Last updated: 24 September 2026

This policy explains how the eRAMS platform handles personal information and how we meet our obligations under the South African Protection of Personal Information Act, 2013 (POPIA). It is written to be honest about what we do today rather than what we plan to do later.

1. Who we are

eRAMS is a road asset and assessment platform operated by Dlala Group. In this policy, “we”, “us” and “eRAMS” refer to Dlala Group acting as the responsible party for personal information processed through the platform.

For privacy questions, requests or complaints, contact us at accounts@erams.co.za.

2. What information we collect

We only collect information that is needed to deliver the platform. The categories below correspond to the surfaces a user actually interacts with.

2.1 Assessor mobile app

• Account credentials. Email address and password used to sign in. Authentication is handled by Supabase Auth; passwords are hashed by Supabase and are never stored or visible to us in plaintext.
• Device identifier. A randomly generated identifier created on first launch and registered with the server. We use it to associate offline assessment data with a specific device for sync, audit and support.
• Location data. GPS coordinates from the device while the app is in use, used for road-segment proximity, map centring and depot-issue capture. Location is not tracked in the background.
• Photos. Photos attached to assessments and depot-issue reports. Field photos are taken to document infrastructure condition and may incidentally include people, vehicles or number plates that were in frame.
• Assessment data. TMH 9 visual condition ratings of public road infrastructure, captured against road segments. This is infrastructure data rather than personal data, but is listed here for transparency.
• Free-text notes. Notes typed by the assessor or QA reviewer. These could contain incidental personal information if the user chooses to type it.
• Map tile requests. The app downloads map tiles directly from MapTiler, so each request reveals the device’s IP address to MapTiler.
• Usage events and error reports. The app sends product-usage events to PostHog and crash and error reports to Sentry. These carry your user identifier, never your email address or password.

2.2 Web admin and QA

• Account credentials. Same Supabase Auth account used for the mobile app.
• Notification preferences. A record of which tenant-scoped notification streams a user has opted out of.
• Audit log entries. Each meaningful state transition (assessment submission, QA decision, reassignment, etc.) is recorded with the acting user, timestamp and before/after state. This supports investigations and dispute resolution.
• Usage events and error reports. The admin applications send product-usage events to PostHog and error reports to Sentry, identified by your user identifier only. Error reports are scrubbed of email addresses and access tokens before they leave the browser or server.

2.3 Marketing site

• Contact form submissions. When you complete the form at /contact we collect your name, email, organisation, role, area of interest and message. We store the submission in our database for up to 24 months and deliver it to our team by email so we can respond.
• Essential cookies. We use only the cookies required for the site to function, including the session cookie for authenticated areas. We do not deploy advertising cookies, analytics cookies or third-party trackers on this site today.

3. Why we collect it

• To authenticate users and authorise access to tenant-scoped data.
• To capture, sync and quality-assure road condition assessments.
• To maintain an audit trail that satisfies engineering and municipal accountability requirements.
• To respond to enquiries you submit through the contact form.
• To send transactional emails related to assessments and platform activity (for example QA notifications), subject to your preferences.
• To find and fix faults in the platform and to understand which features are used.

We do not sell personal information. We do not use it for advertising, behavioural profiling or third-party marketing.

4. How we store and protect it

• Encryption in transit. All client-server traffic uses HTTPS / TLS.
• Encryption at rest. Database and storage are encrypted at rest using the defaults provided by Supabase.
• Tenant isolation. Data is partitioned per tenant (organisation) and access is enforced at the database layer using Supabase Row Level Security policies.
• Least-privilege access. Only authorised staff with an operational need can access production systems, and actions on production data are logged.
• Passwords. New passwords must be at least 12 characters long and mix lowercase and uppercase letters, digits and symbols, and passwords that have appeared in known data breaches are refused.

Backups. Point-in-time recovery is available on our plan as a paid add-on and is not currently enabled; we rely on daily backups retained for seven days, giving a recovery point objective of at most 24 hours.

Automated retention. A nightly scheduled job deletes audit-log records older than 365 days and contact-form submissions older than 24 months. No other personal information is deleted automatically at this time. Personal information in assessments, accounts and attachments is retained for as long as it is needed for the purposes above, or for as long as a customer contract requires.

Security compromises. If a security compromise affects your personal information we will notify the Information Regulator and you as soon as reasonably possible after becoming aware of it, as section 22 of POPIA requires.

5. Where it lives (data residency)

The primary database, file storage and authentication services are hosted by Supabase in the EU (Ireland, eu-west-1) region. The background worker that handles imports and notifications runs on Render in Frankfurt. The marketing and admin web applications are served from Vercel’s global edge network; their server-side functions, including the one that receives the contact form, run in Vercel’s United States region because we have not pinned them to another region. Error reports and usage events are stored in the EU by Sentry and PostHog. Email is sent through Resend, which stores message data in the United States.

Personal information is therefore transferred outside South Africa, to the EU and to the United States. We make these transfers on the basis of section 72(1)(a) of POPIA: each operator listed in section 6 processes personal information for us under a binding agreement — its customer terms and data-processing terms, including, for Resend, a pre-signed Article 28 data-processing agreement with standard contractual clauses — that requires it to protect that information to a standard substantially similar to POPIA’s conditions for lawful processing.

6. Who else processes it

We use the following operators (third-party processors) to deliver the platform. Each processes personal information only on our behalf and under the agreements described in section 5.

• Supabase — managed Postgres, authentication, file storage and realtime infrastructure, hosted in the EU (Ireland). Supabase privacy policy.
• Render — compute for the background worker, in Frankfurt, Germany. Render privacy policy.
• Resend — transactional email delivery for contact-form notifications and assessment-related emails. Resend stores customer data in the United States under a pre-signed Article 28 data-processing agreement with standard contractual clauses. Resend privacy policy.
• Vercel — hosting for the marketing and admin web applications; their server-side functions run in the United States. Vercel privacy policy.
• Sentry — error monitoring for the mobile app, the admin applications, the marketing site and the background worker, hosted in Sentry’s EU region (Germany, de.sentry.io). Sentry privacy policy.
• PostHog — product analytics for the mobile app and the admin applications, hosted in PostHog’s EU region (eu.i.posthog.com); the marketing site sends nothing to PostHog. PostHog privacy policy.
• MapTiler — map tiles, requested directly from the assessor’s device and from our background worker; the request carries the device’s IP address. MapTiler privacy policy.

Contact-form submissions are received by Vercel’s serverless functions in the United States, stored in our Supabase database in the EU for up to 24 months, and delivered to our team by email through Resend.

7. Photos and incidental personal data

Field photos taken during an assessment are intended to document the condition of public infrastructure. They may incidentally contain images of people, vehicles or number plates that were in frame at the time of capture.

• We do not run facial recognition, plate recognition or any other automated identification on these images.
• Photos are stored against the assessment record and access is restricted by Row Level Security to the tenant that owns the assessment.
• If a photo contains personal information that should not have been captured, contact us and we will remove or redact it.

8. Your rights under POPIA

As a data subject under POPIA you have the right to:

• Ask us to confirm whether we hold personal information about you and to receive a copy of it.
• Ask us to correct or update personal information that is inaccurate, irrelevant, out of date, incomplete, misleading or unlawfully obtained.
• Ask us to delete personal information we are no longer authorised to retain.
• Object to the processing of your personal information on reasonable grounds.
• Lodge a complaint with the Information Regulator if you believe we have not handled your personal information lawfully.

To exercise any of these rights, email accounts@erams.co.za. We will acknowledge your request promptly and act on it within 30 days as required by POPIA §23. We may need to verify your identity before acting on requests that relate to specific personal information.

Erasure requests. Where you ask us to delete your account, we action this by anonymising your account record: your name, email address and other identifying fields are removed, and authentication credentials are disabled. Assessment records, audit entries and other operational data that reference your account are retained in anonymised form to preserve the integrity of engineering records. A full hard delete is not technically possible while those records exist, and the anonymisation approach achieves the same privacy outcome.

9. Cookies

The marketing site uses only essential cookies needed for the site to function, such as the session cookie for authenticated areas of the platform. We do not deploy Google Analytics, advertising pixels, social-media trackers or any third-party analytics tools on this site today. If that changes, we will update this policy before deploying them.

10. Children’s data

eRAMS is a professional tool for municipal staff, engineering firms and their contractors. It is not directed at children and we do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The current version will always be available at this URL and the “last updated” date at the top will reflect the most recent change. Material changes will be communicated to active customers through the usual channels.

12. Contact

For any privacy question, request or complaint, contact us at accounts@erams.co.za.

Information Officer. Our Information Officer is the head of Dlala Group (Cebo Makeleni), reachable at accounts@erams.co.za.

You also have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: inforeg@justice.gov.za

Last updated: 24 September 2026.