Privacy Policy

1. Who We Are (Responsible Party / Data Controller)

BCM Transform (Pty) Ltd ("BCM Transform", "we", "us", or "our") is the responsible party for your personal information under the Protection of Personal Information Act (POPIA) and the data controller for purposes of applicable international privacy laws.

• Registered Name: BCM Transform (Pty) Ltd
• South Africa Office: Unit 3, 86 Oak Avenue, Highveld Technopark, Centurion, Gauteng, South Africa
• United States Office: 1200 Libra Dr Suite 103, Lincoln, NE 68512 (in partnership with goIDit)
• Email: privacy@bcmtransform.com
• Phone: +27 12 023 0405
• WhatsApp: +27 72 637 8678

Our designated Privacy Officer can be contacted at privacy@bcmtransform.com.

2. What Personal Information We Collect

We may collect the following categories of personal information:

• Identity Information: Full name, job title, company name
• Contact Information: Email address, phone number, physical address
• Technical Information: IP address, browser type, device type, operating system, referring URL
• Usage Information: Pages visited, time spent on pages, click patterns, scroll depth
• Communication Information: Messages submitted through our contact form, email correspondence

We do not knowingly collect personal information from children under the age of 13 (US) or 16 (South Africa). If we become aware that we have collected data from a child, we will delete it immediately.

3. How We Collect Your Information

• Directly from you: When you fill in our contact form, send us an email, or phone us
• Automatically: Through cookies and similar tracking technologies when you browse our website
• From third parties: Analytics providers and advertising platforms (see Section 7)

4. Why We Collect It (Purpose Specification)

We process your personal information for the following purposes:

• To respond to your enquiries and provide the services you have requested
• To send you information about our services (only with your consent)
• To improve our website, services, and user experience
• To comply with legal obligations
• To protect our legitimate business interests

We will not use your information for any purpose beyond what is described here without obtaining your further consent.

5. Legal Basis for Processing

Under POPIA (South Africa):

• Your consent (Section 11(1)(a))
• Compliance with a legal obligation (Section 11(1)(c))
• Legitimate interest of the responsible party (Section 11(1)(f))

Under CCPA/CPRA (United States — California):

We process personal information for the business purposes described in Section 4. We do not sell or share your personal information as defined by the CCPA/CPRA.

Under PIPEDA (Canada):

We rely on your express or implied consent, depending on the sensitivity of the information and the context. You may withdraw your consent at any time.

6. How Long We Keep Your Data (Retention)

• Contact form submissions: 24 months from date of submission
• Email correspondence: Duration of the business relationship plus 12 months
• Analytics data: 26 months (anonymised)
• Cookie data: See our Cookie Policy for specific retention periods

After the retention period, data is securely deleted or anonymised.

7. Third-Party Service Providers

We may share your information with the following categories of third parties, solely to provide our services:

• Hosting: Cloud infrastructure providers
• Analytics: Website analytics tools to understand site usage
• Communication: Email service providers for responding to enquiries

We require all third parties to respect the security of your data and to treat it in accordance with applicable law. We do not sell, rent, or trade your personal information to third parties for marketing purposes.

8. Cross-Border Data Transfers

As we operate in South Africa and the United States, your personal information may be transferred across borders. Where this occurs, we ensure appropriate safeguards are in place, including contractual data protection agreements that meet the requirements of POPIA Section 72 and equivalent international standards.

9. Your Rights

All Visitors:

• Right to know what personal information we hold about you
• Right to request correction of inaccurate information
• Right to request deletion of your personal information
• Right to object to processing
• Right to withdraw consent at any time

South African Residents (POPIA):

• Right to access your personal information (Section 23)
• Right to request correction or deletion (Section 24)
• Right to object to processing (Section 11(3))
• Right to lodge a complaint with the Information Regulator South Africa: inforegulator.org.za

California Residents (CCPA/CPRA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information
• Right to non-discrimination for exercising your rights

Do Not Sell or Share My Personal Information: We do not sell or share your personal information as defined by the CCPA/CPRA. If this changes, we will provide an opt-out mechanism.

Canadian Residents (PIPEDA / Quebec Law 25):

• Right to access your personal information
• Right to request correction
• Right to withdraw consent
• Right to file a complaint with the Privacy Commissioner of Canada

We do not currently use automated decision-making that produces legal or significant effects on individuals. If this changes, we will update this policy and provide appropriate disclosures as required by Quebec Law 25.

10. How to Exercise Your Rights

To make a privacy request, contact us at privacy@bcmtransform.com or use our Contact Page.

We will respond within:

• POPIA: 30 days
• CCPA/CPRA: 45 days (with possible 45-day extension)
• PIPEDA: 30 days

We may need to verify your identity before processing your request.

11. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. For full details on what cookies we use, why, and how to manage them, please see our Cookie Policy.

12. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments.

In the event of a data breach that poses a risk to your rights, we will notify the relevant regulatory authority and affected individuals in accordance with POPIA, PIPEDA, and applicable US state laws.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post a notice on our website and update the effective date at the top of this page. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights:

• Privacy Officer Email: privacy@bcmtransform.com
• General Contact: hello@bcmtransform.com
• Phone: +27 12 023 0405
• WhatsApp: +27 72 637 8678
• Address: Unit 3, 86 Oak Avenue, Highveld Technopark, Centurion, Gauteng, South Africa