Privacy & POPIA
How Buya handles personal information — written to South Africa's Protection of Personal Information Act (POPIA).
Effective 26 July 2026 · Pot Labs (Pty) Ltd
Who we are
Buya is a loyalty, order-ahead and customer-intelligence engine operated by Pot Labs (Pty) Ltd ("Pot Labs", "we"), a company registered in South Africa. Merchants use Buya to run their own branded customer apps and Merchant Centres.
Our two roles under POPIA
- Operator (processor) — for the customer personal information a merchant collects through their Buya app (name, mobile number, orders, loyalty activity). The merchant is the responsible party; we process it on their documented instruction and for no other purpose.
- Responsible party — for the merchant account information we collect directly (owner name, contact number, business details) to provide and bill the service.
What we collect & why
- Merchant data: business name, owner contact, store details, plan — to create and operate the account.
- Customer data (on the merchant's behalf): mobile number and name at sign-up, and transaction/loyalty events — to run the loyalty programme, order-ahead, and the merchant's own analytics.
- Technical data: minimal logs needed for security, fraud prevention and reliability.
We do not sell personal information, and we do not use a merchant's customer data to advertise other businesses to those customers.
Cross-merchant personalisation
Buya can recognise a returning customer across participating merchants to improve recommendations. This is explicit opt-in only, uses de-identified signals, and is revocable by the customer at any time. It is off unless the customer chooses it.
Who we share it with
Sub-processors that help us run the service — principally Cloudflare (hosting, database, edge) — under confidentiality and data-processing terms. We share customer data back to the merchant who owns it. We disclose information if required by law.
Security & storage
Data is processed on Cloudflare's infrastructure with encryption in transit, strict per-merchant tenant isolation, and access limited to what's needed to operate the service. We aim to store and process South African customer data in line with POPIA's cross-border rules.
Retention
We keep customer data for as long as the merchant's account is active and their instruction requires, then delete or de-identify it within a reasonable period, unless a law requires longer retention.
Your rights (POPIA §23–25)
You may request access to, correction of, or deletion of your personal information, and you may object to processing or withdraw consent. For customer data, the quickest route is the merchant whose app you joined; you can also contact us and we'll route your request. To exercise a right or complain, email our Information Officer at privacy@buya.africa. You may also lodge a complaint with the Information Regulator (South Africa).
Changes
We'll update this page as the service evolves and note a new effective date. Material changes will be communicated to merchants.