Privacy Policy

This policy covers personal information we process about: (a) the staff and administrators of businesses that use the Platform (our Clients); (b) visitors to our website; and (c) our Clients’ own end users (Customers) whose data we process on our Clients’ behalf. “Personal information” has the meaning given under POPIA and includes “personal data” under the GDPR.

PayKit sits between our Clients and payment gateways, so we handle data in two distinct capacities:

• As responsible party (controller): for the personal information of our Clients’ staff and website visitors (for example, account, login, billing-contact, verification, and usage data). This policy is our notice for that processing.
• As operator (processor): for the personal information of a Client’s Customers, which we process only to provide the Platform and on the Client’s documented instructions. For that data, the Client is the responsible party and its own privacy notice governs; our processing is additionally governed by our agreement (and any Data Processing Addendum) with that Client.

We do not collect, process, or store full card numbers (PANs) or card security codes (CVV). Card details are captured by the payment gateway (currently Paystack or PayFast, depending on which the Client connects) under its own security and PCI-DSS obligations. To enable recurring charges, we retain a gateway-issued authorisation token, which we encrypt before storage, and a small amount of non-sensitive card metadata (card brand, last four digits, and expiry month/year). We never log card data, authorisation codes, API keys, or webhook secrets.

As responsible party, we use personal information to:

• provide, secure, and operate the Platform and your workspace, necessary for the performance of our contract with you (GDPR Art. 6(1)(b); POPIA s. 11(1)(b));
• authenticate users, verify a business before allowing it to process live payments, prevent fraud and abuse (including automated controls that detect card testing and pause charging), and maintain audit and security logs, in our legitimate interests in keeping the Platform safe (GDPR Art. 6(1)(f); POPIA s. 11(1)(f)), and to comply with law;
• bill you and keep financial records, in performance of contract and compliance with legal obligations such as tax and accounting law (GDPR Art. 6(1)(c); POPIA s. 11(1)(c));
• communicate with you about the service, including usage and billing notices such as warnings as you approach a plan allowance, and (where permitted or with consent) about relevant features;
• improve and develop the Platform using aggregated or de-identified data that does not identify any individual, including the aggregate revenue and lifecycle analytics shown in the dashboard.

When we act as operator for Customer data, we process it only to deliver the billing lifecycle (charging, retries, dunning, invoicing, add-ons and usage metering, coupons, entitlements, and record-keeping) on the relevant Client’s instructions, not for our own purposes.

We do not sell personal information. We share it only as needed to run the Platform:

• Infrastructure sub-processors: Google Cloud Platform and Firebase provide our authentication, managed Postgres database (Firebase Data Connect), application and worker runtime, file storage for invoice PDFs, and secret storage. Vercel hosts our dashboard and website frontend.
• Email delivery: Campaign Monitor delivers the transactional and billing email we send to you and, on a Client’s behalf, to that Client’s Customers, and reports delivery, bounce, and complaint events back to us.
• Payment gateways: the Gateway a Client connects (currently Paystack or PayFast), to create charges and process payments. The Gateway processes Customer payment data as an independent controller under its own terms.
• Between roles: Customer data we hold as operator is accessible to the Client on whose behalf we hold it, and to that Client’s authorised users.
• To destinations a Client chooses: where a Client registers a webhook endpoint or requests an export, we send that Client’s own data to the destination it nominates. The Client is responsible for the security of those destinations.
• Our support staff: a small number of authorised BIGBrave personnel can access a workspace to investigate a problem. That access is read-only, time-limited, and recorded in an audit trail.
• Legal and safety: where required by law, regulation, or valid legal process, or to protect rights, safety, and the integrity of the Platform.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

We put appropriate contractual protections (including operator/processor terms) in place with our sub-processors.

Our core infrastructure processes and stores data in the European Union: the managed database, application services, workers, and file storage all run in Google Cloud’s europe-west4 region (the Netherlands). Some sub-processors operate elsewhere. In particular, our frontend hosting and our email delivery provider may process personal information outside the European Union and South Africa. If you or your Customers are located elsewhere, personal information will be transferred across borders to be processed. Where POPIA, the GDPR, or other laws require it, we rely on appropriate safeguards for such transfers (for example, Standard Contractual Clauses and POPIA section 72 conditions). Contact us for more detail on the safeguards in place.

We keep personal information for as long as needed to provide the Platform and then as required to meet legal, accounting, tax, and audit obligations, or to resolve disputes and enforce our agreements. Financial records (including invoices, transactions, and the append-only ledger) are retained for the periods required by applicable law. When we act as operator, we retain and delete Customer data in line with our agreement with the relevant Client and its instructions. After an account is closed, we make data available for export for a limited period, then delete or de-identify it, subject to records we must keep.

Where a Client instructs us to erase a Customer, we pseudonymize that Customer’s personal information in place: identifying fields such as name, email, and external reference are irreversibly replaced, while the financial trail (invoices, transactions, and ledger entries) is retained in a form that no longer identifies the person. We do this because those records are append-only by design and must be kept for tax and audit purposes.

Separately from live data, encrypted database backups are retained for 30 days, and database transaction logs are retained for 7 days so we can recover to a point in time after an incident. Deleted or pseudonymized data may persist in those backups until they age out.

We take technical and organisational measures to protect personal information. These include encryption in transit and at rest, additional application-level encryption of sensitive fields (such as gateway authorisation tokens), storage of credentials and signing keys in a managed secret store, strict tenant isolation between Clients, role- and permission-based access controls with re-authentication for sensitive actions, scoped API keys stored only as hashes, signed webhooks in both directions, idempotent and audited state changes, an append-only ledger and audit log, automated abuse controls, and regularly tested backups with point-in-time recovery. No system is perfectly secure, but we work to protect data against loss, misuse, and unauthorised access, and we maintain processes to respond to security incidents, including notifying you and any regulator where the law requires.

Subject to the applicable law and to verification of your identity, you may have the rights below. To exercise them, contact us using the details in clause 15. If your data is held by us as operator on behalf of a Client (for example, you are that Client’s Customer), please see clause 11.

If a business uses PayKit to bill you, that business (not BIGBrave) is the responsible party for your personal information, and we process it as its operator on its instructions. Please direct requests to access, correct, or delete your information, and questions about how your data is used, to that business. We will support them in responding, and will act on their instructions consistent with our agreement and applicable law. The Platform gives that business tooling to erase your personal information on request, in the way described in clause 8.

We use strictly necessary cookies and similar storage to keep you signed in and to secure the dashboard. We keep non-essential tracking to a minimum. Where consent is required for any analytics or similar technologies, we will obtain it, and you can control cookies through your browser settings.

The Platform is a business tool and is not directed to children. We do not knowingly collect personal information from children. If you believe a child’s information has been provided to us, contact us and we will take appropriate steps.

We may update this policy from time to time. If a change is material, we will give reasonable notice (for example, by email or in the dashboard) before it takes effect. The “Effective date” above shows when this version took effect.

Our Information Officer is Tyrann Burger. For privacy questions or to exercise your rights, contact Tyrann at tyrann@bigbrave.co.za, or write to BIGBrave (Pty) Ltd, Building A, 68 on Hobart, 68 Hobart Road, Bryanston, South Africa. For any other question, use info@bigbrave.co.za.

You also have the right to complain to a regulator. In South Africa this is the Information Regulator (inforeg@inforegulator.org.za). In the EU/UK, you may complain to your local supervisory authority.