POPIA Notice

This notice explains how Beesworx (Pty) Ltd, a private company registered in South Africa, operating Buzzz at buzzzmail.co.za ("we", "us"), processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It supplements our Privacy Policy with the detail POPIA specifically requires, and it is written for two different readers: the businesses that use Buzzz to send email and SMS, and the individuals those businesses message.

1. Who this notice is for

If you are a Buzzz customer, you upload your own contacts' personal information and decide what to send them. For that data, POPIA treats you as the responsible party and Buzzz as your operator: we process it only on your instructions, to provide the Service, and we do not use it for our own purposes.

If you are a recipient of email or SMS sent through Buzzz, the business that sent it is the responsible party for your personal information, not Buzzz. This notice still tells you how Buzzz, as that business's operator, safeguards your data and how you can stop receiving messages.

For Buzzz's own customers and account holders (the people who sign up and use the dashboard), Beesworx is itself the responsible party, on the same basis as our Privacy Policy describes.

2. Lawful basis for processing

Section 11 of POPIA requires a lawful justification for processing. The processing described in our Privacy Policy relies on one or more of: performance of the contract between you and us (providing the Service you signed up for); our legitimate interest in operating, securing, and improving the platform, and in preventing abuse of shared sending infrastructure; compliance with a legal obligation (for example, retaining suppression records); and, for a recipient who opted in to a customer's mailing list, the consent that customer collected. Buzzz does not independently collect consent from a customer's contacts: that is the customer's responsibility as responsible party.

3. Operator vs. responsible party, in practice

As operator for customer contact data, Buzzz:

• processes contact data only to provide the Service the customer configured: sending, delivery tracking, suppression, analytics;
• does not sell it, and does not use it for advertising; the optional AI writing features send only the customer's own message copy to our AI provider, never contact data;
• keeps it confidential and applies the security measures in section 7;
• notifies the customer if we reasonably believe their contact data has been accessed by an unauthorised person, so the customer can meet their own section 22 duty to the affected individuals.

The operator/responsible-party split, and the specific commitments an operator agreement carries, are set out in full in our Data Processing Agreement.

4. What personal information we process

The categories are the same as in our Privacy Policy: account and authentication data, provider credentials, contact data a customer uploads (names, addresses, phone numbers, custom fields), message content and delivery/engagement events, opt-out records, and technical/log data. We do not knowingly process special personal information (POPIA section 26) about a customer's contacts, and customers must not use custom fields to store it.

If you are a recipient, the one thing we collect directly from your device rather than from the sender is generated by opening a marketing email or clicking a link in one: the time, your IP address and browser/device information, and, where configured, a country and region derived from that IP address. Transactional messages (receipts, password resets, and the like) carry no such tracking.

5. Cross-border transfers

Some processing described in this notice happens outside South Africa. Outbound email is sent through Amazon SES in AWS region eu-north-1 (Stockholm, Sweden); inbound email receiving and the raw message store run in AWS region eu-west-1 (Ireland). Other service providers we rely on may also process data outside South Africa; see the sub-processor table in our Data Processing Agreement and Where your data lives for the region each one uses.

POPIA section 72 permits a transfer outside South Africa only where the recipient is subject to a law, binding agreement, or set of binding rules that provides an adequate level of protection. Beesworx relies on section 72(1)(a): each provider named above is bound to us by a data processing addendum or standard contractual clauses giving an adequate level of protection substantially similar to POPIA's conditions (for AWS, its own Data Processing Addendum incorporating the Standard Contractual Clauses; our other providers carry equivalent terms). Section 72(1)(b) (the data subject's own consent) is not our basis here: where a recipient consented to a customer's mailing list, that consent is between the customer and their recipient, not something Buzzz relies on for its own transfers.

6. Retention

Retention periods we can state from how the Service is built:

• a sign-in link (email magic link) expires after 15 minutes;
• an idempotency record for an API send request is kept for 24 hours;
• a private inbound-email attachment link expires after 1 hour and is reissued fresh on every read;
• a hosted signup form's confirmation link expires after 48 hours;
• suppression and opt-out records (unsubscribes, SMS STOP replies) are kept for as long as the underlying contact could otherwise be messaged, because deleting one would silently remove the very thing preventing an unwanted message.

Periods we commit to for everything else:

• account and contact data: kept for the life of the account. If you ask us to close your account, we complete the deletion within 30 days of the request (see our Terms of Service, section 5); any data still held afterwards, for legal or billing wind-down, is deleted or anonymised no later than 90 days after closure;
• message content and delivery/engagement event history: kept for up to 13 months from when the message was sent, or until you delete the underlying contact, campaign, or account, whichever comes first;
• server logs: 30 days;
• database backups: 30 days.

7. Security safeguards

We apply technical and organisational measures proportionate to the harm that would result from unauthorised access, in line with POPIA's section 19 security requirement, including:

• encryption in transit (TLS) and encryption at rest for stored provider credentials and API keys (AES-256-GCM);
• API keys stored as bcrypt hashes, never in plaintext;
• signature verification on the delivery-receipt webhooks from AWS (SES bounce, complaint and delivery notifications) and Twilio, so only the real provider can report a delivery event; our SMS provider BulkSMS does not offer webhook signing, so that channel is instead protected by a shared secret known only to us and BulkSMS;
• private inbound email attachments served only via short-lived, per-request presigned URLs rather than public links;
• a per-account sending-reputation guard that warns and, if needed, pauses an account whose bounce or complaint rate endangers the shared sending infrastructure;
• suppression and opt-out lists that apply to every list, campaign, and automated message a given sender sends through Buzzz, not just the message you are reacting to, so one unsubscribe or STOP covers all of that sender's future mail to you.

Full detail is in our Data Processing Agreement and Where your data lives.

8. Data subject rights and how to exercise them

You have the rights POPIA gives every data subject, including to:

• be told what personal information is held about you and why;
• access a copy of it, and have inaccurate or outdated information corrected;
• object to processing, and request its deletion once we no longer have a lawful basis to keep it;
• lodge a complaint with the Information Regulator (South Africa).

If you are a recipient of a customer's email or SMS: the fastest way to exercise your rights is directly with the sender, since they hold the underlying relationship and are the responsible party. Every marketing email includes an unsubscribe link, and every marketing SMS honours a STOP reply; both cover every list, campaign, and automated message that sender sends through Buzzz, not only the one you are reading. You can also contact us directly (section 10 below) and we will either action the request ourselves (for data we hold, such as suppression records) or forward it to the relevant customer.

If you are a Buzzz customer or account holder: most account data, and the contact data you uploaded, can be accessed, corrected, or deleted directly in the dashboard, including deleting an individual contact or a contact list. For anything the dashboard does not cover, contact us at the address below.

9. Information Officer

Beesworx's Information Officer, as required by POPIA section 55, is Brian Machimbira. Contact: support@buzzzmail.co.za.

10. Contact and complaints

POPIA questions or requests: privacy@buzzzmail.co.za.

You may also lodge a complaint with the Information Regulator (South Africa) at any time: inforegulator.org.za, or by email to POPIAComplaints@inforegulator.org.za.