Your information.
Your rights.
This notice explains what personal information Butha collects, why it is needed, how it is used and shared, how it is protected, and the choices and rights available to you.
1. Who is responsible
Qubitron (Pty) Ltd, trading through Butha, determines why and how personal information is processed and is the responsible party under the Protection of Personal Information Act 4 of 2013, commonly called POPIA.
Privacy and Information Officer contact: Allan Kote, Director
Email: info@qubitron.co.za
Telephone: 083 382 3971
Address: 14 Stewart Drive, Berea, East London, 5241, South Africa
Please use the subject “Butha privacy request” and do not email passwords, identity numbers, bank information or copies of identity documents.
2. What we collect
| Category | Examples | How obtained |
|---|---|---|
| Identity and account | Authentication user identifier, verified email address, display name, sign-in provider, session and notice acknowledgement. | From you and the sign-in provider you choose, such as Google, Facebook or Supabase email verification. |
| Individual application | Preferred name, qualification route, occupation or professional context, application statement and, if selected, a self-declared income bracket. | Directly from you. |
| Business application | Trading name, participation role, industry, authorised representative, optional registration or trading reference, supplier base, credentials and application statement. | Directly from the business representative. |
| Marketplace content | Business profile, logo, listing details and images, service areas, pricing, saved offers, follows, reactions, ratings and moderated written reviews. | From participants and their use of Butha. |
| Communication and service records | Enquiries, messages, alerts, support requests, reports, administrator responses and optional email-alert preference. | Created when you communicate or request support. |
| Pilot commercial records | Sandbox quotations, fictional orders, progress events and test subscription status. No real card or bank details are collected. | Created when participants test the pilot workflow. |
| Technical and security data | Authentication cookies, request and security logs, timestamps, record versions, image size and dimensions, and theme preference stored in your browser. | Generated through secure operation of the service and your browser choices. |
Butha does not currently request identity documents, bank statements, card details, exact residential addresses, biometric data, health information or criminal records. Do not place this information in free-text fields, messages or images.
3. Why we process information
| Purpose | Information used | Justification |
|---|---|---|
| Create and secure your account | Sign-in identity, email, display name, session and security data. | To provide the service you request, protect legitimate interests and maintain platform security. |
| Review membership and business participation | Application information, declarations, decision history and administrator reasons. | To take steps at your request, operate a selective marketplace and protect the legitimate interests of Butha and its participants. |
| Publish approved business offers | Approved business profile, logo, listings, images, areas and pricing. | To provide the marketplace service requested by the supplier. |
| Connect buyers and suppliers | Buyer display or approved business name, buying context, enquiry, messages and workflow records. | To facilitate the enquiry or transaction requested by the participants. |
| Provide reactions, ratings and privacy-protected insights | Reactions, ratings and optional application-category consent. | Core engagement is part of the service. Category analysis is included only when you make the separate optional choice. |
| Measure and improve the pilot | De-identified or aggregated usage, feedback, performance and reliability information. | To understand how the pilot is used, correct problems and improve Butha without using identifiable application or message content for unrelated analytics. |
| Moderate, prevent abuse and resolve disputes | Reports, relevant content, audit events and security records. | To comply with legal duties and protect the legitimate interests and rights of participants. |
| Send account alerts | Email address and alert preference. | In-app alerts are part of the service. Generic email alerts are optional and can be switched off. They are not marketing consent. |
| Meet legal obligations | Records reasonably required for lawful requests, complaints, tax, accounting, security or dispute handling. | Compliance with law and protection of legitimate interests. |
Where consent is used, it must be voluntary, specific and informed. You may withdraw it for future processing. Withdrawal does not make earlier lawful processing invalid. Some information is necessary to create an account, assess an application or provide a requested service. If required information is not supplied, Butha may be unable to provide that part of the service.
4. Who can see what
- You: your account, applications, decisions, saved offers, enquiries, alerts, support requests and other records made available in your workspace.
- Authorised Butha administrator: account and application information required for manual review, moderation, support, privacy requests and security. Administrator status alone does not provide access to private participant conversations.
- Approved marketplace participants: approved supplier business profiles and listings. These are not intended for unrestricted public publication.
- A supplier you contact: your personal display name or approved business name, buying context and messages. The supplier does not receive your email address, income bracket, application statement or residential information through the enquiry.
- A business you follow: your display name, follow date and limited aggregate member reputation. It does not receive your email address or private application information.
- Written-review readers: published review text, rating and buying context after moderation. Your account name is not published with the review.
- Operators and service providers: only the information needed to provide contracted or configured services, subject to their service terms and appropriate safeguards.
- Authorities or advisers: information may be disclosed where lawfully required or reasonably necessary to establish, exercise or defend legal rights.
We do not give businesses a directory of application details, income brackets or email addresses, and we do not sell personal information.
5. Service providers and transfers outside South Africa
Butha currently relies on the following operators or technology services:
- Supabase: authentication, verified email identity and session management. The project is configured in the European Union region identified as eu-west-1.
- Cloudflare: website delivery, server processing, D1 database and private R2 image storage. Cloudflare operates a global network and processing may occur outside South Africa.
- Google or Facebook: only when you choose that provider for sign-in. Their own privacy terms also apply to their processing.
- Resend: configured for generic email alerts if Butha enables delivery and you opt in. Private application and message content is not included in those emails.
Personal information may therefore be processed outside South Africa. Qubitron must use a permitted section 72 basis and appropriate contractual, organisational or legal safeguards for those transfers. Provider locations and subprocessors may change. Material changes will be reflected in this notice.
6. How long we keep information
We keep personal information only for as long as needed for the stated purpose, a related legal or dispute requirement, or a valid audit and security need. During the pilot, lifecycle actions are reviewed and carried out manually.
| Record | Current pilot retention criterion |
|---|---|
| Account and active approvals | While the account participates in Butha, then reviewed for deletion or de-identification after closure, subject to records that must be retained. |
| Draft, declined or inactive applications | Reviewed after 12 months without activity. A shorter period may apply after a valid deletion request. |
| Enquiries, messages, moderation, audit and sandbox commercial records | Up to three years after closure or last activity, unless a dispute, security investigation or legal duty requires longer. |
| Support and privacy requests | Up to three years after closure to demonstrate how the request was handled. |
| Email delivery records | Reviewed after 12 months, excluding records needed to honour suppression or opt-out choices. |
| Images | While connected to an active or reviewable business record, then removed when no longer needed, subject to moderation or legal holds. |
Deletion from active systems may not immediately remove provider backups. Backup copies are isolated from ordinary use and expire according to provider recovery cycles. We may retain a restricted record where law requires it, where needed for a dispute or security matter, or where deletion would impair another person’s lawful record. We will explain any applicable exception.
7. How we protect information
Butha uses layered safeguards appropriate to the pilot, including HTTPS connections, server-verified authentication, role and record-level access checks, private image storage, controlled publication, input and file validation, removal of image metadata, versioned administrative decisions, limited response caching and restricted administrator functions.
No online service can guarantee absolute security. If Qubitron has reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, it will follow the notification duties in section 22 of POPIA, including notification to the Information Regulator and affected data subjects as required.
Help keep your account safe
Butha does not receive or store the password for your Google, Facebook or email account. Protect that account, use multi-factor authentication where available, never share a sign-in code, sign out on shared devices and tell us promptly if you notice unfamiliar Butha activity. Butha will never ask you to send a password or sign-in code by email or through Help & feedback.
8. Your choices and rights
Subject to POPIA and any lawful limitations, you may:
- ask whether Butha holds personal information about you and request access to it;
- ask for a description of the personal information held and, where POPIA permits, the identity or categories of third parties who have had access to it;
- ask for inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information to be corrected or deleted;
- object to processing where POPIA permits and ask for processing to be restricted while a request is considered;
- withdraw optional consent, including application-category insight consent and optional email alerts;
- ask for your account to be closed and information deleted or de-identified, subject to lawful retention and other participants’ records;
- complain to Qubitron and, if unresolved, lodge a complaint with the Information Regulator.
To protect your information, we may ask you to authenticate through your Butha account or provide proportionate information before acting on a request. We will not ask for your password. We will acknowledge the request, assess any legal limitations and explain the outcome.
9. Children, marketing, analytics and automated decisions
Butha is intended for adults aged 18 or older and does not knowingly collect children’s personal information. Contact us if you believe a child has supplied information.
Butha does not currently use personal information for unsolicited electronic direct marketing. Optional generic account-alert emails are service notifications, not marketing. Any future electronic direct marketing will require a separate lawful process and an easy opt-out.
Butha may use de-identified or aggregated pilot information to measure usage, diagnose problems and improve the service. Qubitron will not attempt to identify a person from de-identified information. Identifiable application statements and private messages are not used for unrelated product analytics.
Membership and business applications are reviewed by a human administrator. Butha does not currently use artificial intelligence to rank, approve or decline applications, recommend suppliers or make decisions that have legal or substantial effects. Reactions, ratings and aggregates do not prove wealth, creditworthiness, identity or purchasing capacity. This notice will be updated before artificial intelligence is introduced into a material participant-facing process.
10. Cookies, browser storage and external links
Butha uses strictly necessary authentication cookies to keep you signed in and protect account actions. A theme preference may be stored in your browser so that light, dark or system appearance persists. The current pilot does not use advertising cookies or third-party behavioural advertising. Sign-in providers may set their own cookies when you use their services.
Butha may link to a supplier’s website or another external service. Those services control their own processing and privacy notices. Review their terms before giving them personal information. Qubitron remains responsible for processing performed by Butha and its appointed operators.
11. Questions and complaints
Contact Qubitron first at info@qubitron.co.za or through Butha Help & feedback. If you believe your personal information has been processed contrary to POPIA, you may lodge a complaint through the Information Regulator’s eServices portal.
Information Regulator South Africa
Complaint guidance and eServices
Email: enquiries@inforegulator.org.za
Telephone: 010 023 5200
See the official Protection of Personal Information Act 4 of 2013.
12. Changes to this notice
We will update this notice when Butha changes what it collects, why it uses information, its service providers, sharing, retention or participant rights. The current version and effective date appear at the top. Material changes will be presented in Butha for acknowledgement. Recording an acknowledgement confirms that the notice was presented; it does not waive your rights or create consent for optional processing.