Privacy Policy

GOODSOURCE BOS (PTY) LTD ("GoodSource", "we", "us") is committed to protecting the personal information of our users in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and all other applicable South African data protection legislation.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have as a data subject under POPIA.

By using the GoodSource BOS platform (the "Service"), you acknowledge that you have read and understood this Privacy Policy.

Identity and contact information

• Full name
• Email address
• Phone number (if provided)
• Physical or postal address (if provided)

Business and company information

• Company name and trading name
• CIPC registration number and date
• Entity type (Pty Ltd, CC, sole proprietor, etc.)
• VAT registration number (if applicable)
• PAYE registration status
• Director information
• Financial year-end
• Annual return status
• Beneficial ownership filing status

Compliance and CIPC data

• CIPC gazette publication records
• Deregistration notice records
• Beneficial ownership non-compliance records
• Compliance status flags generated by our system

Technical and usage data

• IP address
• Browser type and version
• Pages visited and time spent
• Authentication logs
• Device information

We collect personal information in the following ways:

• Directly from you when you register for an account and complete your compliance profile
• When you use the Service, including data you enter and actions you take
• From Google when you choose to sign in with Google OAuth
• Automatically through cookies and similar tracking technologies
• From publicly available CIPC gazette publications that we process and index

We process your personal information on the following lawful bases under POPIA:

• Performance of contract: To create and manage your account, provide the compliance tracking service, send transactional emails, and process payments.
• Legitimate interest: To improve our Service, ensure platform security, and detect and prevent fraud or abuse.
• Legal obligation: To comply with applicable South African laws and regulations, including tax and financial record-keeping requirements.
• Consent: For marketing communications, where you have opted in. You may withdraw consent at any time.

We share your personal information with the following third-party service providers (operators under POPIA) who process data on our behalf:

• Supabase Inc. — Database hosting, authentication, and storage. Your account data and compliance profile are stored on Supabase infrastructure. Supabase is SOC 2 Type 2 certified.
• Resend Inc. — Transactional email delivery. We use Resend to send confirmation, welcome, and notification emails.
• Google LLC — OAuth authentication provider. If you choose "Continue with Google", Google processes your identity to authenticate you. Google's privacy policy governs their processing.
• Vercel Inc. — Platform hosting and content delivery. Our application is hosted on Vercel's infrastructure.

All third-party processors are contractually obligated to process your personal information only as instructed by us and in accordance with applicable data protection laws. We do not sell your personal information to any third party.

As a data subject under POPIA, you have the following rights:

• Right of access: You may request a record of all personal information we hold about you.
• Right to correction: You may request correction of inaccurate or incomplete personal information.
• Right to deletion: You may request deletion of your personal information, subject to our legal obligations to retain certain records.
• Right to object: You may object to the processing of your personal information in certain circumstances, including objecting to direct marketing.
• Right to data portability: You may request a copy of your personal information in a commonly used electronic format.
• Right to complain: You have the right to lodge a complaint with the Information Regulator if you believe we have violated your privacy rights.

To exercise any of these rights, contact our Information Officer at langamadonsela89@gmail.com. We will respond within 30 days of receiving your request.

We retain your personal information for as long as necessary to provide the Service and comply with our legal obligations:

• Active account data: retained for the duration of your account
• Account data after deletion: deleted within 90 days of account closure, except where legal obligations require longer retention
• Financial and transaction records: retained for 5 years as required by the Tax Administration Act
• CIPC gazette index data (not linked to individuals): retained indefinitely as a public record index
• Email logs: retained for 12 months

We use cookies and similar technologies to maintain your session, remember your preferences, and understand how users interact with our platform. Please refer to our Cookie Policy for full details.

Some of our third-party processors (including Supabase, Vercel, Resend, and Google) may process your personal information outside the Republic of South Africa. Where such transfers occur, we ensure that adequate safeguards are in place in accordance with POPIA's requirements for cross-border data transfers.

Our designated Information Officer under POPIA is responsible for ensuring compliance with this policy and handling data subject requests:

Information Officer: Roberto Madonsela
Company: GOODSOURCE BOS (PTY) LTD
Address: 11 Shaw Road, Blairgowrie, Randburg, Gauteng, 2194
Email: langamadonsela89@gmail.com
Phone: 0713002691

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa at www.inforegulator.org.za.