Privacy Policy

Budski is a loyalty infrastructure platform for small businesses, built and operated by BUDSKI (PTY) LTD, a company registered in South Africa (CIPC Reg: 2026/512018/07). We are based in Cape Town, Western Cape.

This Privacy Policy explains how we collect, use, and protect personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and applicable data protection laws.

Questions? Contact us at privacy@budski.co.za

Budski serves two types of users, and their privacy profiles are very different by design:

• Retail Partners (businesses) — businesses that use the Budski dashboard to run loyalty programmes. We hold their business details to provide the service.
• Adventurers (customers) — end-users of the Budski mobile app who earn rewards. By design, we do not hold their name, phone number, or address. They are known to us only by a pseudonymous Adventurer Code.

Retail Partners

When a business signs up, we collect: business name, industry, contact person's name, and email address. This information is used to create and manage your account, provide the service, and communicate with you about your subscription.

Adventurers (mobile app users)

Privacy is central to Adventurer accounts. We do not store your name, phone number, or address. When you join a loyalty programme, you are assigned a unique Adventurer Code — a pseudonymous identifier. We store only your birth month and year (for age verification where legally required) and your loyalty activity (stamps earned, deals redeemed).

If your activity is ever breached, no personally identifiable information is exposed.

Worker-Bees (staff accounts)

Businesses that onboard staff members through Budski collect a South African ID number for operational accountability and, where applicable, legislative compliance purposes. This information is stored in encrypted form (column-level encryption) and is not accessible to Budski staff except where required by law.

Regulated industries

Businesses in regulated industries (cannabis clubs, liquor stores, bars, and other age-restricted venues) may be required by law to verify customer age or identity. Where this applies, only the information strictly required by law is collected, and only at the point of service. Budski's Legislative Compliance feature serves as a compliant member registry under applicable South African legislation and associated self-regulatory codes.

• To create and manage your Budski account
• To provide loyalty programme features (stamp cards, deals, analytics)
• To communicate with you about your account, including transactional emails
• To comply with legal obligations (POPIA, Cannabis for Private Purposes Act, Liquor Act, and other applicable legislation)
• To improve the Budski platform

We do not sell your personal information. We do not use your information for advertising purposes on behalf of third parties.

Budski uses Supabase as its database infrastructure, hosted on servers within compliant data centre environments. Sensitive information (such as SA ID numbers for staff accounts) is stored using column-level encryption. All data in transit is encrypted via TLS/HTTPS.

Access to personal information is restricted on a need-to-know basis using Row Level Security policies enforced at the database level.

We do not share personal information with third parties for marketing purposes. We may share information in the following limited circumstances:

• Service providers: We use Supabase for database hosting and Expo for mobile app infrastructure. These providers process data on our behalf and are bound by data processing agreements.
• Legal obligation: We will disclose information where required by South African law, court order, or government authority.
• Business transfer: In the event of a merger or acquisition, personal information may be transferred to the acquiring entity, subject to the same privacy protections.

As a data subject under POPIA, you have the right to:

• Know whether we hold personal information about you
• Request access to your personal information
• Request correction of inaccurate information
• Request deletion of your information (subject to legal retention requirements)
• Object to the processing of your information
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at privacy@budski.co.za. We will respond within 30 days.

The Information Regulator of South Africa can be reached at inforegulator.org.za.

In the event of a security breach that is reasonably likely to prejudice the interests of data subjects, we will notify the Information Regulator and affected individuals as soon as reasonably possible, in accordance with POPIA and the 2025 Amendment Regulations.

The Budski web dashboard uses essential cookies only — specifically, a session cookie to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

We retain your information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations. Adventurer Codes and loyalty records are retained for the duration of the associated Retail Partner's subscription and for up to 12 months after account closure.

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the most recent revision. Continued use of Budski after changes constitutes acceptance of the updated policy.