Privacy Policy

Effective date: 2026/07/01 · Version 2.1

In plain language

If you are messaging a business and just want to know your information is handled safely, this is the short version. It does not replace the full policy below.

• Who we are. BotHub is a South African platform that helps businesses manage their WhatsApp conversations. When you message a business that uses BotHub, your messages pass through our platform.
• The business you’re talking to is in charge of your information. We process your messages only on that business’s instructions, to deliver the service. For questions about why they contacted you or what they keep, ask them first.
• We don’t sell your information, and we don’t use your conversations to train our own AI models.
• WhatsApp messages travel through Meta. That’s how the official WhatsApp Business Platform works; Meta’s own privacy terms apply to that part.
• Each business’s data is kept separate — isolation is enforced in our systems so one business can never see another’s conversations.
• You have rights under South African law (POPIA): to see, correct, or delete your information, and to complain to the Information Regulator. Section 17 below explains how.

1. Who we are

Bvelaphanda Business Solutions (Pty) Ltd (“Bvelaphanda”, “we”, “us” or “our”) is a private company registered in South Africa. We operate bvelaphanda.co.za and BotHub, a customer-engagement automation platform that enables businesses to manage conversations with their customers over WhatsApp and, where enabled, other communication channels and integrations.

• Registered name – Bvelaphanda Business Solutions (Pty) Ltd
• Registration number – 2006/009107/07
• Registered or principal address – 202 Lourensford Road, Somerset West, 7130
• Information Officer – Bertus Botha (Director)
• Privacy contact – policy@bvelaphanda.co.za
• Websites – bvelaphanda.co.za and hub.botsvm.com

2. What this policy covers

This policy applies to personal information processed through our website, the BotHub platform, account administration, customer support, billing, security operations, and related business activities. It applies to:

• Website visitors – people who browse our website or submit an enquiry.
• Business customers – organisations and sole proprietors that contract with us or evaluate our services.
• Customer team members – people authorised by a business customer to use or administer BotHub.
• End customers and other correspondents – people whose messages or information are processed through BotHub on behalf of a business customer.
• Suppliers and business contacts – people who interact with us in connection with our operations.

This policy does not replace a business customer’s own privacy notice. A business using BotHub remains responsible for explaining its purposes, lawful grounds, retention practices and communications to its own customers.

3. Our roles under POPIA

Our legal role depends on why and how the information is processed.

As a responsible party. We decide the purpose and means of processing for information used to manage our own website, customer accounts, contracts, billing, support, security, supplier relationships and lawful business communications. We are directly accountable for this processing under POPIA.

As an operator. When a business customer uses BotHub to communicate with its customers or process its own records, that business is normally the responsible party. We process the relevant message content, contact details, media, workflow data and related records on the business customer’s documented instructions and to provide the contracted service.

If your information reached us through a business using BotHub, you should ordinarily direct a privacy request to that business. We will provide reasonable assistance to the business in responding. We may contact you directly where required by law or where Bvelaphanda is also a responsible party for the relevant processing.

4. Where personal information comes from

We obtain personal information from one or more of the following sources:

• Directly from you – when you create an account, communicate with us, submit a form, request support, pay an invoice, or otherwise interact with us.
• From a business customer – when it creates users, imports contacts, configures workflows, connects a data source, or sends and receives messages through BotHub.
• From messaging and platform providers – including Meta and the WhatsApp Business Platform, which supply message, delivery, account and technical information required to provide the service.
• From customer-enabled integrations – such as CRM, helpdesk, email, payment, automation, analytics, transcription, AI, or other systems connected by the business customer.
• Automatically – through application logs, cookies, security monitoring, session records, APIs and webhooks.
• From public or lawful business sources – where reasonably necessary for due diligence, fraud prevention, business administration or establishing a business relationship.

Where information is mandatory for account creation, security, payment, legal compliance or service delivery, failure to provide it may prevent us from opening or maintaining an account, completing a transaction, or providing the requested service. Other information is voluntary unless stated otherwise.

5. What personal information we process

5.1 Business customers and their teams

• Identity and contact information – name, business name, job title, email address, telephone number and business contact details.
• Account and authentication information – user identifiers, password hashes, session tokens, multi-factor authentication records, roles, permissions and account status.
• Commercial and billing information – contracts, subscription details, invoices, transaction references, tax information and payment status. Payment service providers may process payment credentials; we do not store full card numbers.
• Configuration and business content – message templates, automation flows, routing rules, business profiles, connected systems, knowledge resources and settings configured in BotHub.
• Support and correspondence – support tickets, emails, call notes, troubleshooting information and files voluntarily supplied for support.
• Usage, audit and security information – login history, IP address, browser and device details, API activity, webhook events, administrative actions, error logs and security alerts.

5.2 Information processed for business customers

• Message and communication content – text, images, documents, voice notes, video, interactive message responses and other content exchanged through connected channels.
• Contact and profile information – names, telephone numbers, identifiers, profile details, tags, consent records and conversation history supplied by or created for the business customer.
• Message metadata – message identifiers, timestamps, sender and recipient details, channel information, delivery, read and failure statuses, and media metadata.
• Workflow and derived information – categories, assignments, routing outcomes, summaries, transcripts, tags, sentiment indicators, suggested responses and other outputs generated by enabled features.
• Integration information – records retrieved from or sent to customer-selected CRM, billing, support, inventory, payment, automation, identity, AI, or other connected systems.
• Voice-note transcripts – where enabled, voice notes may be converted to text for reading, searching and response preparation. Transcription is performed on infrastructure administered by us by default. If a business selects an external transcription provider, relevant audio or text may be sent to that provider.

5.3 Website visitors and general business contacts

• Website and device data – IP address, browser type, device type, pages viewed, referring page, approximate time of access and similar technical records.
• Enquiries and forms – the information included in a contact, demo, support or other form submitted to us.
• Business relationship information – communications, meeting details, proposals, contracts, supplier records and professional contact details.

6. Why we process personal information

Depending on our role and the circumstances, we process personal information for the following purposes and on one or more lawful grounds recognised by POPIA:

• Provide and administer the service – to create accounts, authenticate users, route and store messages, run workflows, provide enabled features, maintain integrations and fulfil our contracts.
• Process information on customer instructions – to operate BotHub for a business customer acting as the responsible party.
• Support customers – to troubleshoot, answer enquiries, restore service, migrate data and resolve incidents.
• Billing and legal compliance – to invoice, collect payment, maintain accounting and tax records, respond to lawful requests and comply with applicable legal duties.
• Security and service integrity – to authenticate webhooks, detect abuse, prevent fraud, monitor system health, investigate incidents and protect users, customers and our infrastructure.
• Product operation and improvement – to understand performance and improve reliability and usability using aggregated or de-identified information where reasonably possible.
• Business communications – to communicate about accounts, service changes, renewals, support, security and relevant products, subject to direct-marketing rules.
• Consent-based activities – where consent is required or is the most appropriate lawful basis, including certain marketing, optional features, cookies or high-risk processing.

We do not sell personal information. We do not use customer conversation content to train our own general-purpose artificial intelligence models.

7. Special personal information and children

Messages and documents may contain sensitive or special personal information, including information about health, race or ethnic origin, religion or beliefs, political persuasion, trade-union membership, sex life, biometric information, criminal behaviour or alleged offences. BotHub does not require this information for ordinary platform operation, but a business customer or end customer may include it in a communication.

A business customer that processes special personal information through BotHub is responsible for confirming that an applicable authorisation or lawful basis exists, limiting collection to what is necessary, and applying any additional legal, professional or industry safeguards. We may require enhanced contractual, technical or organisational controls for high-risk use cases.

BotHub is a business service and people under 18 may not open or administer a BotHub account. Because BotHub processes communications on behalf of business customers, messages may nevertheless contain personal information relating to children. The relevant business customer is responsible for ensuring that it has the consent of a competent person or another lawful authorisation to process that information. We process it only on the customer’s documented instructions and apply safeguards appropriate to the circumstances.

If you believe a child’s information has been processed unlawfully or reached the platform in error, contact the responsible business or our Information Officer so that the matter can be investigated.

8. Artificial intelligence, transcription and automated processing

Depending on the features enabled by a business customer, BotHub may use automation or artificial intelligence to transcribe voice notes, classify or route messages, detect intent, extract information, search connected knowledge sources, summarise conversations, prioritise work, or draft suggested responses. Outputs may be inaccurate and should be reviewed where their use could materially affect a person.

We do not use customer conversation content to train our own general-purpose AI models. Where a customer enables an external AI, transcription or analytics provider, relevant prompts, content, metadata or outputs may be sent to that provider. We will identify the provider or make relevant subprocessor information available, and the customer is responsible for deciding whether the feature is appropriate for its purpose and data.

We do not intend to authorise an external provider to use customer content to train a general-purpose model unless the customer has expressly enabled a service after receiving appropriate disclosure. Provider terms, retention and processing locations may differ and must be evaluated before use.

Bvelaphanda does not use its own account or website data to make solely automated decisions that produce legal consequences or similarly significant effects for individuals. Business customers must not use BotHub to make such decisions without a lawful basis, appropriate notice, meaningful human review, a way for the affected person to make representations, and any other safeguards required by law.

9. WhatsApp and Meta

BotHub sends and receives WhatsApp messages through the official WhatsApp Business Platform, including the Cloud API operated by Meta. Message content, telephone numbers, account data, templates, delivery information and related metadata therefore pass through Meta’s systems and may be processed outside South Africa.

Business customers ordinarily use their own WhatsApp Business Accounts and accept the applicable Meta and WhatsApp terms. Meta may act in different legal roles for different processing activities. Its processing is governed by its own terms and privacy information, not solely by Bvelaphanda’s instructions.

Meta information: Meta Privacy Policy and WhatsApp Business Platform Cloud API Terms.

10. Service providers, subprocessors and customer integrations

We use a limited number of providers to host, secure, support and operate the service. These may include data-centre or hosting providers, connectivity and DNS providers, email delivery services, payment processors, backup services, security tools, professional advisers and, where enabled, transcription or AI providers.

Where a provider processes personal information for us as an operator, we require appropriate contractual confidentiality, security and processing obligations. We assess the categories of information involved, the location of processing, the provider’s security posture and any further subprocessors where relevant.

We aim to minimise the number of third parties that receive customer content and administer the core BotHub application and databases on infrastructure controlled or administered by Bvelaphanda. Certain infrastructure and supporting services are nevertheless supplied by contracted providers.

A current subprocessor register is available on request from the Information Officer using the contact details in section 1. It identifies the provider, service, data categories and principal processing locations. Where reasonably practicable, we will notify business customers before adding a material subprocessor that will receive customer content.

A business customer may connect BotHub to third-party systems of its choice. The customer is responsible for selecting and authorising those integrations, configuring appropriate permissions, and assessing the third party’s privacy and security practices. We transmit information to those systems only as necessary to perform the configured integration or as otherwise instructed by the customer.

11. Cross-border transfers

Some processing involves transferring personal information outside South Africa. This occurs most notably through Meta and may also occur through email, payment, security, backup, support, transcription, AI or customer-selected integration providers.

Before making or permitting a cross-border transfer for which Bvelaphanda is responsible, we rely on an applicable basis under section 72 of POPIA. Depending on the circumstances, this may include adequate foreign law or binding rules, a binding agreement providing an adequate level of protection, consent, contractual necessity, or another permitted basis. We also consider the nature of the information, the recipient, the processing location and available safeguards.

A business customer remains responsible for evaluating cross-border transfers that arise from its own purposes, instructions or selected integrations. Additional restrictions may apply to children’s information or special personal information.

12. Direct marketing and customer communications

We send electronic direct marketing only where the recipient has consented or where another permitted basis, such as the qualifying existing-customer exception, applies. Every marketing communication identifies the sender and provides a free and straightforward way to stop further marketing. Withdrawing marketing consent does not prevent us from sending necessary account, service, billing, legal or security communications.

Business customers using BotHub for direct marketing are responsible for establishing and recording the lawful basis for each campaign, using approved templates where required, identifying themselves, and promptly honouring objections, withdrawals and opt-outs. BotHub may store consent evidence, suppression records and communication history where configured, but the customer remains responsible for the lawfulness of its campaign and contact list.

We may suspend or restrict campaigns that appear unlawful, deceptive, abusive, inconsistent with platform rules, or likely to harm recipients or the service.

13. Cookies and website analytics

Our website and platform may use essential cookies or similar technologies for authentication, security, session management, preferences and basic operation. These are necessary for the requested service.

If we use non-essential analytics, advertising, embedded-media or tracking technologies, we will provide an appropriate cookie notice and obtain consent where required before activating them. The notice identifies the provider, purpose and duration of each material cookie or technology.

Browser settings may allow you to block or delete cookies, but disabling essential cookies may prevent parts of the website or platform from working correctly.

14. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, a compatible lawful purpose, a contractual requirement, dispute management, security, or a legal retention duty. Retention may also depend on a business customer’s documented instructions and configuration.

• Platform customer data – messages, contacts, media, configuration and workflow records are generally retained while the account is active, subject to any shorter configured retention period. Customers should select a period appropriate to their purpose rather than keeping all conversation history indefinitely.
• Account closure – after termination, customer data is ordinarily kept for a wind-down and export period of 90 days, unless the contract, customer instruction, a legal hold or a verified technical limitation requires a different period. It is then deleted from active production systems or rendered inaccessible.
• Backups and replicas – deleted information may remain in encrypted or access-restricted backups, disaster-recovery copies or system replicas until the applicable rotation cycle expires. It is not restored to ordinary use and will be deleted or overwritten according to the verified backup schedule.
• Billing, tax and corporate records – kept for the periods required by South African tax, company and other applicable laws, generally at least five years where relevant.
• Security, audit and technical logs – ordinarily kept for up to 12 months, unless a longer period is needed to investigate an incident, protect legal rights, meet a contractual requirement or comply with law. Logs may be de-identified where feasible.
• Support records – kept for the period reasonably required to resolve the issue, maintain service history, improve support and manage legal or contractual risk.

A deletion request does not require removal of information that must lawfully be retained. Where full deletion is not immediately possible, we may restrict the information, isolate it from ordinary use, or retain only the minimum record needed to document compliance.

15. How we protect personal information

We apply technical and organisational measures appropriate to the nature and sensitivity of the information and the risks of the processing. Measures may include:

• Secure transmission – encryption of data in transit and authenticated, signature-verified webhooks where supported.
• Tenant isolation – logical separation between business customers using application, access-control and database safeguards designed to prevent one customer from accessing another customer’s data.
• Access control – role-based permissions, least-privilege administration, authentication controls and periodic review of privileged access.
• Operational security – logging, monitoring, patching, vulnerability management, backups, restoration testing, incident-response procedures and secure change management appropriate to the service.
• People and confidentiality – authorised personnel and contractors are subject to confidentiality duties and security responsibilities.

Authorised personnel may access customer information only where reasonably necessary for support, security, incident response, service maintenance, migration, backup restoration, legal compliance or another documented operational purpose. Access is limited, logged where appropriate and reviewed.

No system is completely secure. Business customers remain responsible for protecting their own user accounts, choosing strong authentication, managing permissions, securing connected systems, and informing us promptly of suspected compromise or unauthorised access.

16. Security compromises

Where a security compromise affects personal information for which Bvelaphanda is the responsible party, we will assess and report the compromise to the Information Regulator and notify affected data subjects as required by POPIA, subject to any lawful delay directed by a competent authority.

Where a compromise affects personal information processed by Bvelaphanda as an operator for a business customer, we will notify that customer immediately after becoming aware of the compromise and provide reasonable information and assistance so that the customer can meet its own investigation, reporting and notification duties.

Customers must provide accurate security contacts and cooperate promptly in containment, investigation and notification. Public statements and notices should be coordinated where legally permitted, but this does not prevent either party from meeting an independent legal obligation.

17. Your rights and how to exercise them

Subject to POPIA and any other applicable law, you may have the right to:

• Confirmation and access – ask whether we hold personal information about you and request access to it. Confirmation is provided free of charge; a prescribed fee may apply to copies or records where legally permitted and after notice.
• Correction, deletion or destruction – ask for information to be corrected, updated, deleted or destroyed where it is inaccurate, excessive, out of date, incomplete, misleading, unlawfully obtained or no longer authorised to be retained.
• Objection – object on reasonable grounds to certain processing and object at any time to direct marketing.
• Withdrawal of consent – withdraw consent where processing depends on consent. Withdrawal does not invalidate processing that lawfully occurred before withdrawal.
• Automated decisions – request available information or safeguards where applicable law regulates a solely automated decision that materially affects you.
• Complaint – complain to the Information Regulator if you believe your personal information has been processed unlawfully.

Submit a request to the Information Officer using the contact details in section 1. We may require information reasonably necessary to verify your identity and authority, locate the relevant records and protect the rights of other people. We will not request more verification information than is reasonably necessary.

Where the request concerns information processed for a business customer, we may refer the request to that customer as responsible party and will tell you that we have done so. We will assist the customer as required by our agreement and applicable law.

Access may be limited or refused where permitted by law, including to protect another person’s privacy, confidential commercial information, legal privilege, security or legal obligations. We will explain the outcome and available complaint route where required.

18. When personal information may be disclosed

In addition to the providers and integrations described above, we may disclose personal information where reasonably necessary:

• To comply with law – including a court order, subpoena, regulatory request, statutory duty or lawful investigation.
• To protect people, systems and rights – including fraud prevention, abuse investigation, incident response, debt recovery, legal claims and enforcement of agreements.
• To professional advisers – including lawyers, auditors, accountants, insurers and consultants who are subject to confidentiality duties.
• In a corporate transaction – such as a restructuring, financing, investment, merger, sale of assets or business transfer, subject to appropriate confidentiality and lawful processing safeguards.
• With your instruction or consent – or on the instruction of the responsible business customer, where lawful.

We aim to disclose only the information reasonably necessary for the relevant purpose.

19. Complaints and the Information Regulator

Please contact our Information Officer first so that we can investigate and try to resolve the matter. You may also complain to the Information Regulator (South Africa):

• POPIA complaints email – POPIAComplaints@inforegulator.org.za
• Information Regulator website – inforegulator.org.za
• eServices portal – eservices.inforegulator.org.za
• Telephone – 010 023 5200 or toll-free 0800 017 160

Contact details and complaint procedures may change. The Information Regulator’s current website and forms should be checked before submitting a complaint.

20. Changes to this policy

We may update this policy to reflect changes in law, technology, providers, features or business operations. We will update the effective date and version number, retain prior versions where reasonably available, and notify business customers before a material change takes effect where appropriate. A material change that requires consent will not be applied on the basis of this notice alone.

21. Related documents

This policy should be read together with the applicable customer agreement, BotHub terms of service, operator or data-processing terms, acceptable-use rules, subprocessor register, cookie notice, security documentation and the business customer’s own privacy notice. If there is a conflict, the document that legally governs the specific processing will apply to the extent permitted by law.

Legal reference note

This policy is drafted with reference to the Protection of Personal Information Act 4 of 2013, the applicable POPIA Regulations, and current guidance and contact information published by the Information Regulator. It is a business policy and not a substitute for legal advice. Bvelaphanda should obtain legal review where its processing includes high-risk automated decisions, large-scale special personal information, children’s information, cross-border transfers without clear safeguards, criminal-behaviour information, or cross-customer identity matching.