Privacy Policy

Privacy Policy | BXE – Business Growth Ecosystem Platform Features How It Works About Contact Get Started Privacy Policy Protection of Personal Information Act (POPIA) Compliant Version 2.0 | Effective Date: January 2026 This Privacy Policy is effective as of January 2026 and applies to all personal information collected by BXE on or after this date. Previous versions are superseded. Table of Contents 1. Introduction 9. Data Retention 2. Definitions 10. Data Subject Rights 3. Roles (POPIA Structure) 11. Security Breach Notification 4. Information We Collect 12. Cookies and Tracking 5. How We Use Information 13. Children's Privacy 6. Legal Basis for Processing 14. International Data Transfers 7. Data Sharing and Disclosure 15. Changes to This Policy 8. Sub-Processors 16. Contact Information 1. Introduction ("BXE", "we", "us", "our") is committed to protecting your privacy and processing your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") , the Electronic Communications and Transactions Act 25 of 2002 ("ECT Act") , and other applicable South African laws. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website, platform, and services. By using our Services, you acknowledge that you have read and understood this Privacy Policy. 2. Definitions In this Privacy Policy, the following terms have the meanings assigned to them: "Personal Information" – has the meaning assigned in Section 1 of POPIA, including any information that can identify a natural or juristic person. "Special Personal Information" – has the meaning assigned in Section 26 of POPIA, including religious beliefs, health information, criminal behaviour, biometric data, and race or ethnic origin. "Responsible Party" – the Customer, who determines the purpose and means of processing Personal Information. "Operator" – BXE, who processes Personal Information on behalf of the Responsible Party. "Processing" – any operation or activity concerning Personal Information, including collection, receipt, recording, organisation, storage, updating, modification, retrieval, consultation, use, dissemination, merging, linking, restriction, erasure, or destruction. "Data Subject" – the person to whom Personal Information relates. 3. Roles (POPIA Structure) Important: Role Allocation Under POPIA This section explains how responsibilities for data protection are allocated between BXE and our Customers. 3.1 Customer as Responsible Party The Customer is the Responsible Party under POPIA for all Personal Information uploaded, imported, or processed through the Services. The Customer determines: the purpose of processing; the categories of Personal Information collected; the lawful basis for processing; and the retention period for their Customer Data. 3.2 BXE as Operator BXE acts as an Operator under POPIA, processing Personal Information only: on documented instructions from the Customer; for the purpose of delivering the Services; in accordance with this Privacy Policy and the Master Services Agreement. 3.3 BXE as Independent Responsible Party Where BXE independently determines the purpose and means of processing for platform improvement, analytics, or security (using only Anonymised Data as defined in the Master Services Agreement), BXE acts as an independent Responsible Party for that limited processing. 4. Information We Collect 4.1 Customer Account Data When you register for an account, we collect: Full name and business name Email address and phone number Billing address and payment information (processed by third-party payment gateways) Account credentials (passwords are hashed and encrypted) Tax information where required (e.g., VAT number) 4.2 Customer Data (Uploaded by You) As part of using our Services, you may upload or process: CRM contact data (names, emails, phone numbers of your customers) Lead and customer records Email lists and SMS recipient lists Marketing and communication data Communication logs (calls, emails, SMS messages) AI interaction data and chat transcripts You remain the Responsible Party for this data. You warrant that you have obtained all necessary consents to process this data. 4.3 Usage and System Data We automatically collect certain information when you use our Services: IP address and device identifiers Browser type and version Operating system Pages visited and time spent Click-through and interaction data Log files and audit trails 4.4 Special Personal Information Special Personal Information Restrictions BXE does not intentionally collect Special Personal Information (health, religious, biometric, criminal, or racial information). Customers are prohibited from uploading Special Personal Information without: (a) a valid lawful basis under POPIA Section 26-33; (b) prior authorisation from the Information Regulator where required; and (c) explicit consent from the data subject where required. BXE reserves the right to delete any Special Personal Information uploaded in violation of this policy. 5. How We Use Information We use Personal Information for the following purposes: 5.1 To Provide Services Operating the CRM, AI receptionist, and automation tools Delivering email and SMS communications Processing payments and managing subscriptions Providing customer support and technical assistance 5.2 To Improve Our Platform Analyzing usage patterns to improve functionality Detecting and fixing technical issues Enhancing security and preventing fraud Developing new features and services (using Anonymised Data only) 5.3 To Comply With Legal Obligations Responding to lawful requests from regulators or law enforcement Maintaining records required by tax and corporate laws Enforcing our Terms and Conditions 5.4 For Marketing (With Consent) Where you have provided consent, we may send you marketing communications about our services. You may opt out at any time using the unsubscribe link in any marketing email. BXE does NOT sell your Personal Information to third parties. 6. Legal Basis for Processing (POPIA Section 11-12) We process Personal Information only where we have a valid legal basis under POPIA: Processing Activity Legal Basis (POPIA Section) Providing contracted services Section 11(1)(a) – Necessary for contract performance Legal compliance (tax, regulatory) Section 11(1)(c) – Compliance with legal obligations Security, fraud prevention, analytics Section 11(1)(e) – Legitimate interest (balanced) Marketing communications Section 11(1)(b) – Consent (opt-in required) Processing of Customer Data (by Customer) Determined by Customer as Responsible Party 7. Data Sharing and Disclosure 7.1 Sub-Processors We use third-party service providers to help deliver our Services. These providers act as sub-processors and are bound by contractual obligations to protect your Personal Information. Current sub-processors include: Provider Service Data Location AWS (Amazon Web Services) Cloud hosting infrastructure South Africa (Cape Town) Twilio / Clickatell SMS delivery South Africa / International SendGrid / AWS SES Email delivery South Africa / International OpenAI / Anthropic AI processing (where applicable) International PayFast / Yoco / Stripe Payment processing South Africa 7.2 Legal Disclosures We may disclose your Personal Information where required by law, court order, or lawful request from a government or regulatory authority (including the Information Regulator of South Africa). 7.3 Business Transfers In the event of a merger, acquisition, restructuring, or sale of assets, your Personal Information may be transferred as part of that transaction. We will notify you of any such change. 8. Sub-Processors BXE uses sub-processors to provide certain aspects of our Services. Each sub-processor is contractually bound to: Process Personal Information only on BXE's instructions Implement appropriate security measures Notify BXE of any security breaches without undue delay Flow down the same data protection obligations to any of their own sub-processors 9. Data Retention We retain Personal Information only as long as necessary for the purposes for which it was collected, or as required by law. Data Category Retention Period Customer Account Data Duration of active account + 30 days Customer Data (uploaded) Controlled by Customer (Responsible Party) Communication Logs 90 days System Logs and Audit Trails 90 days Billing Records 7 years (tax/legal compliance) Marketing Data (with consent) Until consent withdrawn Upon termination of your account, you have 14 days to export your data. After this period, your data will be deleted or irreversibly anonymised in accordance with our retention schedule. 10. Data Subject Rights (POPIA Sections 23-25) Under POPIA, data subjects have the following rights regarding their Personal Information: 10.1 Right of Access You may request confirmation of whether we hold your Personal Information, and request a copy of that information. 10.2 Right to Rectification You may request correction of inaccurate or outdated Personal Information. 10.3 Right to Deletion (Right to be Forgotten) You may request deletion of your Personal Information where there is no lawful basis for continued processing. 10.4 Right to Object You may object to the processing of your Personal Information for legitimate interest purposes (including direct marketing). 10.5 Right to Data Portability You may request to receive your Personal Information in a structured, commonly used, machine-readable format. How to Exercise Your Rights To exercise any of these rights, please submit a written request to rd@bxe.co.za . We will respond within 30 days of receiving your request. We may require proof of identity before processing your request. If you are a data subject whose Personal Information has been uploaded by one of our Customers (i.e., you are a customer of a BXE user), please contact the Customer directly. BXE acts as an Operator for such data and will assist the Customer in responding to your request. 11. Security Breach Notification (POPIA Section 22) BXE takes security breaches seriously. In the event of a security breach that compromises Personal Information, we will: Notify the Information Regulator in accordance with Section 22 of POPIA Notify affected data subjects within 24-72 hours of confirming the breach Provide information about the nature of the breach, affected data, and recommended mitigation steps Security Measures: BXE implements appropriate technical and organisational security measures including encryption (TLS 1.2+ and AES-256), role-based access controls, audit logging, and secure cloud infrastructure. However, no system is 100% secure, and we cannot guarantee absolute security. 12. Cookies and Tracking Technologies We use cookies and similar tracking technologies to: Enable essential website functions (session cookies) Analyse website usage (analytics cookies) Remember your preferences (functional cookies) You may control cookies through your browser settings. Disabling cookies may affect the functionality of our Services. We do not use cookies for cross-site tracking or behavioural advertising without consent. 13. Children's Privacy (POPIA Section 34) Important: Children's Data Restrictions Our Services are not intended for children under 18 years of age. We do not knowingly collect Personal Information from children. Where a Customer processes Personal Information of children (e.g., schools, sports clubs, healthcare providers), the Customer warrants that they have obtained verifiable parental or guardian consent as required by Section 34 of POPIA. 14. International Data Transfers (POPIA Section 72) Your Personal Information may be transferred to and processed in countries outside South Africa where our sub-processors operate. We ensure that adequate protection is in place for such transfers, including: Standard contractual clauses approved by the European Commission (where applicable) Binding corporate rules (where applicable) Adequacy decisions by the Information Regulator (as they become available) By using our Services, you consent to the transfer of your Personal Information to these countries for the purposes described in this Privacy Policy. 15. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified by: Email to your registered email address (30 days' notice for material changes) Notice within your account dashboard Posting on our website The "Effective Date" at the top of this Privacy Policy indicates when it was last updated. Your continued use of our Services after the effective date constitutes acceptance of the updated policy. 16. Contact Information For privacy-related enquiries, data subject requests, or to report a suspected breach: Privacy Officer: rd@bxe.co.za Legal Enquiries: legal@bxe.co.za Physical Address: The Firs, Biermann Avenue, Rosebank, Johannesburg, 2196 Postal Address: PO Box 1234, Sandton, 2146 Privacy Policy Version 2.0 | Effective January 2026 This Privacy Policy is compliant with the Protection of Personal Information Act 4 of 2013 (POPIA). Ready to build your BXE growth system? Connect your website, CRM and customer-growth tools. Register for BXE → Growth Ecosystem BXE is an AI-driven growth system combining automated marketing, predictive CRM intelligence and data-powered campaigns to help businesses attract and convert customers at scale. Quick Links Platform How It Works About Contact Legal Terms & Conditions Privacy Policy PAIA Manual Contact support@bxe.co.za 087 821 6028 The Firs, Biermann Ave Rosebank, Johannesburg © 2025 BXE Ltd. All rights reserved.