Draft v1.0.3 · fixed URL /privacy/v1.0.3 · Envy Fincorp (Pty) Ltd t/a Beedee · placeholders marked [TO CONFIRM]
Version 1.0.3 (draft) · Effective: [TO CONFIRM: date - confirm]
1. Who we are
Beedee (beedee.co.za) is an online business hub for South African businesses: tenders, leads, compliance documents and outreach tools in one place. It was formerly called BizKraal. Beedee is owned and run by Envy Fincorp (Pty) Ltd t/a Beedee, registration number 2021/756475/07 ("Beedee", "we", "us"). We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA), except where section 8 says we act as an operator.
Address (and address for legal notices): 102 Churchill Street, Wendywood, 2090
Under POPIA, "personal information" includes information about companies and other juristic persons, not only individuals. This notice applies to both.
2. What we collect when you sign up
- Your name.
- Your business name.
- Your work email.
- The sectors (and, if you choose, provinces) you are interested in.
- If you arrived through a referral link: the referral code, so we can credit the business that referred you.
To sign you in we send a one-time code to your email. We store the code only in scrambled (hashed) form, with the time it was sent, the number of attempts and your IP address. Codes expire after 10 minutes.
To keep a record that you accepted our terms, we also log:
- your IP address;
- the date and time you accepted; and
- the version of the Terms of Service and this Privacy Notice you accepted.
We do not ask for more than this at sign-up.
3. What we collect while you use Beedee
- Credits, referrals and share posts: your credit history (credits granted, used and withdrawn); referral records (who referred whom, the date, and checks against self-referral, such as comparing email domains and business names); and the links to any public social media posts you submit for a share bonus. See the Beedee Credits and Referral Terms.
- Usage and security logs: pages used, actions taken, IP address, browser and time, kept in an audit log.
- Cookies: strictly necessary cookies only, to keep you signed in and to protect forms. We do not use advertising cookies. If we add analytics, we will ask first.
4. Why we use it and our lawful basis (POPIA section 11)
| Purpose | Lawful basis |
| Create and run your account and teaser dashboard; match you with tenders and information in your sectors; run the credits and referral programme | Contract (s11(1)(b)) |
| Send service emails, such as sign-in codes, sign-up confirmation, security notices and changes to our terms | Contract (s11(1)(b)) |
| Keep the platform safe; prevent fraud, fake accounts and self-referrals; prove acceptance of our terms | Legitimate interest (s11(1)(f)) |
| Keep billing and tax records | Legal obligation (s11(1)(c)) |
| Send marketing | Your consent (s69), see section 5 |
5. Marketing
We send marketing emails only if you opt in with the separate, optional tick-box. You can unsubscribe at any time using the link in every email. Not opting in does not affect your account.
If someone referred you to Beedee, we do not market to you because of that referral unless you sign up and opt in yourself, or the person who referred you confirmed that you agreed to hear from us.
6. When you unlock full access
If you choose to unlock full details, we will ask for fuller registration details (for example company registration number, VAT number, address and contact persons), compliance documents and billing information. We will give you a separate notice on how we use that information at that point, before you provide it. [Unlock-stage notice - to be drafted.]
7. People whose details appear in Beedee listings
Beedee shows tenders and opportunities collected from public sources, such as government and state-owned company tender portals. These may include the names and work contact details of contact persons at the issuing organisations. We use this information only to show the opportunity to our users, so that they can respond to it. Our lawful basis is legitimate interest (s11(1)(f)), and the information was made public by the issuer (s12(2)(a)). If you are such a contact person, you may object at any time (section 11) and we will remove or hide your details unless the law requires otherwise. Users who contact you must follow POPIA, including the rules on electronic direct marketing.
8. Documents and data you upload for your business (we are your operator)
When your business uploads its own documents and records to Beedee (for example compliance documents in the KYC vault, leads, contacts and tender records), your business is the responsible party for the personal information in them and we process it as your operator under POPIA sections 20 and 21. We use it only to provide the service to you, keep it confidential and secure (vault files are encrypted, and director ID documents are restricted to authorised users of your business), and delete it when you delete it or your account ends. Your business must have a lawful basis, and where needed the consent of the people concerned, before it uploads their information.
9. Where we keep it and who we share it with
- We host your information in South Africa [TO CONFIRM: hosting provider - confirm].
- We use service providers (operators), such as hosting and email delivery providers. They may only process your information on our instructions and are bound by written terms to keep it secure and confidential (POPIA sections 20 and 21). Our email delivery provider is [TO CONFIRM: email delivery provider - confirm], which processes information in [TO CONFIRM: country - confirm]. Where any provider processes information outside South Africa, we make sure POPIA section 72 is met.
- If you pay by card, your card payment is processed by PayFast (Pty) Ltd through a payment page operated by our related company Envy Finpro (Pty) Ltd t/a Monte La Vue, which receives the payment details needed to match your payment to your invoice. We do not see or store full card numbers.
- If you were referred, the business that referred you sees your business name and whether its referral was credited. It does not see your contact details or activity.
- We may disclose information where the law requires it, or to professional advisers, auditors and a buyer of our business under confidentiality.
- We do not sell your personal information.
10. How we keep it safe
We use reasonable technical and organisational measures, including encrypted (HTTPS) connections, passwordless one-time sign-in codes, access controls, audit logs, encryption of uploaded files at rest and staff confidentiality. If there are reasonable grounds to believe your information has been accessed or acquired by an unauthorised person, we will tell you and the Information Regulator as POPIA section 22 requires.
11. How long we keep it
- Inactive sign-ups: deleted 12 months after your last activity.
- Sign-in codes: expire after 10 minutes and are deleted within 24 hours [TO CONFIRM: confirm with developer].
- Billing records: kept for 5 years, as tax law requires.
- Acceptance logs and credit ledger: kept while your account is active and for [3] years after it closes, to prove acceptance and resolve disputes.
- Marketing opt-outs: your email is kept on a suppression list so that we never market to you again.
- If you delete your account, we delete your sign-up information, unless the law requires us to keep it.
12. Your rights
You may:
- ask whether we hold personal information about you, free of charge, and ask for a copy (POPIA s23; our PAIA Manual explains how and any fees);
- ask us to correct or delete it (s24);
- object to how we use it, including for marketing (s11(3));
- withdraw your consent at any time; and
- complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za; [inforegulator.org.za](https://inforegulator.org.za).
To use your rights, email our Information Officer. We may need to confirm your identity first.
13. Contact
Information Officer: Mr D Mhlaba
Information Regulator registration number: [TO CONFIRM: IR registration number - confirm]
Email: privacy@beedee.co.za [TO CONFIRM: confirm mailbox]
Address: 102 Churchill Street, Wendywood, 2090
PAIA Manual: [TO CONFIRM: link]
14. Changes
We may update this notice. We will tell you about material changes by email or on the platform before they take effect. The version and effective date are shown at the top.
Beedee is for businesses and people aged 18 or older. We do not knowingly collect information about children.