Data Protection

We comply with:

• POPIA (South Africa) where we process personal information of South African data subjects;
• GDPR (EU) where we process personal information of individuals in the EU or that of EU residents;
• UK GDPR where we process personal information of UK residents.

Where more than one law applies, we follow the strictest requirement.

Accountability

We take responsibility for what we do with personal information. We have documented policies, a data protection officer contact, and we investigate complaints. Our Privacy Policy sets out how we handle your information.

Processing limitation

We collect the minimum needed, with consent or another lawful basis. We do not ask for special personal information such as race or ethnicity. A B-BBEE certificate or affidavit you choose to share can show ownership by race. We use it only with your consent, to check and show your B-BBEE status.

Purpose specification

We collect information mainly to build and check evidence records, make the introductions you agree to, and confirm what happened afterwards. Our Privacy Policy lists every purpose.

Further processing limitation

We do not use information collected for one purpose for another purpose, unless the new use is compatible with the first one or we have your consent.

Information quality

Every evidence item carries its source, how it was checked, and a date.

Openness

We are open about what we do. Our Privacy Policy is available on our website. You can ask us how any information about you is being used.

Security

We keep personal information secure through encryption, access controls, staff training, and regular security reviews. See our Security Policy for details.

Data subject participation

You can ask for a copy of your information, ask us to correct it, ask us to delete it, or withdraw your consent. Contact us at info@bhotaafrica.co.za.

An enterprise controls its own evidence record. You decide:

• what information to share;
• who can see it (you can make your profile visible or hidden);
• who to be introduced to (we ask your consent each time);
• whether to withdraw consent (and then we delete or anonymise your information).

We never sell evidence to a third party without your permission. We never use it to build a profile to sell to others. Your evidence stays yours.

For our own records, Bhota Africa is the responsible party under POPIA (the controller under the GDPR).

If we work with an institution, a written agreement sets out which of us is responsible for what. An example is a programme that asks us to support its enterprises.

Our service providers process personal information for us under written agreements. These require them to keep it secure and to use it only on our instructions.

Today, people do the checks behind every evidence record. We do not score, rate, grade, rank or certify any enterprise, whether by a person or by software.

We make no decision about you based solely on automated processing (POPIA section 71). A person decides on and makes every introduction, and a reviewer signs off every item at the two higher levels. Funding decisions are always made by the funder, never by us.

Our platform is designed so that, as it grows, software can take on repetitive work, such as reading a photographed ledger. This software may include AI tools. Such a tool may only propose the two lower levels (Self-declared or Document supplied). Before we use one on your information, we will update this page to explain what it does and where a person stays involved.

You can ask us at any time how an item in your record was checked.

We keep evidence for as long as it is needed for the purpose it was collected for, plus any period the law requires. We then securely delete or anonymise it.

If you withdraw your consent, we stop using your information and delete or anonymise it, unless the law requires us to keep it.

We may keep aggregated, anonymised statistics, such as the number of sales confirmed. We use these to report our impact and to research the sector.

We investigate any suspected incident straight away.

Where POPIA requires it, we notify the Information Regulator and the people affected as soon as reasonably possible. Where the GDPR or UK GDPR applies, we notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the incident.

If we hold the information for an institution, we also tell that institution immediately.

Questions about data protection? Contact us at info@bhotaafrica.co.za.

To lodge a complaint with the South African Information Regulator, visit inforegulator.org.za or use its eServices portal at eservices.inforegulator.org.za.