information in line with POPIA, please first contact our Information Officer so that we can try to resolve the issue. If you are not satisfied, you can lodge a complaint with the Information Regulator (South Africa). Its current contact details and complaint forms are published at https://inforegulator.org.za.

14. Contact our Information Officer

Information Officer: registered with the Information Regulator. Email: [email protected]. Every request, correction, deletion or complaint is handled through that address. Postal address: Val de Vie Estate, R301 Jan van Riebeeck Drive, Paarl, 7646, South Africa.

15. Changes to this notice

We may update this Privacy Notice from time to time. The latest version is always available at wrdo.co.za/privacy. The date at the top of the notice tells you when it was last revised. Material changes will be communicated to you where reasonable to do so.

Issued by WRDO (Pty) Ltd. WRDO™, “As you are”™, echo™ and the WRDO spiral mark are trade marks of WRDO (Pty) Ltd, used pending registration with CIPC under the Trade Marks Act 194 of 1993.