Privacy Policy

That Business Thing is a South African business directory platform operating at thatbusinessthing.co.za. We are the responsible party for personal information collected through this platform.

If you have any questions, concerns or requests regarding this Policy or your personal information, please reach out to us via our Contact page.

We may collect and process the following categories of personal information:

When you create an account:

• Full name
• Email address
• Phone number
• Password (stored in encrypted form — we never store plain-text passwords)

When you list a business:

• Business name, description and category
• Business address (province, city, suburb)
• Contact details including phone number, WhatsApp number and social media handles
• Business images
• Operating hours and methods

When you browse or interact with the platform:

• Businesses you have saved to your Favourites
• Search queries and filter preferences
• IP address and browser or device information

When you make a payment:

• Transaction reference numbers and payment confirmation data
• We do not store your card numbers or banking details — all payments are processed securely by our third-party payment providers (PayFast and Paystack)

We process your personal information only for specific, defined and lawful purposes, including:

• To create and manage your account
• To allow you to list, publish and manage business profiles on our platform
• To process payments for listing plans
• To enable users to search for and connect with businesses
• To provide and improve our services
• To send transactional communications such as account confirmations, password resets and payment receipts
• To send promotional or marketing communications where you have opted in (you may opt out at any time)
• To detect, prevent and address fraud, abuse or security issues
• To comply with applicable South African law

Under POPIA, we process your personal information on the following lawful grounds:

• Contractual necessity — processing is required to perform our agreement with you (e.g., creating your account or publishing your listing)
• Legitimate interests — processing is necessary for our legitimate business interests, balanced against your rights (e.g., fraud prevention, platform security)
• Consent — where we ask for your consent (e.g., for marketing emails), and you may withdraw consent at any time
• Legal obligation — where processing is required to comply with a law or court order

We take reasonable technical and organisational measures to protect your personal information. These include:

• Encrypted passwords using industry-standard hashing
• HTTPS encryption for all data transmitted between your browser and our servers
• Session tokens stored in HTTP-only cookies to prevent client-side script access
• Access controls limiting who can access personal data

While we implement these safeguards, no electronic transmission or storage is completely secure. We encourage you to use a strong, unique password and to notify us immediately via our Contact page if you suspect any unauthorised access to your account.

• Account information is retained for as long as your account remains active
• Business listing data is retained while the listing is active and for a reasonable period after deactivation
• Payment records are retained as required by applicable South African tax and financial legislation
• On written request to delete your account, we will remove your personal data within a reasonable period, subject to any legal obligation to retain it

We do not sell your personal information. We may share it with:

Service providers:

• Payment processors (PayFast and Paystack) to process transactions securely
• Cloud hosting and database providers for platform infrastructure
• Email service providers for transactional and marketing communications

Legal and regulatory requirements:

• We may disclose your personal information where required by law, court order or regulatory authority in South Africa
• We may disclose information to enforce our Terms and Conditions or to protect the rights, property or safety of That Business Thing, our users or the public

All third parties who process personal information on our behalf are required to implement appropriate security measures and to handle personal information in accordance with POPIA.

Some of our third-party service providers may be located outside South Africa. Where we transfer personal information to a foreign country, we take reasonable steps to ensure the recipient provides an adequate level of protection, consistent with the requirements of section 72 of POPIA.

We use the following types of cookies on our platform:

• Strictly necessary cookies — required for the platform to function (e.g., your login session)
• Preference cookies — remember your settings and preferences

You can control cookie settings through your browser. Disabling strictly necessary cookies may prevent you from logging in or using certain features.

As a data subject under POPIA, you have the right to:

• Know what personal information we hold about you
• Request access to your personal information
• Request correction or deletion of inaccurate, irrelevant or outdated personal information
• Object to the processing of your personal information on reasonable grounds
• Withdraw consent for processing based on consent, at any time
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact us via our Contact page. We will respond within a reasonable period.

Our platform is not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us via our Contact page and we will delete such information promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Your continued use of the platform after any changes constitutes your acceptance of the updated Policy.