Who we are
Bona is a trading name, run from South Africa. This policy explains how we handle personal information under the Protection of Personal Information Act (POPIA).
- For information about our own customers and the people who contact us, we are the responsible party.
- When a business uses Bona to help its customers, that business is the responsible party, and we are its operator: we process information only to run the service for it.
What we never see: the page
Bona is built so that there is very little personal information for anyone to hold, including us.
- Passwords, card numbers, one-time codes and any field the business marks as private are masked on the customer’s own device, before anything is sent.
- The page itself travels over an end-to-end encrypted, peer-to-peer connection, browser to browser. If a firewall blocks a direct link, the stream goes through an encrypted relay that can’t read it either.
- Our servers only connect the two sides and never see the page.
What we do process
- To connect a session: the page address and title, plus any visitor name or email the business’s website chooses to pass to Bona.
- Agent accounts: the names and email addresses of agents and the details they need to sign in.
- Enquiries: what you send through our contact form, such as your name, work email, company, team size and message. The form also tells us how you found this website: the site that linked to it, any campaign tags in the link (such as utm_source), the page you landed on and when. Your browser keeps this for up to 30 days and sends it only with the form.
- Business contact details: to contact people at businesses we think may find Bona useful, we keep their name, job title, work email address and company. We get these from public business sources, company websites and business-data providers (such as Clay).
- Billing: card payments are handled by PayFast. We receive confirmation of payments and subscription status, never your full card number.
- Technical data: like any web service, our servers see IP addresses and basic connection details, which we use to connect sessions and protect the service from abuse.
This website uses Google Analytics to count visits and see which pages and buttons people use. It sets first-party cookies (named _ga) and sends Google the pages you view, your browser and device type, and your approximate location. Google Analytics doesn’t store IP addresses. Its advertising features are switched off, and this website uses no advertising cookies. You can block it with your browser’s privacy settings or Google’s opt-out add-on.
Why we use it
We use personal information to provide and secure Bona, to reply to enquiries, to bill for paid plans, and to meet our legal obligations, such as keeping tax records. We don’t sell personal information, and we don’t use it for advertising.
Who we share it with
- Cloudflare hosts this website and the servers that connect sessions. Its network runs in many countries, so some information may be processed outside South Africa.
- PayFast processes card payments.
- Google provides Google Analytics, which measures how this website is used.
- Our email provider hosts our mailboxes.
- Business-data providers (such as Clay), which we get business contact details from.
- Authorities, when the law requires us to.
How long we keep it
We keep personal information only as long as we need it for the purposes above, or as long as the law requires. Enquiries we no longer need are deleted.
Security
Information is encrypted in transit, access is limited to the people who need it, and the most sensitive fields never leave the customer’s device in the first place.
Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete it;
- object to us processing it, including for direct marketing;
- withdraw consent where we rely on your consent; and
- complain to the Information Regulator.
If you were helped by a business that uses Bona, that business is responsible for your information, so please contact them first. We’ll help them respond.
If you’re in the UK or the EU
Bona is a trading name, run from South Africa. When we contact businesses about Bona, or reply to an enquiry, we decide how that information is used. Under UK GDPR and the EU GDPR, that makes us its controller.
- Why we may email you: our lawful basis for business outreach is legitimate interests. We tell businesses about a product that is relevant to their customer support work. We have weighed this against your interests and rights, and we keep a written assessment. For our contact form and our customers, we use information for the purposes described in “Why we use it” above.
- Work addresses only: we only email work addresses at companies. Every email says who we are and how to opt out.
- Your rights: you can ask for a copy of your information, and ask us to correct it, delete it, restrict how we use it, or give it to you in a format you can take elsewhere. You can object to direct marketing at any time. If you do, we stop, and we keep only your email address on a do-not-contact list, so that we never email you again.
- Complaints: in the UK, you can complain to the Information Commissioner’s Office (ICO). In the EU, you can complain to your local data protection authority.
- Transfers: we are based in South Africa, which the UK and the EU haven’t assessed as giving adequate protection, and Cloudflare processes data in many countries. We protect your information with the measures described under “Security” and with contractual safeguards agreed with our providers.
- How long we keep it: we keep outreach contacts for up to 12 months after we last contacted you, unless you become a customer. We keep the do-not-contact list for as long as we do outreach.
To use any of these rights, contact our information officer, below.
Our information officer
To use any of these rights or ask a privacy question, contact our information officer at [email protected] or through the contact form. Start your message with “Information officer” so it reaches the right person.
Changes to this policy
We’ll post any changes on this page and update the date at the top.