Privacy Policy

01 Who We Are

McSbuSing (Pty) Ltd ("McSbuSing", "we", "us", or "our") is the responsible party for personal information collected through this website and in the course of our business operations, as defined under the Protection of Personal Information Act, 2013 (POPIA).

We are registered with the Information Regulator of South Africa under registration number 2026-001032. Our Information Officer registration certificate is publicly available.

We are committed to processing personal information lawfully, transparently, and in accordance with POPIA and other applicable South African legislation.

02 Information We Collect

We collect personal information in the following contexts:

We do not collect sensitive personal information (such as biometric data, health information, or race/ethnicity) unless specifically required for a project and with your explicit consent.

03 How We Use Your Information

We use your personal information for the following purposes:

• Scheduling and confirming discovery sessions and meetings
• Responding to enquiries and providing quotes or proposals
• Selecting participants for product focus groups you apply to, and contacting you about the outcome
• Delivering contracted software development services
• Preparing timesheets, quotations and invoices, and processing payments
• Giving your team secure access to your timesheets, invoices, quotations and account balance through our client portal
• Communicating project updates, milestones, and support
• Protecting our systems against spam, fraud and unauthorised access (for example with reCAPTCHA and sign-in logs)
• Improving our website and services through aggregate analytics
• Complying with legal and regulatory obligations

04 Legal Basis for Processing

Under POPIA, we process your personal information on the following grounds:

• Consent: When you submit a form or book a session, you consent to us processing your information to respond to your request.
• Contractual necessity: When you engage us for services, processing is necessary to fulfil the contract.
• Legitimate interest: For analytics and service improvement, where our legitimate business interest does not override your rights.
• Legal obligation: Where processing is required to comply with South African law (e.g. tax records, FICA).

05 Information Sharing

We do not share your personal information except in the following limited circumstances:

• Service providers: Third-party tools necessary to deliver our services (e.g. Google Workspace for email and calendar, cloud hosting providers). These providers act as operators under POPIA and are bound by data processing agreements.
• Legal requirements: Where disclosure is required by law, court order, or regulatory authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity.

All third-party service providers are required to maintain appropriate security and process personal information only as instructed.

06 Data Retention

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law:

• Discovery session bookings: 12 months from the date of the session, unless a project engagement follows.
• Focus group applications: 12 months after the focus group closes.
• Client project and billing records (quotations, invoices, timesheets): 5 years after project completion, as required for tax and legal compliance.
• Client portal accounts: for as long as your organisation is our client; removed on request or when the engagement ends.
• Security logs: 12 months.
• General enquiries: 24 months from the date of last contact.
• Website analytics: according to Google Analytics' retention settings; we only use aggregated reports.

When retention periods expire, personal information is securely deleted or anonymised.

07 Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction, including:

• Encryption in transit: HTTPS/TLS for all data sent to and from this website and our client portal.
• Encryption at rest: personal information we store — names, email addresses, phone numbers, addresses, booking details, focus group answers and the IP addresses in our security logs — is encrypted in our database using AES-256. The encryption keys are kept separately from the database, so a copy of the database alone does not reveal this information.
• Searchable without exposure: where we need to look up a record by email address (for example to sign you in), we use a keyed one-way fingerprint of the address rather than storing it in readable form.
• Passwords: client portal and staff passwords are stored only as one-way hashes and can never be read back, including by us.
• Access controls: staff access is limited by role; client portal users see only their own organisation's documents, and sign-in attempts are rate-limited.
• Hashed tokens for appointment management links, and secure credential management (credentials are not stored in version control).

No method of electronic transmission or storage is 100% secure. In the event of a data breach that is likely to prejudice your rights, we will notify the Information Regulator and affected individuals as required by POPIA.

08 Your Rights

Under POPIA, you have the following rights regarding your personal information:

To exercise any of these rights, contact us at hello@mcsbusing.co.za. We will respond within 30 days.

You may also contact the Information Regulator (South Africa):
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za

09 Cookies

This website uses cookies. Cookies are small text files stored on your device.

• Essential cookies: keep forms secure (a security token) and keep you signed in to the client portal (a session cookie). The website and portal cannot work without them.
• Security cookies: Google reCAPTCHA sets cookies to tell people and automated spam apart on our booking and contact forms.
• Analytics cookies: Google Analytics helps us understand, in aggregate, how visitors use the site. You may block these through your browser settings without affecting the website.

We do not use advertising cookies. You can control cookies through your browser settings.

10 Third-Party Services

This website integrates with the following third-party services. Each has its own privacy policy:

• Google Workspace (email, calendar, Google Meet) — booking details are added to our calendar to schedule your session. Google Privacy Policy
• Google Analytics — website usage statistics.
• Google reCAPTCHA — spam and abuse protection on our forms; your use of reCAPTCHA is subject to Google's Privacy Policy and Terms.
• Google Fonts — font files loaded from Google's servers, which may log your IP address.
• Font Awesome (CDN) — icon assets served from a content delivery network.

We are not responsible for the privacy practices of third-party services. We encourage you to review their policies.

11 Children's Privacy

Our website and services are intended for business use by individuals aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a minor has submitted information to us, please contact us immediately and we will delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The revised version will be published on this page with an updated effective date.

We encourage you to review this policy periodically. For material changes, we will notify active clients by email.

13 Contact & Complaints

For privacy-related enquiries, requests to exercise your rights, or to report a concern: