Privacy policy.

1. Who we are, and who is responsible for what

Magu Business Consultants (Pty) Ltd ("Magu", "we", "us"), registration number 2023/889153/07, is a company registered in South Africa. Our information officer is at compliance@magubusiness.co.za. This policy is written in line with South Africa's Protection of Personal Information Act (POPIA).

There are two roles, and it helps to know which applies:

• Magu is the responsible party for information about the people who use our site and buy from us: visitors, account holders, customers, partners and subscribers.
• A business is the responsible party for the information it puts into its own workspace about its employees, clients and others: names, contact details, invoices, payslips, files, messages and so on. Magu is the operator. We store and process that information on the business's behalf, only to run the platform for it, and we follow the business's instructions. If you are an employee or client of a business and want to see, correct or delete what it holds about you, please ask the business first.

2. What we collect

What you give us:

• Your name and email address, and a phone number if you choose to give one.
• Your account login details.
• Your orders and payment history for plans, packages, services, domains and guides.
• Registrant (WHOIS) details for any domain you register through us.
• Messages you send through the chat or enquiry form, including the service, business name, project needs, timeline, budget range, preferred contact method and page you came from.
• Your name and email if you subscribe to our newsletter.
• If you are a Partners Connect partner: your name, email and phone number, your date of birth and gender (you can choose "prefer not to say"), and the South African bank account details you give us for payouts (account holder, bank, branch code, account type and account number). We never ask for card details.
• If you connect to a partner: the partner's PR code or link you used, and when you connected.

What a business and its people put into a workspace:

• The business: its name, logo, registration and tax details, address, contact details, social links, the email settings it connects to send messages from its own address, its clients, quotes, invoices, documents, files, tasks, schedule, costs and stock.
• Its employees: the employee's name, picture, role, job title, department, employee number and the date they joined. The employee can add a phone number, where they live (city, province, country), a short description of themselves, and an emergency contact (name, relationship and phone number). The business can record payslips and payroll figures for them.
• A business listing: if the owner or an admin switches on the Business finder, the headline, description, categories, offerings, location, website, logo, and the email and phone number they choose to show, are visible to other businesses on Magu. Enquiries from other businesses are delivered to the inbox of the owner and admins.
• Messages: the updates owners and admins send through the inbox, who they were sent to, and whether each person has read them.
• The AI coach: what a person types to the coach and its replies, so the conversation can continue.

What we collect automatically, when website analytics is on: page visits, clicks, form submission events, JavaScript errors and request status codes. Form contents are never included. We don't ask for sensitive personal information (such as health, biometric, religious or political data). A business should not record it in Magu unless it has a lawful reason to.

3. Why we use it

We use information to deliver the plans and services you've paid for, run your account and workspace, register and manage your domains, unlock your guides, run the Partners Connect Programme (connecting you to a partner, working out and paying commission), reply to your messages, send the emails you've subscribed to or that the platform needs to send (such as sign-in, invitations and invoices), find and fix problems, keep the platform secure, and meet our legal, tax and accounting duties.

Our legal grounds are: it is necessary to perform our contract with you; you have given consent (for example subscribing to the newsletter); or we have a legitimate interest in running the business and preventing fraud and abuse. For information inside a workspace, the business is responsible for having its own lawful reason.

4. Who can see what inside a workspace

• Employees see their own details, the parts of the workspace their role allows, and the updates sent to them.
• Owners and admins can see the people in the workspace, their roles, departments and employee numbers, and can reset logins and remove people. Only you and your business owner or admins can see your emergency contact.
• Other employees can see names and roles in the team list when their role includes the team.
• Magu staff don't read a business's workspace as part of normal work. We may access it where needed to give support you ask for, keep the platform secure, or meet the law.

5. Who we share it with

We only share information with the providers we need to run Magu, and only for that purpose:

• Payments: Paystack processes payments.
• Payouts: Paystack also receives a partner's bank details so it can send their commission payout.
• Domains: our domain registrar and the relevant registry (for example ZADNA for .co.za) receive what's needed to register and manage your domain.
• Storage and hosting: a cloud database provider and a file storage provider keep your account and workspace information, including uploaded files.
• Email: an email delivery provider sends our emails. If a business connects its own email account, messages it asks us to send go out through that account.
• AI coach: an AI provider receives what is typed to the coach so it can reply.
• Analytics: a website analytics provider, when switched on, helps us find and fix problems.

Each is bound by its own security and processing terms. We don't share information with anyone else, except where the law requires it.

6. Partners Connect Programme

Partners Connect is our referral programme. This is how it uses personal information:

• If you connect to a partner: we record which partner you are connected to and when, so the right partner is credited. The partner can see your display name and the commission earned on your purchases. They can't see your email address, password or any other personal information. If you came through a partner's link, your browser's local storage remembers the code until you create your account.
• If you are a partner: we keep your name, email, phone number, date of birth, gender, PR code, link ending, the commission you have earned and been paid, and the bank details you give us. Your bank details are visible only to you (with all but the last four digits hidden), and to the Magu admin team who process payouts. When you request a payout, we copy your bank details onto that request and send them to Paystack to make the transfer. We send you emails about your payout requests.
• Why we ask for your date of birth and gender: to confirm that partners are 18 or older, and to understand who our partners are (for example the ages and gender mix of the programme). Only you and the Magu admin team can see them. We don't show them to the people connected to you, and we don't use them to decide your commission.
• We never sell this information, and we never ask for card details in the programme.

7. Analytics, cookies and local storage

When analytics is on, our analytics provider records selected interactions and technical events, and we keep simple activity counts (visits, clicks, form attempts, error types and failed-request codes) for our admin team. These use random browser identifiers, only the past seven days are shown, and private pages (account, checkout, workspace and admin) are left out.

Your browser's local storage is used to keep you signed in, to remember which workspace you are in, to remember a name you gave the chat so we don't ask twice, and to save your display preferences such as your home page background. It stays on your device until you clear it.

8. How long we keep it

For as long as your account, workspace or subscription is active, and for as long as the law requires, such as financial records for tax (including commission and payout records) or WHOIS data a registry makes us keep. A partner's bank details are kept while they are a partner, and removed when they stop unless we must keep them for the law.

When an owner deletes a workspace, what is inside it, including the information of the people in it, is permanently removed. When a person is removed from a workspace, their access ends. If you close your account (by emailing myfolder@magubusiness.co.za) or unsubscribe, we delete or anonymise what we no longer have a legal reason to keep. Businesses are responsible for how long they keep their employees' and clients' information.

9. Your rights

Under POPIA you can ask to access, correct or delete the personal information held about you. For what Magu holds as the responsible party, email compliance@magubusiness.co.za. We'll respond within a reasonable time, subject to what we're legally required to keep. For what a business holds about you in its workspace, ask the business. You can also correct your own details yourself under Account settings. You can unsubscribe from any newsletter or campaign email using the link inside it, object to processing based on our legitimate interest, or complain to the Information Regulator of South Africa if you think your information has been handled wrongly.

10. Children

This site and the platform aren't for anyone under 18, and we don't knowingly collect their information. If you think a child has given us personal information, contact us and we'll remove it.

11. Security

We take reasonable technical and organisational steps to protect information. Access to a workspace is controlled by sign-in and by each person's role, and the business code adds a further check when people connect. We rely on our storage and payment providers' own security standards. No method of storage or transmission is completely secure, so we can't guarantee absolute security. Tell us straight away at security@magubusiness.co.za if you think an account has been used by someone else.

12. Changes

We may update this policy as the site and our services change. The date at the top shows the latest version, and continuing to use the site after an update means you accept it.

Questions or requests about your personal information: compliance@magubusiness.co.za
Closing your account: myfolder@magubusiness.co.za
Account security concerns: security@magubusiness.co.za
See also our terms & conditions.