Privacy & Cookies Policy.

01Introduction and purpose

Agility Solutions (Pty) Ltd (registration number 2022/813563/07), which provides the Linen Management Solutions platform and is referred to as "we", "us" or "our", is committed to protecting your personal information. We treat your privacy as a high priority and have taken steps to ensure your personal information is protected.

This document serves as our Privacy Policy and our data subject notification as required by section 18 of the Protection of Personal Information Act, 2013 ("POPIA"). It explains what personal information we collect, why we collect it, how we "process" it, and the security measures we have in place.

"Process" means how we collect, use, store, share, destroy, or otherwise handle your personal information.

Agility Solutions (Pty) Ltd was previously registered as Linen Management Solutions (Pty) Ltd. The name changed with effect from 25 August 2026. The registration number is unchanged, and the change of name does not affect any existing agreement. Linen Management Solutions remains the name of the platform.

02Applicability

This Privacy Policy applies to your use of our public website (https://linenmanagement.co.za/) and your access to and use of the Linen Management Solutions platform: our cloud-based software, its web portal at secure.linenmanagement.co.za, and its phone app for Android and iOS (collectively, "the Services").

Who uses the Services. The platform is used by hospital groups, by hospitality properties such as hotels and lodges, and by the laundry contractors that serve them, and by the people those organisations authorise to use it, such as ward and theatre staff, housekeepers, laundry staff and managers.

Our role. Where we process personal information on behalf of an organisation that uses the platform, that organisation is the responsible party and we act as its operator, as set out in our Terms and Conditions. If your personal information is in the platform because of your work for such an organisation, that organisation decides who is given an account and what is recorded, and it is your first point of contact about that information. We are the responsible party for the personal information we collect for our own purposes, such as enquiries sent through this website.

The phone app. The app is distributed through Google Play and the Apple App Store. It asks for access to the phone's camera, to scan QR codes and to take photographs that you choose to attach (for example to a form, a fault report or an incident report), and to the phone's photo library if you choose to attach an existing photograph. It does not use your location, and it contains no advertising or analytics software. When the phone has no signal, what you capture is kept on the phone, in the app's secure storage, and is sent when the connection returns. Your sign-in is also kept in the phone's secure storage so that you stay signed in. On Android, a restore key is kept in the phone's own encrypted backup so that the app on a replacement phone can continue your session or, where you sign in with a PIN, fill in your username; it works only while that session is still active.

By using our website or Services, you agree that we may process your personal information as explained in this policy.

We may change this Privacy Policy from time to time if the law or our business practices require it. The version displayed on our website at the time of your interaction will be the applicable one.

03What is personal information?

Personal information is any information that identifies you or specifically relates to you. This includes, but is not limited to:

• Identifiers: your name, identity number, email address, physical address, telephone number, and online identifiers.
• Employment details: employment history, education, and company information.
• Financial information: financial history or bank details (for billing).
• Technical data: location information, correspondence, and biometric data.
• Personal views: personal opinions, preferences, or beliefs.

What we process in practice. The personal information we process through our website and the platform falls into the following categories:

• Website enquiries: if you send us an enquiry through the website, your name, your organisation, your email address, your telephone number if you give it, the topic you choose and your message. The enquiry is emailed to us; the website itself does not keep a copy.
• Your user account: your first name, surname, email address and username; a profile photograph if one is added; the organisation, sites, roles and permissions you have been given; and your sign-in information. Passwords and PINs are stored only as hashes, and the secret behind an authenticator app is stored encrypted. If your organisation uses single sign-on, we receive your email address from its identity provider and never see your password.
• Registered phones: where a site registers the phones that may be used there, a device identifier and device name, and when the phone was registered and last seen.
• What you do in the platform: the counts, requests, dispatches, collections, deliveries, stock takes, asset and service records, housekeeping visits, linen movements and forms that you capture are recorded against your account with the date and time. Sign-ins, permission changes and other administrative actions are written to an audit log, and our servers log the IP address and time of requests. Some reports show activity for a named person, for example the housekeeping record of the rooms a person serviced.
• Signatures and photographs: signatures captured on the phone, for example when linen is collected, delivered or received, or where a form asks for one; and photographs that users attach to forms, asset records, fault reports, circulation records and incident reports.
• Incident reports: a report that an incident or an injury occurred, with a description and a photograph, as described in section 7.
• Other people named in records: the name and signature of a driver on a consignment; the name, email address and telephone number of the contact persons of an organisation or a laundry contractor; the name of the person who asked for linen, where a user types it in; and the email address of a person an organisation has chosen to receive alert emails without holding an account.

What the platform does not hold. The platform has no fields for identity or passport numbers, dates of birth, race, gender, religion, trade union membership or criminal history. It is not designed to hold information about patients or guests: where an organisation's own system sends occupancy information, it is a count of occupied beds or the status of a room (occupied, departure, stayover or vacant), never who is in the bed or the room, and the platform refuses any other field. Notes, form answers and photographs are captured by users, however, and so contain whatever a user chooses to type or photograph.

04When we process your personal information

We will only process your personal information for lawful purposes relating to our business if one of the following applies:

• You have consented to it.
• It is necessary to conclude or perform under a contract we have with you (for example, to provide you with access to our software).
• The law requires or permits it.
• It is required to protect or pursue your, our, or a third party's legitimate interest.

05Mandatory vs. voluntary information

Some personal information is mandatory to provide, as required by laws such as the Companies Act or the Income Tax Act. If you do not supply this information, we cannot legally do business with you.

In other cases, supplying personal information is voluntary. However, we require this information to provide our Services to you (for example, we need your email address to create your software account). If you do not supply this information, we cannot provide our Services to you.

06Reasons for processing your personal information

We process your personal information for the following reasons:

• To create and manage your user account for the platform, its web portal and its phone app.
• To provide you with our products and Services, including hospital and hospitality linen management, asset management, housekeeping, forms, stock takes and reports.
• To process payments, subscriptions, and transactions.
• To respond to your enquiries and provide customer support.
• To communicate with you about your account and send service-related notices (for example, invitations, password resets, alerts, links to scheduled reports, maintenance updates and security alerts).
• To comply with legal, regulatory, and compliance requirements.
• To develop, test, and improve our website, software, and apps.
• To conduct market or behavioural research.
• For security, identity verification, and to check the accuracy of your information.
• To market our products, goods, and services to you (see section 9).

07Special personal information

Special personal information includes details about your race, ethnic origin, health, religious beliefs, or biometric information. We will generally not process this type of information unless:

• You have explicitly consented.
• The processing is required by law.
• The information has been made public by you.

Incident reports. The platform includes an incident report in which an organisation's users can record that an injury occurred, including a needle-stick injury, with a description and a photograph. Such a report may contain information about the health of an identifiable person, which is special personal information. It is captured by the organisation's users and processed on that organisation's behalf.

Signatures. Signatures are captured in the platform as proof of a hand-over or of who completed a form. They are not used as a means of identifying a person.

08Sources of personal information

We collect personal information:

• Directly from you when you sign up for our Services, contact us for support, send an enquiry through our website, or use the portal or the app.
• From your employer, or the organisation you work for, if it uses our Services and creates a user account for you, or names you as a contact person or as someone who receives alert emails.
• From your organisation's identity provider, if it has chosen single sign-on.
• From your use of our Services, such as interaction data, technical data from our apps, or support queries.
• From public records.
• From third parties if you have given us consent to do so.

09Marketing

We may use your personal information to send you updates and information about our products and services. We may do this by post, telephone, or electronic channels like SMS and email.

If you are not our customer, we will only market to you electronically with your consent. You can request us to stop sending marketing communications to you at any time.

10Sharing your personal information

We will only share your personal information if:

• You have consented to it.
• It is necessary to perform under our contract with you (for example, sharing with our service providers).
• The law requires it.
• It is necessary to protect a legitimate interest.

We may share your information with:

• Our service providers: third parties who help us operate our business, such as our cloud hosting provider, payment processors, and customer support tools.
• Legal and regulatory bodies: law enforcement, fraud prevention agencies, or regulatory authorities when required by law.

The service providers we currently use to provide the platform and this website are:

• Amazon Web Services: hosts the platform (the web portal, the service the phone app talks to, the database and the logs) and its daily database backups, in the AWS Africa (Cape Town) region. All the information captured in the platform is held there.
• SMTP2GO: delivers the emails the platform sends, such as invitations, password resets, alerts and links to scheduled reports, and the enquiries sent through our website's contact form. It handles the names and addresses of recipients and the content of those messages.
• Vercel: hosts this website and the function behind its contact form, and provides the website's visit statistics. It handles enquiries in transit and keeps request logs, which include IP addresses.
• Microsoft: provides single sign-on through Microsoft Entra ID where an organisation chooses it, under that organisation's own Microsoft agreement, and provides our company email, where enquiries and support emails are received.
• Google and Apple: distribute the phone app through Google Play and the Apple App Store, and hold installation and device information about the people who install it, under their own terms. The app does not send them the information you capture in it. This website also loads its typefaces from Google Fonts (see section 14).

We also use GitHub for source code and deployment, Tailscale for secured administrative access and UptimeRobot to monitor availability. None of them holds the personal information captured in the platform; where platform information crosses Tailscale, it is encrypted end to end.

Within the platform. Information captured at a site is visible to the organisation that owns the site and, to the extent that organisation allows, to the laundry contractors it has invited to work there.

11International transfer of information

As we use cloud-based software, your personal information may be stored and processed in other countries. We will only transfer your personal information to third parties in another country if:

• The information will be adequately protected under the other country's laws or an agreement.
• The transfer is necessary to perform our contract with you.
• You have consented to the transfer.

This transfer will happen within the requirements and safeguards of the law.

Where the platform is hosted. The platform's production database and its daily backups are hosted in South Africa, in the Amazon Web Services Africa (Cape Town) region. Emails are delivered through SMTP2GO and this website runs on Vercel; both may process information outside South Africa. Microsoft, Google and Apple, which we use as described in section 10, operate internationally.

12Securing your information

We take appropriate and reasonable technical and organisational steps to protect your personal information. Our security measures include:

• Keeping our systems secure (for example, monitoring access).
• Storing our records securely.
• Controlling access to our buildings, systems, and records.
• Safely destroying or deleting records when no longer needed.

In the platform these measures include encrypted connections to the portal and from the phone app; passwords and PINs stored only as hashes, and authenticator secrets stored encrypted; access controlled by the roles and permissions each organisation sets; an audit log of sign-ins, permission changes and other administrative actions; and a daily backup of the production database.

13How long we keep your information

We will keep your personal information for as long as:

• The law requires us to keep it.
• A contract between us requires us to keep it.
• You have consented to us keeping it.
• We require it for our lawful business purposes or for statistical purposes.

We may keep your personal information even if you no longer have a relationship with us, for example, to meet our legal or regulatory obligations.

In the platform the following fixed periods currently apply. Other records are kept in line with the rules above.

• Day-to-day linen records (daily replenishment requirements, clean counts, dirty counts, clean receptions and fulfilled linen requests) are deleted five years after their date.
• Completed forms, with their photographs and signatures, are deleted seven years after their final outcome, unless the organisation that owns the form has set a different period for it. A completed form that is the evidence behind an equipment service record is kept with that record.

14Our cookie policy

A cookie is a small piece of data sent from a website or application to your browser or device. Similar technologies, such as a browser's local storage, work in the same way. This is how we use them:

• This website: our pages do not set cookies. When you make a choice in the cookie banner, the choice is kept in your browser's local storage so that it is remembered; it is not sent to us. At present the website sets no analytics or marketing cookies.
• Visit statistics: we count visits to this website with Vercel Web Analytics. According to Vercel, it identifies a visit by a hash created from the request instead of by a cookie, and discards that hash after 24 hours. It records the page visited, the referring site, the approximate location (country, region and city), the type of device, the operating system and browser, and the time.
• Your choice: your visits are counted until you choose otherwise. If you choose Reject all in the cookie banner, or switch Analytics off under Customise, the counter is no longer loaded and your visits are not counted, in that browser and for as long as your choice is stored there. The page you were on when you made the choice will already have been counted; nothing further is sent from it after you choose. You can change your choice at any time.
• Typefaces: the website loads its typefaces from Google Fonts, so your browser requests them from Google's servers, which shows Google your IP address.
• The web portal: the portal at secure.linenmanagement.co.za uses only the cookies it needs to sign you in, keep your session secure and protect the forms you submit. It uses no analytics or marketing cookies.
• The phone app: the app does not use cookies. It keeps your sign-in and any captures waiting to be sent in the phone's secure storage, as described in section 2.

By using our website or applications, you agree that cookies may be sent to your computer or device.

15Your rights

You have rights regarding your personal information. You must provide proof of identity when exercising these rights. Please inform us when your personal information changes.

• Right to access: you have the right to request access to the personal information we hold about you. This includes confirmation that we hold your data and a copy of the record. We will attend to this in a reasonable time.
• Right to correction or deletion: you have the right to request us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.
• Right to object: you may object on reasonable grounds to the processing of your personal information. We may not be able to give effect to your objection if the processing is permitted by law or necessary for our contract.
• Right to withdraw consent: where you have provided consent, you may withdraw it at any time. We will explain the consequences of this.

If your information is in the platform because of your work. Where your personal information is processed in the platform on behalf of the organisation you work for, that organisation is the responsible party. You can make your request to it directly. If you send it to us, we will pass it to that organisation and act on its instructions.

The Information Regulator publishes forms for an objection (Form 1) and for a request for correction or deletion (Form 2) on its website. You may use them, and we will also accept a request sent by email. We aim to respond within 30 days of receiving a request.

To exercise any of these rights, please contact our Information Officer.

16How to complain

You have the right to file a complaint with us or with the Information Regulator about any alleged contravention of the protection of your personal information. The Regulator's complaint form (Form 5) is available on its website.

17Our contact details

For any queries about this policy or your personal information, please contact our Information Officer.