Privacy Policy

The responsible party (as defined in POPIA) for personal information processed through the Platform is:

The designated Information Officer for POPIA purposes is Monja Kemp (Director). Questions about your personal information or this Policy should be directed to the Information Officer at the email address above.

We collect personal information only as necessary for the purpose of operating the Platform. This includes:

Account & Identity Information

• Full name, email address, and password (hashed, never stored in plain text).
• Phone number.
• Location and province.

Pilot Profile Information

• Licence type, category, and number, and any type ratings or general ratings you add.
• Medical certificate class and expiry date.
• Total flight hours and employment history.
• Bio, and any supporting documents you upload for verification (e.g. licence or medical certificate copies).

Operator Information

• Company name, company type, description, and contact name, phone, and email.
• City and province, and VAT number if you have one (used for invoicing your subscription).
• Proof of commercial operation, such as an Air Operator Certificate, an Approved Training Organisation certificate, proof of a Part 91 private operation (including the aircraft's registration), or a written description of how you're authorised to engage Pilots, and any supporting documents you upload for verification.
• Subscription and billing status (payment card details are processed and stored by Paystack, not by us).
• A record of which Pilot profiles you have unlocked, and when.

Usage & Technical Data

• IP address, browser type, and device identifiers.
• Pages viewed, features used, and time spent on the Platform.

Information from Third Parties

• Payment and subscription status signals from Paystack.
• Any information you choose to provide when contacting our support team.

We process personal information on the following lawful grounds under POPIA:

To perform our contract with you:

• Creating and managing your account.
• Building and displaying a Pilot Profile, or an Operator's search and unlock access.
• Reviewing Pilot and Operator profiles and supporting documents as part of Verification.
• Processing Subscriptions and recording Contact Unlocks.
• Sending account, verification-status, and subscription notifications.

To comply with legal obligations:

• Retaining transaction records as required by tax and financial services law.
• Responding to lawful requests from South African regulatory or law enforcement authorities.

For our legitimate interests (where these don't override your rights):

• Preventing fraud, abuse, and misuse of unlocked contact details.
• Improving Platform features through aggregated usage analytics.
• Resolving complaints about Profile accuracy or User conduct.

With your consent:

• Sending marketing communications about Lofft Crew products, promotions, and news. You can withdraw this consent at any time by clicking "Unsubscribe" in any marketing email.

Lofft Crew does not sell your personal information. We share it only as follows:

With other Users:

• A verified Pilot's Profile (licence, ratings, experience, location, bio) is visible to subscribed Operators browsing the directory.
• A Pilot's direct contact details (phone, email) are shown to an Operator only after that Operator unlocks the Profile under an active Subscription.
• Pilots can see which Operators have unlocked their Profile.

With service providers acting as operators (as defined in POPIA):

• Supabase: database and authentication hosting.
• Paystack: subscription payment processing. Paystack operates its own privacy policy and is independently responsible for payment data.
• Resend: transactional email delivery (account and verification notifications).
• Vercel: web hosting and edge network.

All operators are contractually required to process your information only on our documented instructions and to implement appropriate security measures.

For legal and safety reasons:

We may disclose personal information to law enforcement or regulatory authorities where required by law, or where necessary to prevent fraud, protect the safety of any person, or enforce our Terms of Service.

Some of our service providers (including Supabase and Vercel) process data in the European Union and the United States. In accordance with POPIA Section 72, we transfer personal information outside South Africa only where:

• The recipient country provides an adequate level of data protection (e.g., the EU under GDPR); or
• The recipient has entered into a binding data processing agreement with Lofft Crew that provides comparable protections to those required under POPIA Section 72.

Subscription payments are processed by Paystack, which operates data centres in Nigeria and South Africa.

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum periods:

After the applicable retention period, data is securely deleted or anonymised.

We implement industry-standard technical and organisational security measures to protect your personal information, including:

• TLS/HTTPS encryption for all data in transit.
• Row-level access controls so a User can only ever read or modify their own account data.
• Password hashing (passwords are never stored in plain text).
• Role-based access controls limiting which Lofft Crew staff can access User data.

Despite these measures, no system is completely secure. You are responsible for keeping your account credentials confidential. Notify us immediately at support@lofft.co.za if you suspect unauthorised access to your account.

In the event of a security breach that is reasonably likely to result in a risk to your rights, we will notify you and the Information Regulator as required by POPIA Section 22 as soon as reasonably possible after becoming aware of the breach.

Lofft Crew uses cookies and similar technologies to:

• Keep you logged into your account (session cookies, essential).
• Collect aggregated, anonymous analytics on how the Platform is used. No personally identifiable information is included in analytics data.

We do not use third-party advertising cookies or sell browsing data to advertisers.

Under POPIA, you have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your information where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Objection: Object to processing of your information where we rely on our legitimate interests as the lawful basis, if your particular circumstances justify it.
• Withdrawal of consent: Withdraw consent to marketing communications at any time.
• Complaint: Lodge a complaint with the South African Information Regulator if you believe your rights under POPIA have been violated.

To exercise any of these rights, contact us at support@lofft.co.za. We will respond within 30 days. We may need to verify your identity before processing certain requests.

The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us at support@lofft.co.za and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

For any privacy-related questions, access requests, or concerns, contact our Information Officer:

If you are unsatisfied with our response, you have the right to escalate your complaint to the South African Information Regulator (see Section 9 above).