Privacy Policy

BMS™ – BUSINESS MANAGEMENT SOLUTIONS (PTY) LTD (2026/791785/07) known as Business Management Solutions (“BMS”, “we”, “us” or “our”) develops and operates the BMS business management software platform.

BMS provides businesses with digital tools for managing various operational activities, which may include customer management, quotations, invoicing, expenses, financial information, reporting, tax-related records, asset management, maintenance and other business processes.

We respect the privacy of our customers, users and individuals whose personal information may be processed through the BMS platform.

This Privacy Policy explains how we collect, use, store, process, protect and disclose personal information when users access or use BMS.

We are committed to processing personal information responsibly and in accordance with applicable South African data protection legislation, including the Protection of Personal Information Act 4 of 2013 (“POPIA”), where applicable.

This Privacy Policy applies to personal information processed through:

• The BMS website;
• BMS web applications;
• BMS mobile applications;
• BMS APIs and integrations;
• Customer support channels;
• Registration and subscription processes;
• Communications with BMS; and
• Other services forming part of the BMS platform.

This policy applies to users such as business owners, administrators, employees, authorised representatives, customers and other individuals whose personal information is processed through BMS.

Depending on how BMS is used, we may process different categories of information.

3.1 Account Information

When an account is created, we may collect information including:

• Full name;
• Email address;
• Telephone number;
• Company or organisation name;
• Job title or role;
• Username;
• Account identifiers; and
• Authentication and security information.

Passwords should be stored using appropriate cryptographic protection and are not intended to be stored as readable plain text.

3.2 Business Information

Businesses using BMS may provide information such as:

• Company name;
• Registration details;
• Contact information;
• Business address;
• Tax-related information;
• Banking or payment-related information;
• Customer records;
• Supplier records;
• Products and services;
• Quotations;
• Invoices;
• Expenses;
• Transactions;
• Asset information; and
• Operational records.

Some of this information may constitute personal information where it identifies or relates to an identifiable individual.

3.3 Customer Information Entered by BMS Users

Businesses using BMS may enter personal information relating to their own customers, suppliers, employees or other individuals.

This may include:

• Names;
• Contact details;
• Addresses;
• Company information;
• Transaction records;
• Invoice information;
• Payment information; and
• Other information required by the business using BMS.

Where a BMS customer enters this information into the platform, that customer generally determines why and how the information is processed.

3.4 Technical Information

When BMS is accessed, certain technical information may be collected automatically, including:

• IP address;
• Browser type;
• Device information;
• Operating system;
• Login timestamps;
• Session information;
• Application activity;
• Error information;
• Security logs; and
• Performance information.

This information may be used for security, troubleshooting, auditing, analytics and improving the BMS platform.

Personal information may be processed for purposes including:

• Creating and maintaining BMS accounts;
• Providing BMS services;
• Authenticating users;
• Managing subscriptions;
• Processing authorised transactions;
• Generating quotations and invoices;
• Providing reports and dashboards;
• Managing customers and suppliers;
• Managing assets and business records;
• Providing customer support;
• Communicating service-related information;
• Maintaining security;
• Preventing fraud and unauthorised access;
• Diagnosing technical problems;
• Improving platform performance;
• Maintaining audit records;
• Meeting contractual obligations;
• Complying with applicable laws; and
• Developing and improving BMS functionality.

We aim to process personal information only for legitimate and appropriate purposes.

Where POPIA applies, BMS is committed to processing personal information in accordance with the principles and requirements of POPIA.

These include, where applicable:

• Accountability;
• Processing limitation;
• Purpose specification;
• Further processing limitation;
• Information quality;
• Openness;
• Security safeguards; and
• Data subject participation.

Personal information should not be collected or processed unnecessarily and should only be retained for as long as reasonably required for the relevant purpose, contractual obligation or legal requirement.

The role of BMS under POPIA may depend on the circumstances in which personal information is processed.

Where a business uses BMS to store and manage information concerning its own customers, employees, suppliers or other individuals, that business may act as the Responsible Party, while BMS may act as an Operator processing information on behalf of that business.

Where BMS determines the purpose and means of processing information relating directly to BMS customers, users, subscriptions or its own business operations, BMS may act as the Responsible Party.

BMS customers remain responsible for ensuring that personal information they upload to or process through BMS has been collected and is processed lawfully.

We do not sell personal information.

Information may, however, be shared with trusted service providers where reasonably necessary to operate BMS.

These may include providers of:

• Cloud infrastructure;
• Database services;
• Email services;
• SMS or messaging services;
• Payment processing;
• Application monitoring;
• Cybersecurity;
• Analytics;
• Customer support; and
• Other infrastructure required to deliver BMS services.

Service providers are expected to process information only as necessary to provide their services and subject to appropriate confidentiality and security requirements. Information may also be disclosed where required by law, regulation, court order or another lawful request from an authorised authority.

Where BMS provides payment functionality, payments may be processed through third-party payment service providers.

BMS may receive information regarding the status and reference of a payment without necessarily storing complete payment-card information.

Payment service providers may process personal information according to their own privacy policies and regulatory obligations.

We take reasonable technical and organisational measures to protect personal information against:

• Unauthorised access;
• Loss;
• Misuse;
• Destruction;
• Alteration;
• Disclosure; and
• Unlawful processing.

Depending on the service and infrastructure, security measures may include:

• Encryption in transit;
• Secure authentication;
• Password hashing;
• Role-based access control;
• Access restrictions;
• Security monitoring;
• Audit logging;
• Database security;
• Backups;
• Network security;
• Secure development practices; and
• Vulnerability management.

No internet-connected system can guarantee absolute security. We therefore continuously assess and improve security controls as the platform evolves.

Personal information will generally be retained only for as long as reasonably necessary to:

• Provide BMS services;
• Maintain customer accounts;
• Meet contractual obligations;
• Maintain required business records;
• Comply with tax, accounting or regulatory requirements; and
• Meet applicable legal obligations.

Information may be securely deleted, anonymised or archived when it is no longer reasonably required, subject to applicable legal and contractual obligations.

BMS may maintain backups of platform information for operational resilience, disaster recovery and business continuity purposes.

Information deleted from an active BMS account may remain temporarily within backup systems until those backups are overwritten or securely removed according to applicable retention procedures.

Some technology or cloud service providers used by BMS may process or store information outside South Africa.

Where cross-border processing occurs, reasonable steps will be taken to ensure that personal information receives appropriate protection as required by applicable law, including POPIA.

BMS websites and applications may use cookies or similar technologies to:

• Maintain user sessions;
• Authenticate users;
• Remember preferences;
• Improve platform functionality;
• Monitor performance;
• Improve security; and
• Understand how the platform is used.

Where required, users will be provided with appropriate choices regarding non-essential cookies.

Users are responsible for maintaining the confidentiality of their BMS login credentials.

Users should:

• Use strong passwords;
• Avoid sharing login credentials;
• Protect devices used to access BMS;
• Assign appropriate user permissions;
• Immediately report suspected unauthorised access; and
• Ensure information uploaded to BMS is processed lawfully.

BMS should only be accessed by authorised users.

Subject to POPIA and other applicable legislation, individuals may have rights relating to their personal information.

These may include the right to:

• Request confirmation that personal information is being processed;
• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion or destruction where legally permitted;
• Object to certain processing;
• Request restriction of certain processing where applicable;
• Withdraw consent where processing relies on consent; and
• Lodge a complaint with the appropriate regulatory authority.

Requests may be subject to identity verification and applicable legal requirements.

Where permitted by law, BMS may send users information relating to products, services, platform updates or promotional offers.

Where required, users will be given an appropriate mechanism to opt out of direct marketing communications.

Operational communications relating to security, accounts, transactions or important service changes may still be sent where necessary.

BMS may integrate with third-party platforms, including payment providers, accounting systems, communication platforms, cloud services and other business applications.

Where users choose to enable such integrations, information may be exchanged between BMS and the relevant third party as required to provide the integration.

Third-party platforms operate according to their own terms and privacy policies.

BMS is primarily designed for businesses and authorised business users and is not intended as a consumer service directed at children.

Users should not intentionally submit children’s personal information unless there is a legitimate and lawful business reason to do so and all applicable legal requirements have been satisfied.

If BMS becomes aware of a security compromise involving personal information, the incident will be investigated and appropriate action will be taken.

Where required by applicable law, affected parties and/or the relevant regulatory authority will be notified.

Customers may request closure of their BMS account subject to contractual, financial, regulatory and legal obligations.

Following account closure, information may be retained for a reasonable period where necessary for:

• Legal compliance;
• Financial records;
• Tax requirements;
• Dispute resolution;
• Fraud prevention;
• Backup and disaster recovery; or
• Other legitimate purposes permitted by law.

After applicable retention periods expire, information may be securely deleted or anonymised.

We may update this Privacy Policy periodically to reflect:

• Changes to BMS functionality;
• Changes to our business operations;
• New technologies;
• Regulatory requirements; or
• Changes in applicable law.

The latest version will be made available through the BMS website or platform with an updated “Last Updated” date.

Material changes may also be communicated to users through the platform or other appropriate channels.

Questions, concerns or requests relating to this Privacy Policy or the processing of personal information may be directed to:

Users may also contact BMS through the official support channels provided within the platform or website.

Individuals may have the right to lodge a complaint with the Information Regulator of South Africa where they believe their personal information has been processed contrary to applicable data protection legislation.

Users are encouraged to contact BMS first so that we have an opportunity to investigate and address their concerns.