Privacy Policy

1. Who We Are & Scope of This Policy

BantuTec (Pty) Ltd ("BantuTec", "we", "us", or "our") is a software product development company incorporated in the Republic of South Africa with its principal place of business at 4 Indigo Drive, Burgundy Estate, Cape Town, South Africa. We deliver custom web applications, mobile applications, cloud infrastructure, and related digital services to clients across South Africa and Zambia.

This Privacy Policy explains how BantuTec collects, uses, discloses, and safeguards personal information when you visit our website at bantutec.dev ("Website") or engage our services. It applies to all data subjects whose personal information we process, whether you are a visitor, a prospective client, a current client, or a supplier.

This Policy is issued in compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) of South Africa. Where we operate in or process the personal information of residents of Zambia, we additionally observe the Zambia Data Protection Act No. 3 of 2021, administered by the Zambia Information and Communications Technology Authority (ZICTA), as our secondary regulatory framework.

2. Information Officer

BantuTec has designated an Information Officer as required by POPIA. For all data protection enquiries, access requests, or complaints, please contact:

• Information Officer — BantuTec
• Email: info@bantutec.dev
• Phone: +27 78 603 3130
• Address: 4 Indigo Drive, Burgundy Estate, Cape Town, South Africa

If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Regulator (South Africa) at www.justice.gov.za/inforeg/, or with the relevant supervisory authority in your country of residence.

3. Personal Information We Collect

3.1 Information You Provide Directly

• Contact & enquiry data: name, email address, phone number, company name, and the content of messages submitted via our contact form or email;
• Client onboarding data: business registration details, billing address, banking information (for invoicing), and authorised signatory information;
• Project data: content, requirements, specifications, and materials you supply to us for inclusion in deliverables;
• Communications: records of email, WhatsApp, or other correspondence with our team.

3.2 Information Collected Automatically

• Usage data: IP address, browser type and version, pages visited, time and date of visit, referring URL, and device type;
• Cookies & similar technologies: see Section 8 below.

3.3 Information from Third Parties

We may receive personal information about you from referral partners, public business directories, or social media platforms when you engage with our content or are referred to us by a mutual contact. We only retain such information if there is a legitimate basis for doing so.

4. Lawful Basis for Processing

Under POPIA, we process your personal information only where we have a lawful basis to do so. The bases we rely on are:

• Contract: processing is necessary to perform a service agreement with you or to take steps at your request before entering into one;
• Legitimate interests: processing is necessary for our legitimate business interests (e.g. responding to enquiries, improving our services, preventing fraud), provided those interests are not overridden by your rights;
• Legal obligation: processing is necessary to comply with a legal obligation applicable to us (e.g. tax and financial reporting);
• Consent: where we rely on your consent (e.g. for marketing communications), you may withdraw it at any time by contacting us at info@bantutec.dev.

5. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

• Responding to your enquiries and providing requested quotations;
• Delivering, managing, and supporting our software development services;
• Sending invoices and processing payments;
• Communicating project updates, milestones, and delivery information;
• Improving and personalising your experience on our Website;
• Sending service-related announcements and, where you have consented, marketing communications about our services;
• Complying with legal and regulatory obligations;
• Protecting against fraud, unauthorised access, and other security threats;
• Enforcing our Terms & Conditions and other agreements.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

6. Disclosure of Personal Information

We may share your personal information with the following categories of recipients:

• Service providers and operators: cloud hosting providers, email platforms, accounting software, project management tools, and payment processors who assist us in delivering our services. These parties are bound by confidentiality obligations and may only process your information on our instructions;
• Professional advisers: lawyers, accountants, and auditors bound by professional secrecy obligations;
• Regulatory authorities: where required by law, court order, or government request;
• Business transfers: in the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity, subject to equivalent privacy protections.

7. Cross-Border Transfers of Personal Information

BantuTec operates across South Africa and Zambia. In delivering our services, your personal information may be transferred to and processed in these countries. We ensure such transfers are conducted in accordance with Section 72 of POPIA and equivalent provisions under the Zambia Data Protection Act No. 3 of 2021, including by implementing appropriate safeguards such as contractual arrangements that afford comparable protection to that provided under POPIA.

Some of our third-party service providers may be located outside Africa. Where personal information is transferred outside the African continent, we implement appropriate transfer mechanisms (such as standard contractual clauses) to ensure your information receives an adequate level of protection.

8. Cookies & Tracking Technologies

Our Website uses cookies and similar technologies to enhance your browsing experience and analyse site traffic. Cookies are small text files stored on your device. We use the following types:

• Essential cookies: necessary for the Website to function correctly. These cannot be disabled.
• Analytics cookies: help us understand how visitors interact with the Website so we can improve it. Data collected is aggregated and anonymised where possible.
• Preference cookies: remember your settings and choices for a better experience on return visits.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Website. Where consent is required under applicable law, we will request it before placing non-essential cookies.

9. Data Retention

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our general retention guidelines are:

• Client records and project data: 7 (seven) years from the end of the engagement, to comply with tax and commercial law requirements;
• Enquiry and contact data: 12 (twelve) months from the date of last contact, unless a client relationship develops;
• Website usage data: up to 26 months in aggregated or anonymised form;
• Marketing consent records: retained until you withdraw consent, plus 1 (one) year thereafter.

When personal information is no longer required, we securely delete or anonymise it.

10. Security

BantuTec implements appropriate technical and organisational measures to protect your personal information against unauthorised access, accidental loss, destruction, or disclosure. These measures include encrypted data transmission (TLS/HTTPS), access controls, and regular security reviews.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that is likely to affect you, we will notify you and the Information Regulator as required by POPIA.

11. Your Rights as a Data Subject

Under POPIA and applicable African data protection laws, you have the following rights in relation to your personal information:

To exercise any of these rights, please contact our Information Officer at info@bantutec.dev. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.

12. Children's Privacy

Our Website and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a child, we will delete it promptly. If you believe we have collected such information, please contact us immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. Material changes will be indicated by an updated effective date at the top of this page. We encourage you to review this Policy periodically. Where required by law, we will notify you of significant changes directly.

14. Contact & Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or our data handling practices, please contact our Information Officer:

• BantuTec — Information Officer
• 4 Indigo Drive, Burgundy Estate, Cape Town, South Africa
• Email: info@bantutec.dev
• Phone: +27 78 603 3130

If you are not satisfied with our response, you may escalate your complaint to:

• South Africa: The Information Regulator — www.justice.gov.za/inforeg/
• Zambia: Zambia Information and Communications Technology Authority (ZICTA) — www.zicta.zm