Privacy Policy

01 Who We Are

McSbuSing (Pty) Ltd ("McSbuSing", "we", "us", or "our") is the responsible party for personal information collected through this website and in the course of our business operations, as defined under the Protection of Personal Information Act, 2013 (POPIA).

We are registered with the Information Regulator of South Africa under registration number 2026-001032. Our Information Officer registration certificate is publicly available.

We are committed to processing personal information lawfully, transparently, and in accordance with POPIA and other applicable South African legislation.

02 Information We Collect

We collect personal information in the following contexts:

We do not collect sensitive personal information (such as biometric data, health information, or race/ethnicity) unless specifically required for a project and with your explicit consent.

03 How We Use Your Information

We use your personal information for the following purposes:

• Scheduling and confirming discovery sessions and meetings
• Responding to enquiries and providing quotes or proposals
• Delivering contracted software development services
• Sending invoices and processing payments
• Communicating project updates, milestones, and support
• Sending service-related announcements (e.g. scheduled maintenance)
• Improving our website and services through aggregate analytics
• Complying with legal and regulatory obligations

04 Legal Basis for Processing

Under POPIA, we process your personal information on the following grounds:

• Consent: When you submit a form or book a session, you consent to us processing your information to respond to your request.
• Contractual necessity: When you engage us for services, processing is necessary to fulfil the contract.
• Legitimate interest: For analytics and service improvement, where our legitimate business interest does not override your rights.
• Legal obligation: Where processing is required to comply with South African law (e.g. tax records, FICA).

05 Information Sharing

We do not share your personal information except in the following limited circumstances:

• Service providers: Third-party tools necessary to deliver our services (e.g. Google Workspace for email and calendar, cloud hosting providers). These providers act as operators under POPIA and are bound by data processing agreements.
• Legal requirements: Where disclosure is required by law, court order, or regulatory authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity.

All third-party service providers are required to maintain appropriate security and process personal information only as instructed.

06 Data Retention

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law:

• Discovery session bookings: 12 months from the date of the session, unless a project engagement follows.
• Client project records: 5 years after project completion (required for tax and legal compliance).
• General enquiries: 24 months from the date of last contact.
• Website analytics: Aggregated and anonymised; no retention limit on aggregate data.

When retention periods expire, personal information is securely deleted or anonymised.

07 Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction, including:

• HTTPS/TLS encryption for all data transmitted to and from this website
• Hashed tokens for appointment management workflows
• Access controls limiting who can access personal data internally
• Secure credential management (credentials are not stored in version control)

No method of electronic transmission or storage is 100% secure. In the event of a data breach that is likely to prejudice your rights, we will notify the Information Regulator and affected individuals as required by POPIA.

08 Your Rights

Under POPIA, you have the following rights regarding your personal information:

To exercise any of these rights, contact us at hello@mcsbusing.co.za. We will respond within 30 days.

You may also contact the Information Regulator (South Africa):
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za

09 Cookies

This website may use cookies and similar tracking technologies. Cookies are small text files stored on your device that help us understand how you use the site.

• Essential cookies: Required for the website to function (e.g. form session state). Cannot be disabled.
• Analytics cookies: Help us understand visitor behaviour in aggregate. You may opt out by adjusting your browser settings.

We do not use advertising or tracking cookies. You can control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use this website.

10 Third-Party Services

This website integrates with the following third-party services. Each has its own privacy policy:

• Google Workspace (email, calendar, Google Meet) — Google Privacy Policy
• Google Fonts — font files loaded from Google's servers, which may log your IP address
• Font Awesome (CDN) — icon assets served from a CDN

We are not responsible for the privacy practices of third-party services. We encourage you to review their policies.

11 Children's Privacy

Our website and services are intended for business use by individuals aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a minor has submitted information to us, please contact us immediately and we will delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The revised version will be published on this page with an updated effective date.

We encourage you to review this policy periodically. For material changes, we will notify active clients by email.

13 Contact & Complaints

For privacy-related enquiries, requests to exercise your rights, or to report a concern: