Privacy Policy

Bhota Africa Group (Pty) Ltd is a company registered in South Africa. We operate Bhota Africa, a platform that helps enterprises build evidence records and introduces them to buyers, programmes and institutions.

We are the responsible party for your personal information under POPIA and the data controller under GDPR.

We collect only what we need, and you decide what evidence to share.

• Contact details: your name, email address, phone or WhatsApp number, organisation and role, and anything you tell us in an enquiry.
• About your business: what you make or sell, where you trade, the kinds of customers you sell to, and, if your business is registered, its registration details.
• Evidence you choose to share: for example orders, invoices, delivery notes, photographs of your products, statements from your bank or payment provider, and certificates.
• Confirmations: when a sale is reported, what each side confirms about the product, quantity, price and date.
• Results of checks: what an official source (such as CIPC, SARS or B-BBEE records) showed when a reviewer checked it, and when the check was made.
• Optional impact questions: gender, age band and type of location. We use these only to report our impact in aggregate, never for matching. Each question has a "prefer not to say" option.
• Account and technical information: your sign-in details and plan, and billing records for paid tiers (Paystack processes card payments). We also collect technical data from your use of our website and app.

What we do not collect, and the limits we keep:

• Race or ethnicity. We do not ask for your race or ethnicity. A B-BBEE certificate or affidavit can show ownership by race. If you choose to share one, we use it only with your consent, to check and show your B-BBEE status to opportunities that ask for it.
• Your customers' and suppliers' details. If a document you share names your customers or suppliers, we use their details only to check that item. Buyers we introduce you to give their own consent.
• Photographs of people, unless that person has agreed.
• Details of anything unsafe. If you tell us it is unsafe to continue, we stop. We do not record identifying details of what happened. We do not report to the police on your behalf unless you ask us to or the law requires it.

We use your information to:

• build your evidence record and check each item as far as it can be checked;
• introduce you to a buyer, programme or institution, but only one you have agreed to;
• confirm what happened after an introduction, by asking each side separately;
• reply to your enquiries and send you messages about your account;
• process payments for paid tiers;
• meet our legal obligations; and
• improve how we work, using anonymised or aggregated information wherever possible.

We process your information on the basis of your consent, our legitimate business interests in running Bhota Africa as a trustworthy evidence service, and our legal obligations.

We never use your information to score, rate, grade or rank you or your business.

• Institutions using our app. They can see your profile only if you choose to make it visible, and you can hide it again at any time.
• Buyers, programmes and institutions you agree to be introduced to. Before any introduction to a specific buyer or institution for a specific opportunity, we ask for your consent separately. We then share only what is relevant to that opportunity. A person at Bhota Africa decides on and makes every introduction. We never send your information to anyone in bulk or automatically.
• Funders and prospective partners. They see only anonymised or aggregated results, unless you have agreed to be introduced to them.
• Service providers who help us run Bhota Africa. These provide hosting, database and storage, email and documents, payments, and analytics. They work under written agreements that limit what they may do with your information.
• Anyone the law requires us to share it with.

We do not share your information for anyone else's marketing.

When we transfer your information outside South Africa, we do so where there is an adequacy decision (for example, to the EU or UK) or under standard contractual clauses. The transfers that take place do so on the basis of your consent or our legitimate interests in running Bhota Africa.

We keep your information for as long as it is needed for the purpose it was collected for. We then delete or anonymise it. Evidence records are kept in line with POPIA's requirements and our business need to maintain records you may rely on.

If you withdraw your consent, we stop using your information and delete or anonymise it, unless the law requires us to keep it.

Under POPIA and GDPR, you have the right to:

• ask us what information we hold about you, and get a copy;
• ask us to correct information that is wrong;
• ask us to delete your information (though we may need to keep some for legal reasons);
• ask us to limit how we use your information;
• object to how we use your information;
• ask for your information to be transferred to another organisation in a portable format; and
• lodge a complaint with the data protection authority.

If something in your record is wrong, tell us. We will re-check it, and every correction is dated and explained.

Information Regulator (South Africa): inforegulator.org.za. Complaints are lodged through its eServices portal at eservices.inforegulator.org.za.

We use industry-standard technical and organisational measures to protect your information against unauthorised access, alteration, disclosure or destruction. These measures include encryption, access controls, and regular security reviews.

We may update this policy from time to time. We will tell you of material changes by email or by posting the updated policy on our website.