How we collect, use, store, and protect your personal information — in compliance with POPIA.
McSbuSing (Pty) Ltd ("McSbuSing", "we", "us", or "our") is the responsible party for personal information collected through this website and in the course of our business operations, as defined under the Protection of Personal Information Act, 2013 (POPIA).
We are registered with the Information Regulator of South Africa under registration number 2026-001032. Our Information Officer registration certificate is publicly available.
We are committed to processing personal information lawfully, transparently, and in accordance with POPIA and other applicable South African legislation.
We collect personal information in the following contexts:
| Context | Information Collected |
|---|---|
| Discovery session booking | Full name, email address, phone number, company name (optional), project type and description, preferred date and time |
| Contact / quote request forms | Full name or company name, email address, phone number (optional), message content. These are emailed to us and not stored on our website. |
| Focus group applications | Full name, email address, phone number (optional), your answers to the screening questions, and the date you gave consent |
| Client accounts & billing | Company name and registration details, VAT number, contact person's name, email address and business address; quotations, invoices, timesheets and payment status |
| Client portal users | Name, email address, password (stored only as a one-way hash, never readable), the time of your last sign-in, and, if you set one up, the secret for your authenticator app (encrypted) |
| Quotations & plans in the portal | Which quotations you accept and when, optional add-ons you choose, discount requests and the reasons you give, and support plans you subscribe to or cancel |
| Agreements you respond to | When you accept or decline an agreement in the client portal: the full name you type as your signature, your email address, the date and time, the IP address and browser used, any reason you give for declining, and a fingerprint of the exact text you were shown. These are kept with the agreement as proof of what was agreed, and the personal details are encrypted. |
| Service ratings | The rating (1 to 5) and any comment you give about our service, in the client portal or from the link we email after a payment or a resolved support ticket, and who gave it |
| Logins you share with us | Usernames, passwords, keys and notes for systems we work on for you (for example hosting, domains or app stores), shared through the client portal or given to us otherwise. These are encrypted, only our admins can view them, and every view is recorded. |
| Online payments | When you pay by card, we send your name, email address and the amount to PayFast. PayFast collects your card details on its own secure pages; we never see or store them. We keep PayFast's confirmation of the payment: its reference, amount, fee and status, and the name and email address it returns. |
| Timesheets | Time worked on your projects: development time measured automatically in our developers' code editors (WakaTime), and time for calls and meetings added by hand. This records our team's work, not yours. |
| Documents you send us | Briefs, specifications, quotations or invoices you share so we can prepare a quotation or record an invoice. Their text may be read by an AI model that we run on our own equipment; documents are not sent to outside AI services. |
| Security logs | For sign-ins to our administration system: the email address used, IP address, browser details and time of the attempt. For all sign-ins (including the client portal): failed attempts, account lockouts and one-time sign-in codes. |
| Activity records | Actions taken in our administration system, the client portal and the website's forms (for example accepting a quotation or submitting a booking): who acted, what was done and when, with the IP address and browser used. Personal details that change are noted as changed, but their values are not recorded. |
| Website analytics | Pages visited, browser and device type, approximate location and referring website, collected by Google Analytics using cookies |
| Email communications | Any personal information you include in emails sent to us |
We do not collect sensitive personal information (such as biometric data, health information, or race/ethnicity) unless specifically required for a project and with your explicit consent.
We use your personal information for the following purposes:
Under POPIA, we process your personal information on the following grounds:
We do not share your personal information except in the following limited circumstances:
All third-party service providers are required to maintain appropriate security and process personal information only as instructed.
Some providers, such as Google, store information on servers outside South Africa. We only use providers that are bound by laws, rules or agreements giving it protection comparable to POPIA, as section 72 of POPIA requires.
We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law:
When retention periods expire, personal information is securely deleted or anonymised.
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction, including:
No method of electronic transmission or storage is 100% secure. In the event of a data breach that is likely to prejudice your rights, we will notify the Information Regulator and affected individuals as required by POPIA.
Under POPIA, you have the following rights regarding your personal information:
Request a copy of the personal information we hold about you.
Request that we correct inaccurate or incomplete information.
Request deletion of your personal information, subject to legal retention requirements.
Object to the processing of your information for specific purposes.
Withdraw consent at any time without affecting prior lawful processing.
Lodge a complaint with the Information Regulator of South Africa.
To exercise any of these rights, contact us at hello@mcsbusing.co.za. We will respond within 30 days.
You may also contact the Information Regulator (South Africa):
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za
This website uses cookies. Cookies are small text files stored on your device.
We do not use advertising cookies. You can control cookies through your browser settings.
This website integrates with the following third-party services. Each has its own privacy policy:
We are not responsible for the privacy practices of third-party services. We encourage you to review their policies.
Our website and services are intended for business use by individuals aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a minor has submitted information to us, please contact us immediately and we will delete it.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The revised version will be published on this page with an updated effective date.
We encourage you to review this policy periodically. For material changes, we will notify active clients by email.
For privacy-related enquiries, requests to exercise your rights, or to report a concern:
Email: hello@mcsbusing.co.za
Phone: 073 674 5702
Website: www.mcsbusing.co.za
Information Regulator Registration No.: 2026-001032
Download Information Officer Certificate
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za.