Privacy policy for service providers

1. Introduction

Buzz Communities (Pty) Ltd t/a JollyBee (hereafter referred to as “JollyBee”) provides a software-as-a-service community management platform (“Platform”), which delivers a dynamic suite of digital tools and services to assist Community Owners in the administration, monetisation, and engagement of their respective communities.

To operate our Platform, maintain our infrastructure, and manage our day-to-day business operations, JollyBee partners with various external vendors. Consequently, we are required to process the personal information of our service providers, suppliers, independent contractors, and their authorised representatives (collectively referred to as “you” or “Service Providers”).

JollyBee constitutes a Responsible Party and is strictly committed to protecting your constitutional right to privacy. We handle all personal information in accordance with the Protection of Personal Information Act, No. 4 of 2013 (POPIA).

Responsible party: Buzz Communities (Pty) Ltd t/a JollyBee, registration number 2024/689754/07
Registered address: Uniwines Vineyards, Daschbosch Cellar, Louwshoek Voorsorg Road, Rawsonville, Western Cape, 6845, South Africa
Postal address: PO Box 174, Rawsonville, Western Cape, 6845

2. Purpose of this policy

POPIA aims to give effect to the constitutional right to privacy by balancing the right to privacy against that of the right of access to information. POPIA requires that personal information pertaining to individuals and juristic persons be processed lawfully and in a reasonable manner that does not infringe on their right to privacy. The purpose of this Privacy Policy is to clearly set out:

How we collect, use, share, and otherwise process your personal and commercial information during our procurement, onboarding, and ongoing contractual relationship;
The specific types of information we require to facilitate trade and compliance; and
Your rights as a data subject under POPIA.

By contracting with, providing services to, or submitting a quotation to JollyBee you acknowledge that your personal information will be processed in accordance with this Policy.

3. Definitions

We, us and our: Buzz Communities (Pty) Ltd t/a JollyBee, Registration Number 2024/689754/07.
You and your: means any data subject as defined by POPIA which includes service providers, suppliers, independent contractors, and their authorised representatives.
Your personal information: Includes, but is not limited to, first name, surname, phone number, identity number; business name; business registration number, payment information, e-mail address, physical address, postal address and banking details. Personal information is not general, statistical, aggregated or anonymised information.
Process information: means the automated or manual activity of collecting, recording, organising, storing, updating, distributing and removing or deleting personal information.

4. Purpose for processing your personal information

We will only process your personal information for the lawful purpose for which it was collected. You agree that we may process your personal information for the following purposes:

4.1

to enable us to utilise your products and services;

4.2

to effectively correspond with you;

4.3

to enable us to make payment for goods and / or services;

4.4

B-BBEE verification.

5. Types of data collected and purpose for processing

Information	Purpose
Email address	Correspondence, orders, record keeping
Name and surname	Correspondence, orders, record keeping
Business name	Correspondence, orders, payment, record keeping
Phone number & fax number	Correspondence, record keeping
Business registration number	Orders, payment, record keeping
VAT registration number	Orders, payment, record keeping
Physical address	Orders, payment, record keeping
Postal address	Orders, payment, record keeping
Banking details	Payment, record keeping

6. Automated processing

We may process your information using automated means (without human intervention in any decision-making process). You may query the decision made about you by automated means.

7. Acceptance is voluntary

You have the right to object to the processing of your personal information. It is voluntary to accept these terms and conditions. However, we require your acceptance to enable us to utilise your products and / or services. This means that if you do not accept, we cannot utilise your products and / or services. By providing us with your personal information, you agree to this Privacy Policy and authorise us to process your information as set out herein.

8. We keep personal information confidential

Save as provided in this privacy policy, we will keep your personal information confidential.

9. Consent

You have the right to object to the processing of your personal information at any time. Accepting these terms and conditions is completely voluntary.

9.1

For prospective Service Providers: We require your consent to process your personal and commercial information during our procurement and onboarding processes, including evaluating your quotation, tender, or proposal. Without this information and consent, we cannot evaluate your suitability or proceed with a potential business relationship.

9.2

For existing Service Providers: We require your consent to process your personal information for contract-related purposes. This includes managing our ongoing commercial relationship, processing payments, fulfilling mutual contractual duties, and ensuring compliance with our legal and statutory obligations.

9.3

By providing us with your personal information, you confirm that you agree to this Privacy Policy and authorise us to:

9.3.1

process your information as set out in this privacy policy;

9.3.2

retain your information as set out in clause 13 below;

9.3.3

share such personal information with third parties only on the basis set out in this privacy policy.

10. Sharing personal information with third parties

If a third party asks us for any of your personal information, we will share it with them only if:

10.1

you have already given your consent for the disclosure of this information to that third party; or

10.2

we have a legal or contractual duty to give the information to that third party and such sharing is in accordance with POPIA; or

10.3

for any of the purposes set out in this privacy policy.

11. Collection of data directly from you

11.1

We shall, as far as possible, always collect your personal information directly, save where your information is collected from a public source, or with your written consent.

11.2

If we collect personal information from a source other than you, we shall record in writing the details of that source, including the full names and contact details of that source where applicable.

11.3

We may collect personal and commercial information from you at any point during our procurement, onboarding, and ongoing contractual relationship. This includes, but is not limited to, instances when you:

11.3.1

Submit proposals or quotes;

11.3.2

Complete vendor onboarding;

11.3.3

Send enquiries or correspond;

11.3.4

Engage in service level reviews.

12. Data storage and international transfers

Your Personal Information is hosted and stored on secure cloud servers. Records about our Service Providers, such as agreements, invoices and correspondence, are kept in the email and document storage services we use to run our business. Where you also use the JollyBee Platform, your account is stored in our database, which Supabase hosts on Amazon Web Services in Ireland, in the European Union; our website runs on Vercel in its Cape Town region, with fallback regions in the European Union and the United Kingdom. Some of these services keep information outside South Africa, including in the United States. You hereby acknowledge and consent to the transfer of your Personal Information to these international servers for the purposes of hosting, maintenance, and processing. POPIA section 72 allows these transfers; we rely mainly on our providers’ data processing terms, which bind them to protect the information. We maintain strict security protocols with our cloud service providers to protect your data.

13. Retention

We will retain your personal information for the period for which the data is required to serve its primary purpose or for the period required to comply with any applicable legal requirement, whichever is the longer.

14. Security safeguards

We have physical, technological and procedural security safeguards in place and will do our best to ensure the protection of your personal information. We will take all reasonable steps to prevent the loss, abuse or misuse of your personal information. We will review our security controls and related processes on a continuous basis, to ensure that your information remains secure.

15. Breach

15.1

In the event of a data breach, where personal information has been compromised, we will notify the Information Regulator and the data subject as soon as possible.

15.2

The notification of breach will be in writing in one of the following ways:

15.2.1

By post to the data subject’s physical address;

15.2.2

By e-mail to the data subject’s email address;

15.2.3

By notification on the website;

15.2.4

Published in news media.

16. You have the right to know what personal information we have of yours

You have the right to know what personal information we hold about you, and asking whether we hold it is free (POPIA section 23). If you wish to receive a copy of the information, you will have to lodge a request with our information officer via e-mail. We will take all reasonable steps to confirm your identity before providing details of your personal information. A copy may carry the access fee prescribed under the Promotion of Access to Information Act (see our PAIA manual), and we will let you know what it is at the time of your request, before we do the work.

You have the right to ask us to update, correct or delete your personal information. We will require proof of identification or authority prior to making any of the requested changes. If you are aware of any personal information in our custody which is incorrect, inaccurate or which needs to be updated, you must make a written request to our information officer at phil@jollybee.buzz to update or correct the relevant information. If you contest the accuracy of any personal information being used by us, we shall immediately stop using that information until its accuracy has been verified.

17. Changing this Privacy Policy

We may change this Privacy Policy at any time. The most updated version will always be published on this page, with the date at the top, and is available upon request. Earlier versions are available from our Information Officer on request.

18. If you have any concerns

If you believe that we have used your personal information contrary to this Privacy Policy or in contravention of POPIA, we ask that you first attempt to resolve any concerns with us. You also have the right to lodge a complaint with the Information Regulator in accordance with POPIA at any time, whether or not you have contacted us first.

Please contact us at:

Information Officer: Philip Roelof Du Toit, phil@jollybee.buzz, +27 82 672 8180
Deputy Information Officer: Reinier Matthee, reinier@jollybee.buzz, +27 83 633 4813
Post: PO Box 174, Rawsonville, Western Cape, 6845

Please contact the Information Regulator at:

The Information Regulator (South Africa)
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Post: P.O. Box 31533, Braamfontein, Johannesburg, 2017
Tel No.: 010 023 5200; toll free 0800 017 160
General enquiries: enquiries@inforegulator.org.za
Complaints: on POPIA Form 5, through the Regulator’s eServices portal or by e-mail to POPIAComplaints@inforegulator.org.za (see the Regulator’s complaints page)
Website: inforegulator.org.za