Privacy Policy

1. Introduction

Budify (Pty) Ltd ("Budify", "we", "us", or "our") is committed to protecting the privacy and personal information of our clients, their staff, and end-users. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information in connection with the Budify POS and club management platform ("the Platform").

This Policy applies to all users of the Platform, including cannabis club operators, dispensary staff, and private member club administrators operating within the Republic of South Africa. By accessing or using the Platform, you agree to the terms of this Privacy Policy.

2. Applicable Legislation

This Policy is governed by and complies with the following South African legislation:

•Protection of Personal Information Act, 4 of 2013 (POPIA)

•Electronic Communications and Transactions Act, 25 of 2002 (ECTA)

•Consumer Protection Act, 68 of 2008 (CPA)

Budify acts as both a Responsible Party and, in certain cases, an Operator as defined under POPIA, depending on the context in which personal information is processed.

3. Information We Collect

We collect the following categories of personal information:

3.1 Business Operator Information

•Full name, identity number, and contact details of the business owner or authorised representative

•Business registration details, VAT number, and banking information for billing purposes

•Login credentials (username and hashed password)

3.2 Staff Information

•Name, surname, contact number, and email address of staff members added to the Platform

•Role and access permissions assigned within the system

•Login activity logs and session data

3.3 Member / Customer Information

•Full name, ID number or passport number of club members

•Contact details including phone number and email address

•Membership tier, join date, and renewal status

•QR code identifiers linked to membership cards

•Purchase history and transaction records processed through the POS

3.4 Technical & Usage Data

•IP addresses, browser type, and device identifiers

•Log data including pages visited, features used, and session duration

•Cookies and similar tracking technologies for platform functionality

4. Purpose of Processing

Budify processes personal information for the following lawful purposes:

•To provide, operate, and maintain the Platform and its features

•To process payments, manage subscriptions, and issue invoices

•To manage cannabis club memberships, QR codes, and entry validation

•To enable POS transactions, inventory management, and sales reporting

•To communicate important service updates, security alerts, and system notifications

•To comply with applicable South African laws, regulations, and lawful requests from authorities

•To improve the Platform through aggregated, anonymised usage analytics

•To respond to support requests, queries, and complaints

•To verify the identity of users and prevent fraudulent or unauthorised access

5. Sharing of Personal Information

We do not sell, rent, or trade personal information to third parties for marketing purposes. We may share personal information with:

5.1 Service Providers

Third-party vendors who assist in operating the Platform (e.g., cloud hosting providers, payment processors, email service providers). All operators are contractually bound to process data only as instructed by Budify and in compliance with POPIA.

5.2 Legal & Regulatory Authorities

Where required by law, court order, or lawful instruction from a government authority or regulatory body, we may disclose personal information.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Budify's assets, personal information may be transferred to the acquiring entity, subject to equivalent privacy protections.

5.4 With Your Consent

We may share information with third parties where you have provided explicit consent to do so.

6. Data Security

Budify implements industry-standard technical and organisational measures to protect personal information against unauthorised access, loss, destruction, or disclosure. These measures include:

•Encrypted data transmission using TLS/SSL protocols

•Password hashing using bcrypt or equivalent algorithms

•Role-based access controls limiting staff access to necessary data only

•Regular security audits and vulnerability assessments

•Secure cloud infrastructure hosted within compliant data centres

Notwithstanding these measures, no method of transmission over the internet is 100% secure. In the event of a data breach affecting your rights and interests, Budify will notify affected parties and the Information Regulator as required under POPIA.

7. Retention of Personal Information

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specifically:

•Active account data is retained for the duration of the subscription

•Transaction and financial records are retained for a minimum of 5 years in accordance with tax and financial reporting obligations

•Member records are retained as directed by the cannabis club operator (Responsible Party)

•Upon account termination, personal data is anonymised or securely deleted within 90 days, unless a longer retention period is required by law

You may request the deletion of your personal information at any time (subject to legal retention obligations) by contacting us as set out in Section 11.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

•**Right to Access** — Request confirmation of whether we hold your personal information and obtain a copy thereof

•**Right to Correction** — Request correction of inaccurate, incomplete, or outdated personal information

•**Right to Deletion** — Request the deletion or destruction of personal information where it is no longer necessary or lawfully retained

•**Right to Object** — Object to the processing of your personal information in certain circumstances

•**Right to Lodge a Complaint** — Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated

•**Right to Data Portability** — Request your personal data in a structured, commonly used format

To exercise any of these rights, please contact our Information Officer using the details in Section 11.

9. Cookies & Tracking Technologies

The Platform uses cookies and similar technologies to:

•Maintain your login session and authentication state

•Remember your platform preferences and settings

•Collect anonymised analytics data to improve platform performance

•Ensure security and detect fraudulent activity

You may disable cookies through your browser settings; however, this may affect the functionality of certain Platform features. We do not use cookies for cross-site advertising or third-party tracking purposes.

10. Third-Party Links

The Platform may contain links to third-party websites or integrations (e.g., payment gateways, WhatsApp, social media). Budify is not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform.

11. Contact & Information Officer

For any privacy-related queries, requests, or complaints, please contact Budify's Information Officer:

Budify (Pty) Ltd

Information Officer: Budify Compliance Team

Email: privacy@budify.co.za

WhatsApp: +27 61 423 2317

Website: https://budify.co.za

You also have the right to lodge a complaint directly with the Information Regulator of South Africa:

Website: https://www.justice.gov.za/inforeg/

Email: inforeg@justice.gov.za

12. Amendments to This Policy

Budify reserves the right to update or amend this Privacy Policy at any time. Changes will be communicated via the Platform or by email to registered account holders. Your continued use of the Platform after notification of changes constitutes acceptance of the updated Policy. The effective date of the current version is indicated below.