Privacy notice
1. Who we are and this notice
Ace by FIFO (ace.fifo.systems) helps conveyancing firms run training for estate agents. Agents sign in on their phones and answer a live quiz, and the firm can give them a certificate. The firm gets an attendance register and reports.
Ace by FIFO is made and run by FIFO Solutions (Pty) Ltd ("FIFO", "we", "us"), Registration No. 2026/071559/07, 25 Bethel Gardens, 22 Church St, Durbanville, Western Cape, 7550.
This notice explains what personal information Ace by FIFO handles, who is responsible for it, and your rights under the Protection of Personal Information Act, 2013 (POPIA). It covers:
- agents and other people who sign in to a training (section 3);
- firms that subscribe and their staff (section 4);
- visitors to this website (section 5).
Our Information Officer is Riaan Potas (riaan@fifo.systems, 082 525 4011).
2. Two roles: the firm's records and our own
POPIA gives FIFO two different roles, depending on whose information it is.
2.1 Agents' details: the firm is in charge
When a firm runs a training on Ace by FIFO, the details agents give go into that firm's records. The firm is the responsible party: it decides why and how they are used.
FIFO is the firm's operator (POPIA sections 20 and 21). We store and process agents' details for the firm, under a written agreement: the operator terms in clause 12 of our Terms of Service. We don't use them for any purpose of our own.
The firm may have its own privacy notice that explains how it uses your details.
2.2 Everything else: FIFO is in charge
FIFO is the responsible party for:
- staff accounts (the firm's owners, admins and trainers who log in);
- each firm's subscription and billing;
- this website;
- messages you send us.
2.3 What this means for you
If you're an agent with a question about your details, contact the firm that ran the training. You may also contact us. We'll tell the firm, and if you ask us to remove your details, we'll do it (section 3.8).
3. Agents at a training
This part is for you if you signed in to a training on your phone.
3.1 What you give
- Your first name and surname.
- Your agency.
- Your cell number, your email address, or both.
- Whether you tick the box "[Firm] may contact me about training and property transfers."
- An avatar: a picture you pick from our list.
Your details go to the firm running the training, for its attendance register.
Your phone signs in to Ace by FIFO without a password. This lets only your phone change your seat in the session. The sign-in itself holds no name or contact details.
3.2 What the room sees
The screen at the front and the other phones in the session show your first name and the first letter of your surname, such as "Sarah M.", with your avatar, your progress and your score. They never show your agency, cell number or email address.
Your full name goes on the firm's register and reports, and on your certificate if the firm gives one.
3.3 What else is recorded
- Your quiz answers, your score and when you finished.
- Your answers to quick questions the presenter asks during the talk. These are never scored.
- Feedback, if you give it: 1 to 5 stars and what you'd like to be trained on next. The firm sees your name with it.
- "Let's meet", if you tap it. The firm gets an email with your name, agency, cell number, email address and your answer to the box.
- Which of the firm's contact buttons or app link you tapped, and when. Not what you did afterwards.
- Questions you send the presenter. These are anonymous: no name or seat is saved with a question, and the app never shows who asked. The firm may answer a question and share it with the room, still without a name. Your phone counts how many you've sent (at most 10), and the firm can't see that count. What you type could still identify you, so leave your name out if you want to stay anonymous.
If the firm gives certificates, yours is made on your phone. We don't keep a copy, but the firm can print certificates from its records. Downloading a handout is not recorded.
3.4 Who sees your details
- The firm's people who use Ace by FIFO see your full details, answers and scores. They can see every training you attended with that firm. They may give your agency a summary of who attended and how they did.
- FIFO's administrator can see them, but looks only to set up and support the firm's account, to keep the service secure, or when the law requires it.
- Our service providers store and send them for us (section 6).
FIFO doesn't sell your details, doesn't use them to market to you, and doesn't share them with anyone else.
3.5 Your choice to hear from the firm
The box starts unticked. We save your answer, the time and the version of the wording you saw.
- If you tick it, the firm may add you to its contact list and contact you about training and property transfers.
- If you don't, the firm uses your details for its register, your results and your certificate. If you tap "Let's meet", the firm may contact you about that meeting only.
You can change your mind at any time. Leave the box unticked at your next training with that firm, or tell the firm or us. The firm must then stop contacting you.
3.6 What your phone remembers
Your phone remembers your details, and your answer to the box for each firm, so next time you sign in with one tap. On a shared phone, tap "Not you?" to clear them. Clearing your browser's data also removes them. Section 11 lists everything kept on your phone.
3.7 How long it's kept
Your details stay in the firm's records while the firm subscribes to Ace by FIFO, unless the firm deletes the training sooner. If the firm stops subscribing, it has 90 days to download its records. Then we delete them.
3.8 Removing your details
Ask the firm that ran the training, or email riaan@fifo.systems. We remove your name and contact details within 30 days and let the firm know. Your scores stay, without your name, so the firm's attendance counts stay right.
The firm may already have downloaded a register, report or contact list. Those copies are in the firm's own systems, so ask the firm about them too.
If you're unhappy with how your details were handled, you may complain to the Information Regulator (section 9.4).
4. Firms and their staff
For the information in this section, FIFO is the responsible party.
4.1 What we keep and why
| Information | Why |
|---|---|
| Staff name, email address, role and firm | Logins, and showing each person what their role allows |
| Staff passwords | Logging in. Google's Firebase Authentication handles them. FIFO never sees them. |
| Invitations: email address, role, who sent it | Inviting someone to join the firm's team. The link expires after 7 days. |
| Firm name, logo, colours, fonts, welcome and closing lines, lobby slides | Showing the firm's brand on every screen and document |
| Contact card (the names, numbers and addresses the firm chooses) and the link to the firm's FIFO Law app, if it has one | Shown to agents after the training |
| Signature image, signer's name and title | Printed on certificates |
| Quizzes, pictures and PDF handouts | Running the firm's trainings |
| Session details: training name, date, presenter's name and title, the agency it was for, venue, the venue's Wi-Fi name and password | Shown on the welcome screen, and printed on certificates and reports |
| A presenter's phone's push token | Sending questions from the room to the presenter's phone, if they turn alerts on |
| Subscription status and expiry date | Running the subscription |
| Annual fee, invoice reference and notes | Billing. Private to FIFO: the firm's staff and agents can't see them. |
| Support messages | Answering questions and fixing problems |
4.2 What agents can see
The firm's name, logo, colours, contact card, welcome lines and slides are shown on agents' phones and on the screen at the front. Pictures and handouts in a quiz are shown to agents too. Anyone with the link to a session or a file can see these, so they shouldn't contain anything private.
4.3 Our lawful reasons
| Purpose | POPIA basis |
|---|---|
| Providing Ace by FIFO to the firm and its staff | Performing our contract with the firm (section 11(1)(b)) |
| Invoicing and payment | Performing our contract with the firm (section 11(1)(b)) |
| Support | Performing our contract with the firm (section 11(1)(b)) |
| Security, and notices about the service | Our legitimate interest in a safe, working service (section 11(1)(f)) |
| Tax and accounting records | Complying with the law (section 11(1)(c)) |
We don't use staff information for marketing without consent. We don't sell, rent or share it with anyone for their marketing.
5. Visitors to this website
5.1 No cookies, no tracking
This website and the Ace by FIFO app use no cookies, no analytics, no advertising and no tracking pixels.
5.2 Server records
Google hosts the website. Its servers record technical details such as your IP address, browser, the page and the time, to deliver the site and protect it from abuse. We don't use these records to identify visitors.
5.3 Contacting us
If you WhatsApp or email us, we use your message and contact details to reply, and keep them as set out in section 8. WhatsApp and your email provider handle those messages under their own privacy terms.
5.4 joinsession.xyz
joinsession.xyz is a short address for joining a training. It sends you on to ace.fifo.systems. Its page loads fonts from Google Fonts and styling from the Tailwind CSS content network, so those services receive your IP address. It stores nothing on your device.
6. Who processes it for us
These service providers process personal information on our behalf, under written terms. None of them may use it for their own purposes.
| Provider | What it does for Ace by FIFO | Where |
|---|---|---|
| Google (Firebase and Google Cloud) | Hosts the website and the app. Stores the database and files. Runs logins for staff and the password-free sign-in for phones, and sends password-reset emails when staff ask. Runs the server tasks that send emails and alerts and close abandoned sessions. Delivers push alerts to presenters' phones (Firebase Cloud Messaging). Keeps a shared clock for quiz timers (Realtime Database: no personal information). | United States (us-central1, Iowa). The website and app are delivered through a worldwide network. |
| Brevo (formerly Sendinblue, France) | Sends emails: invitations to join a firm's team, set-password emails for new staff, and "Let's meet" emails to firms. | European Union |
| Cloudflare | DNS only: points the address ace.fifo.systems to Google. No website traffic or personal information passes through it. | Not applicable |
A push alert reaches a presenter's phone through that phone's own push service (for example, Apple's on an iPhone).
If we add or replace a provider, we update this table and tell subscribing firms first (Terms of Service clause 12.6).
7. Where it's stored
Ace by FIFO's database, files and server tasks run on Google Cloud in the United States (region us-central1, Iowa). Emails pass through Brevo in the European Union. Everything travels encrypted (HTTPS), and Google encrypts it where it is stored.
7.1 Sending information outside South Africa
POPIA section 72 allows personal information to go to another country when the recipient is bound by an agreement that gives protection substantially similar to POPIA's. We rely on section 72(1)(a):
- Google is bound by its data processing terms for Google Cloud and Firebase (the Cloud Data Processing Addendum and the Firebase Data Processing and Security Terms). They limit Google to processing on our instructions, require security measures and control onward transfers.
- Brevo is bound by its data processing agreement and by the European Union's General Data Protection Regulation.
8. How long we keep it
| Information | How long |
|---|---|
| Agents' details, answers, scores, feedback, "Let's meet" requests and questions at a training | While the firm subscribes, unless the firm deletes the training sooner. Deleting a training deletes its register and everything recorded at it. |
| An agent's name and contact details, when they ask us to remove them | Removed within 30 days. Their scores stay, without a name. |
| Waiting rooms left open for 12 hours | Closed automatically. If nobody signed in, the session is removed. If agents signed in, it is ended and the register kept. |
| A presenter's phone's push token | Kept with the session. Removed when it stops working or the session is deleted. |
| All of a firm's information: firm details, files, quizzes, trainings, registers, reports and staff accounts | While the firm subscribes. When the subscription ends, the firm has 90 days to download its records. Then we delete it all, including the logins of staff who belong to no other firm. |
| Staff who leave a firm | The firm removes them from its team. Their login is deleted with the firm's information, unless they belong to another firm. |
| Invoices and payment records | 5 years (South African tax law) |
| Support messages | 2 years after the matter is resolved |
| Deleted database records | Recoverable by us for up to 7 days (Google's point-in-time recovery), then gone |
9. Your rights
9.1 What you may ask
Under POPIA you have the right to:
- Access: ask what personal information is held about you (section 23);
- Correction: ask for wrong or incomplete information to be corrected (section 24);
- Deletion: ask for information to be deleted, subject to records the law requires us to keep (section 24);
- Objection: object, on reasonable grounds, to your information being processed (section 11(3)(a));
- No direct marketing: object to direct marketing at any time, and withdraw your consent to hear from a firm (sections 11(3)(b) and 69);
- Complaint: complain to the Information Regulator (section 9.4 below).
9.2 Who to ask
For your details at a training, ask the firm that ran it: it is the responsible party. You may also ask us, and we'll pass your request to the firm. Removal requests we handle ourselves, within 30 days (section 3.8).
For staff accounts, billing, this website or messages you sent us, ask us.
9.3 How we respond
Email our Information Officer at riaan@fifo.systems. We respond within 30 days. We may first check that the request comes from you, for example by contacting you on the cell number or email address you gave.
9.4 The Information Regulator
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints: POPIAComplaints@inforegulator.org.za
Phone: 010 023 5200
Website: inforegulator.org.za
10. Security
- Access rules in the database. Every read and write is checked against access rules. A firm's people read only their own firm's records. A phone can change only its own seat. The register is private to the firm. Questions from the room are stored without a name or seat. Billing details are private to FIFO. These rules are tested automatically before changes go live.
- Files. Only the firm's people, and FIFO when setting the firm up, can upload or change its files.
- Encryption. Everything travels over HTTPS. Google encrypts stored data.
- Passwords. Google's Firebase Authentication handles staff passwords. FIFO never sees them.
- FIFO's own access. Only FIFO's administrator account can see across firms.
- Recovery. The database can be restored to any point in the last 7 days.
No system is completely secure. If personal information is compromised, we tell the affected firms immediately, as their operator. For information we are responsible for, we notify the Information Regulator and the people affected, as POPIA section 22 requires.
11. Information stored on your device
Ace by FIFO uses no cookies. It keeps a few things in your browser's own storage so that the app works. Nothing here is used for tracking or advertising.
| What | Why | How long |
|---|---|---|
| An agent's details, and their answer to each firm's box | One-tap sign-in next time | Until you tap "Not you?" or clear your browser's data |
| Which session and seat your phone has | A reload or rescan takes you back to your seat | Used for 12 hours |
| What your phone already sent at a training (feedback, "Let's meet", answers to quick questions) | Shows "Sent" instead of the buttons again | Until you clear your browser's data |
| The phone's password-free sign-in, and an offline copy of the session | Keeps your seat yours, and keeps your answers safe if the connection drops | Until you clear your browser's data |
| Staff: your login, a note that you're signed in, and the firm you last worked in | Keeps you logged in, and sends you from the website to your dashboard | Until you log out (the note) or clear your browser's data |
| Staff: names you typed when starting sessions (presenters, agencies, training names, Wi-Fi) | Suggests them next time | Until you clear your browser's data |
| Presenters: a device code and a background helper for push alerts | Shows questions from the room on your phone, if you turn alerts on | Until you clear your browser's data |
| Staff: short-lived copies of the firm's settings, of your login when you open the presenter window, and of the questions you've already seen on your phone | Faster pages, and a presenter window that opens straight away | The login copy for 30 seconds; the rest until that browser tab closes (firm settings for at most 30 minutes) |
You can clear all of it in your browser's settings.
12. Changes to this notice
We may update this notice when Ace by FIFO changes. We tell subscribing firms about material changes by email at least 30 days before they take effect. The effective date at the top shows the current version.
13. Contact and the Information Officer
FIFO Solutions (Pty) Ltd
Registration No. 2026/071559/07
25 Bethel Gardens, 22 Church St, Durbanville, Western Cape, 7550
Information Officer: Riaan Potas
Email: riaan@fifo.systems
Phone and WhatsApp: 082 525 4011
We review this notice regularly and may update it. The effective date at the top shows the current version.