Privacy policy

This policy explains what personal information Bonang M Investments (Pty) Ltd, trading as Bonang Technologies, collects when you use this website or engage us as a client, why we collect it, and what you can ask us to do with it. It is written to meet our obligations under the Protection of Personal Information Act, 2013 (POPIA).

Who is responsible

Bonang Technologies is the responsible party for the information described here. Our information officer can be reached at info@bonangtech.com, on +27 72 823 2999, or in writing at Sunninghill, Sandton, Johannesburg, 2196, South Africa.

What we collect

We collect only what we need to answer you, do the work, and meet our legal obligations.

• Information you give us: your name, email address, telephone number, company name and whatever you write in an enquiry or email.
• Information from the engagement: the contact details of the people we work with, project material you send us, and the invoicing details we are required to keep.
• Technical information: the pages requested from this site, in aggregate, along with the standard request data any web server logs: approximate location, browser and referring page.
• Where we manage your systems: administrative credentials, asset records and support correspondence, held for as long as the agreement runs.

We do not collect special personal information as defined in POPIA, we do not collect information about children, and we do not buy contact lists.

Why we collect it

• To respond to an enquiry and to prepare a quotation. Our lawful basis is that you asked us to.
• To perform a contract with you, and to support what we have built or manage.
• To meet our legal obligations, including the invoicing records the Companies Act and tax legislation require us to retain.
• To improve this website, using aggregate statistics that do not identify an individual.

Who we share it with

We do not sell personal information and we do not share it for anybody else's marketing. We do use operators who process information on our behalf under written agreement, and only for the purposes above.

• Hosting and infrastructure providers, including Vercel, Amazon Web Services, Microsoft Azure and Supabase.
• Email and productivity providers, including Microsoft 365 and our transactional email provider.
• Our accountants and, where we are legally obliged to, the South African Revenue Service and other regulators.

Where it is processed

Some of these providers process information outside South Africa, including in the European Union and the United States. Where that happens we rely on the provider's contractual commitments to standards comparable to POPIA, as section 72 requires. You can ask us which provider holds a particular category of information and where.

How long we keep it

• Enquiries that do not become work: two years, then deleted.
• Client records and correspondence: five years after the engagement ends.
• Invoices and financial records: five years, as tax legislation requires.
• Website request logs: thirty days in identifiable form, then retained only in aggregate.

How we protect it

Information is encrypted in transit and at rest, access is limited to the people who need it, administrative accounts require multi-factor authentication, and our backups are tested rather than assumed. If a breach occurs that is likely to affect you, we will notify you and the Information Regulator as section 22 requires.

Your rights

Under POPIA you may ask us to confirm what information we hold about you, to correct or delete it, or to stop processing it. You may also object to processing on reasonable grounds. Write to us and we will respond within thirty days.

If you are not satisfied with our answer, you may complain to the Information Regulator (South Africa) at enquiries@inforegulator.org.za.

Changes

When this policy changes we will update the date at the top of the page. If a change materially affects how we handle your information, we will tell clients directly rather than relying on you to notice.