Grow South Africa ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains what we collect, why we collect it, how we use and share it, and the rights you have. It applies to growsouthafrica.co.za, our membership platform, the Business Registry, online Courses, the Road to Wellness and Prosperity Card programme, and our Tours and Events in South Africa.

1. Who we are

Grow South Africa is the data controller of personal information collected through our website and services. You can contact us at any time at matthys@growsouthafrica.co.za.

2. Information we collect

  • Account information: name, email address, password (hashed), phone number, membership tier.
  • Business profile information: business name, description, industry, province and city, logo, contact details, website and social links.
  • Payment information: we do not store full card details. Payments are processed by our payment partners (Paystack and Netcash). We retain transaction references, amounts, dates, and billing names for accounting and refund purposes.
  • Course and workbook data: lesson progress, downloaded plans, and the responses you save in workbook fields.
  • Tour and event booking data: participant names, ID or passport number (only where required for tour manifests, transport, or accommodation), date of birth, dietary requirements, medical or accessibility notes you choose to share, emergency contact details, and proof of payment.
  • Contact and lead information: name, email, phone, message, and any details you submit via contact, partnership, or "Get the Card" forms.
  • Technical data: IP address, browser type, device, pages visited, referrer, and cookie identifiers.

3. How we use your information

  • Create and manage your account and membership.
  • List your business in the Business Registry (where applicable to your tier).
  • Process payments, refunds and cancellations.
  • Confirm bookings and operate Tours and Events safely (manifests, dietary, medical and emergency contact).
  • Deliver Courses and save your workbook responses.
  • Send transactional emails (welcome, receipts, password reset, booking confirmations) and, where you have opted in, our newsletter.
  • Respond to enquiries you submit through contact forms.
  • Improve our website, content and services.
  • Comply with our legal obligations.

4. Legal basis (POPIA and GDPR)

We process your personal information under the Protection of Personal Information Act, 2013 (POPIA) of South Africa, and where applicable the EU General Data Protection Regulation (GDPR). We rely on one or more of: your consent, performance of a contract with you, our legitimate interests (such as running our platform securely), and compliance with a legal obligation.

5. Who we share information with

We share personal information only with the following categories of recipient, and only as necessary:

  • Payment processors — Paystack and Netcash, to process payments and refunds.
  • Email delivery — Migadu, used to send transactional and marketing emails.
  • Hosting and backend — Lovable Cloud (powered by Supabase) for secure database, authentication and file storage.
  • Tour and event operators — only the participant details needed to operate a specific booking (e.g. transport, accommodation, guides, insurance).
  • Government or regulators — where required by law, court order or to protect our rights.

We do not sell your personal information. We do not share it for third-party advertising.

6. Cookies and analytics

We use a small number of cookies for authentication, security, and to understand how the site is used so we can improve it. You can clear or block cookies in your browser; some features (such as staying signed in) will not work without them.

7. Data retention

  • Account data: kept for as long as your account is active, plus up to 5 years for tax and audit records.
  • Payment records: 5 years (South African tax law).
  • Tour and event records: 3 years after the event.
  • Marketing data: until you unsubscribe.
  • Contact form submissions: up to 2 years.

8. Security

We protect your data with TLS encryption in transit, hashed passwords, and database row-level security so that one user cannot read another user's data. No system is perfectly secure; please use a strong, unique password and let us know immediately if you suspect unauthorised access.

9. Your rights

You have the right to:

  • Access the personal information we hold about you.
  • Correct information that is inaccurate or out of date.
  • Delete your account and associated personal data (subject to legal retention requirements).
  • Object to or restrict certain processing.
  • Withdraw consent for marketing communications at any time via the unsubscribe link in our emails.
  • Request a copy of your data in a portable format.

To exercise any of these rights, email matthys@growsouthafrica.co.za. We will respond within 30 days.

10. International transfers

Some of our service providers store data outside South Africa. Where this happens, we ensure that an adequate level of protection applies, in line with POPIA section 72.

11. Children

Our services are intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be communicated by email or a notice on the site.

13. Complaints

If you are not satisfied with how we handle your information, you may lodge a complaint with the South African Information Regulator: inforegulator.org.za.

See also our Refund Policy, Cancellation Policy, and Terms of Service.