Legal
Privacy Policy
Last updated: 6 August 2026
This Privacy Policy explains how Quillstone Capital Private Limited — which provides DatumPro through its Quillstone Digital division (“DatumPro”, “we”, “us”) — collects, uses, shares and protects personal information when you use the DatumPro website and application (the “Service”). We act as the responsible party / data controller for information about your account, and as an operator / processor for the content your organisation stores in the Service.
We aim to comply with Zimbabwe’s Cyber and Data Protection Act, South Africa’s Protection of Personal Information Act (POPIA), and comparable data-protection laws; where you are protected by the EU/UK GDPR, the equivalent rights described below apply to you.
1. Information we collect
Account & profile. Your name, email address, and — if you provide them — phone number, profile photo and company name. When you create an organisation we also collect its legal name, country, sector and registration number.
Content you put into the Service. Projects, tasks, schedules, comments, uploaded files and images, tender and quote information, and financial records such as payment requests, claims and approvals. This content belongs to your organisation; we process it to provide the Service.
Technical & usage data. IP address, device and browser information, and — only if you consent to analytics cookies — aggregated usage data (see Cookies). We keep security and audit logs of key actions to protect your organisation’s data.
Authentication. We process sign-in credentials through our authentication provider. The mobile app can send a one-time passcode by SMS to a phone number you provide.
2. How we use information
To provide, secure and maintain the Service; authenticate you and enforce access controls; send transactional messages (invitations, password resets, notifications); respond to support requests; detect, prevent and investigate abuse or security incidents; keep an audit trail for accountability; understand aggregate usage to improve the product (with your consent); and comply with legal obligations.
3. Our legal bases
We rely on: performance of our contract with you (to deliver the Service); your consent (for analytics cookies and optional communications, which you may withdraw at any time); our legitimate interests (security, fraud prevention, and improving the Service, balanced against your rights); and compliance with legal obligations. Under POPIA these correspond to the conditions for lawful processing; under the GDPR, to Articles 6(1)(a), (b), (c) and (f).
4. Cookies & analytics
Essential cookies are required to run the Service — for example to keep you signed in and to remember your active organisation. These are always on because the Service cannot function without them.
Analytics cookies (Google Analytics) are off by default and load only after you select “Accept” in our cookie banner. Choose “Decline” and no analytics cookies are set and no analytics scripts are loaded. You can change your choice at any time via “Manage cookies” in the site footer.
5. Sharing & sub-processors
We do not sell your personal information. We share it only with service providers who process it on our behalf under contract, and where required by law or to protect rights and safety. Our current sub-processors are:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage (hosts your account and project data) |
| Resend | Transactional email (invitations, password resets, notifications) |
| Vercel | Application hosting and content delivery |
| Google Analytics | Website usage analytics — loaded only with your consent |
| Sentry | Error monitoring to detect and fix faults |
| Africa's Talking | SMS one-time passcodes for mobile sign-in (mobile app only) |
6. International transfers
Our providers may store and process data on servers outside your country. Where we transfer personal information across borders, we take steps intended to ensure it remains protected to a standard comparable to this policy and applicable law. If you have specific data-residency requirements, contact us — we’ll confirm region and handling.
7. Retention
We keep personal information for as long as your account or organisation is active, and thereafter only as needed to comply with legal obligations, resolve disputes, and enforce our agreements. Organisation content is retained while the organisation exists; when it is deleted, content is removed or anonymised within a reasonable period, subject to backups and legal retention requirements.
8. Security
Your data is isolated per organisation and access is enforced in the database, not just the interface. We use encryption in transit and at rest through our infrastructure providers and keep an audit trail of key actions. Learn more on our Security page. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.
9. Your rights
Subject to applicable law, you may request access to the personal information we hold about you; correction of inaccurate information; deletion; restriction of or objection to certain processing; a copy of your information in a portable format; and withdrawal of consent where we rely on it. To exercise these rights, email allenk@quillstonecapital.com. You also have the right to lodge a complaint with your data-protection regulator — for example the Information Regulator (South Africa) or the data-protection authority in your country.
Where your organisation administers your account, some requests may be directed to that organisation as the responsible party for its content.
10. Children
The Service is intended for business use and is not directed to children under 18. We do not knowingly collect personal information from children.
11. Changes to this policy
We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you.
12. Contact us
Quillstone Capital Private Limited · Registration [company registration number] · 275 Henderson Road, Hatfield, Harare, Zimbabwe · +263 77 618 3229. Privacy enquiries: allenk@quillstonecapital.com.
See also our Terms of Service.