Privacy Policy

1. Who we are

Business Hustle (www.businesshustle.co.za) is a provider of software development solutions and digital marketing services and is a product of Simple Eternity Holdings (Pty) Ltd (Registration No. 2017/652523/07), a company registered under the Companies Act 71 of 2008 in the Republic of South Africa (“we”, “us”, “Business Hustle”).

This policy applies to Business Hustle and our family of platforms, including Hustle Portal (hustleportal.online), Business Hustle Local (app.businesshustle.co.za), KloofStreet Online (kloofstreet.online), BreeStreet Online (breestreet.online), and our other hyperlocal platforms as listed in our PAIA Manual.

The Chief Executive Officer, Mr Tselakgosi Jacob Seatlholo, is our designated Information Officer in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”) and the Promotion of Access to Information Act 2 of 2000 (“PAIA”), registered with the Information Regulator.

2. What personal information we collect

Depending on how you interact with us, we may collect:

• Names, email addresses, and telephone numbers (e.g. when you submit our contact or newsletter forms)
• Physical and postal addresses
• Identity or registration numbers, and FICA documentation where required by law
• Banking and invoicing details for client engagements
• BEE certificates and tender documents supplied in the course of business
• Business and social media profile information relevant to our services
• Technical information generated through your use of our websites (see our Cookie Policy)

3. Why we process it — our six legal bases

We only process personal information where a lawful basis exists under POPIA:

• Consent — freely given, specific, informed, and unambiguous
• Contractual necessity — processing needed to fulfil a contract with you
• Legal obligation — required by South African or other applicable law
• Vital interests — to protect someone’s life
• Public task — in the public interest or under official authority
• Legitimate interest — supported by a documented Legitimate Interests Assessment

Every processing activity we undertake is mapped to a specific legal basis in our integrated PAIA/POPIA Manual.

4. Special category information

We do not process special personal information (such as health, biometric, or religious data) unless a POPIA exception applies: explicit consent, employment law obligations, legitimate activities of foundations or associations, data manifestly made public by you, or the establishment, exercise, or defence of legal claims.

5. Direct marketing

In line with POPIA and our internal rules:

• Existing customers: a soft opt-in applies and every message includes the ability to opt out
• New prospects: we require your explicit consent before marketing to you
• We will ask for consent at most once before marketing

6. Your rights

As a data subject you have the right to:

• Be informed about how your information is processed
• Access the personal information we hold about you
• Request correction, deletion, or destruction of your personal information
• Restrict or object to processing
• Data portability
• Not be subject solely to automated decision-making

POPIA requests are simple and free — email the Information Officer at ceo@businesshustle.co.za (e.g. “What personal data do you have about me?”) and we will respond within a reasonable timeframe. Requests for company records (non-personal information) follow the formal PAIA procedure described in our PAIA Manual, using the prescribed Form 2, which may involve prescribed fees and a 30-day response period.

You may also lodge a complaint with the Information Regulator (South Africa).

7. How we protect your information

Our IT practices include:

• Password and network security controls
• Physical security at our premises
• Regular software updates and virus/malware protection
• A disaster recovery and back-up policy

8. Data breaches

We operate a documented breach response protocol: containment and forensic preservation within the first 24 hours, assessment of scope and affected data subjects, and — for high-risk incidents — notification of the Information Regulator within 72 hours, with affected individuals informed as required by law.

9. International transfers

We only transfer personal information across borders where the recipient is subject to laws, binding corporate rules, or contractual safeguards providing an adequate level of protection as required under section 72 of POPIA. Where no adequate protection exists, the transfer does not proceed.

10. Retention and governance

We retain personal information only as long as necessary for the purpose collected or as required by law. Our compliance programme includes annual privacy training, third-party vendor reviews, policy framework reviews, and internal audits with board reporting.

11. Changes to this policy

We may update this policy from time to time. The current version will always be available on this page, and our PAIA Manual is reviewed at least every two years (next review: January 2028).