Privacy Policy

Big Five Group Africa (“we”, “us”, “our”) is committed to protecting your personal information in accordance with the Protection of Personal Information Act (POPIA) of South Africa and international best practices.

Responsible party: Big Five Foods (Pty) Ltd (registration number 2025/108507/07, VAT number 4280321847), which operates Big Five Group, is the responsible party for personal information processed through this website under POPIA. Address: 21A Old Howick Road, Pietermaritzburg, KwaZulu-Natal, South Africa.

1. Information We Collect

We collect personal information when you:

• Visit our website or use our platforms (Big Five Connect, SupplierAdvisor)
• Register as a business, partner, or donor
• Make a donation or submit an inquiry
• Scan QR codes or interact with on-chain features

This may include name, email, phone number, organisation name, business details, IP address, and transaction data.

2. Website enquiries

When you use the contact form at /contact, your enquiry is sent from our website systems to craig@bigfivegroup.africa (or our configured inbox) using our email provider (Resend). We set Reply-To to the email address you provide so we can respond to you. If site delivery is unavailable, you may be offered a draft in your own mail app as a fallback. We use enquiry details solely to respond and, where relevant, prepare a briefing. We do not sell this information.

The customer feedback portal at /feedback keeps a profile (name, email, organisation, role, phone) and the notes you write about Foods products or Group service. Sign-in is a one-time code emailed to you. Other customers cannot read your profile or your notes. We use them to improve products and service, and we email a copy to our customer desk. We do not sell them.

Your notes stay private unless you tick the optional box on a note, “You may quote my feedback, with my first name and organisation, on the Big Five Group website”, and we approve that note. Only then do we show it in “What our customers say” on our website: your first name, your organisation, the headline and note in your own words (a long note may be shortened, never reworded) and your star rating, with the average rating of the notes we show. We never publish your surname, email address or phone number. We keep a record of when you ticked the box. Notes saved before the box existed are published only where the customer has told us they agree to be quoted.

You may withdraw this consent at any time: untick the box on the note, delete the note, or email our Information Officer, Dr Craig Ross Muller, at craig@bigfivegroup.africa. We then take the quote off the website.

2A. Newsletter subscriptions

When you subscribe via the footer or /newsletter, we collect your email address and, if provided, name and organisation, plus topic preferences and a record of your consent (timestamp, source, and technical signals such as a hashed IP for abuse prevention). Subscriptions are stored in our newsletter register (durable store and, where configured, a secure webhook for CRM / email tooling). If double opt-in is enabled (transactional email), you must confirm via a time-limited link before we mark you active; we may send a welcome message with preference and unsubscribe links. We use this information only to send occasional Group updates you opted into. You may manage topics via the preference link in emails, unsubscribe at any time via /newsletter/unsubscribe, one-click unsubscribe headers where present, or by emailing craig@bigfivegroup.africa. We do not sell newsletter data.

3. How We Use Your Information

We use your information to:

• Respond to partnership and programme enquiries
• Provide and improve our services
• Process donations and issue Section 18A certificates
• Verify businesses on Big Five Connect
• Send newsletters and impact reports where you have opted in (including via the website newsletter form)
• Comply with legal and regulatory requirements

4. Data Sharing & Third Parties

We do not sell your personal information. We only share data with trusted partners (e.g., payment processors, auditors, government regulators) when necessary to deliver our services or comply with law.

Our website and email run on service providers that process data on our behalf, including Vercel (website hosting), Resend (sending enquiry and newsletter emails), Plausible (website analytics) and Supabase (the database for our own visit statistics). These providers may store or process data on servers outside South Africa.

5. Your Rights (POPIA)

You have the right to:

• Access your personal information
• Request correction or deletion
• Object to processing
• Withdraw consent at any time
• Request access to records we hold under the Promotion of Access to Information Act (PAIA), as set out in our PAIA manual
• Lodge a complaint with the Information Regulator (South Africa) if you believe your personal information has been handled unlawfully: inforegulator.org.za

6. Data Security

We implement industry-standard security measures, including encryption, access controls, and regular audits.

6A. How Long We Keep Information

Under section 14 of POPIA we keep personal information only for as long as we need it for the purpose we collected it for, unless a law requires or allows us to keep it for longer. The periods below are the periods we work to. When a period ends, we delete or destroy the information, or de-identify it so that it can no longer identify you.

• Financial and tax records (for example invoices, payment and donation records, and records that support our tax and VAT returns): at least 5 years from the date the relevant return is submitted, as required by the Tax Administration Act, 2011, or longer where that Act requires (for example while an audit, objection or appeal is open).
• Company and accounting records required by the Companies Act, 2008: at least 7 years. Records the Act requires a company to keep for longer (such as founding documents and the securities register) are kept for as long as the Act requires.
• Employment records required by the Basic Conditions of Employment Act, 1997 (for example time worked and remuneration): at least 3 years after the date of the last entry in the record.
• Website enquiries and contact-form messages, and correspondence with investors, partners and other contacts: only for as long as we need them to respond and to manage the relationship, and then deleted, no later than 2 years after our last contact with you, unless they form part of a record listed above.
• Customer feedback portal profiles and notes: while your account is in use, and deleted no later than 2 years after your last activity, unless you ask us to delete them sooner.
• Portal sign-in and access logs (investor, partner and customer feedback portals): 12 months. The same period applies to the named record of which investor or partner portal pages and documents a signed-in person opened.
• Website visit statistics (pages, coarse location, device, organisation name, and the random visitor id described below): 14 months, then deleted. The network address used to look up an organisation is not kept at all.
• Newsletter and marketing consent: we keep your subscription and consent record until you withdraw your consent or unsubscribe. After that we keep only the minimum needed to respect your choice (for example your email address on a do-not-contact list) and to show when you consented and when you opted out.

We keep information for longer than these periods only where a law requires or allows it, where we reasonably need it to establish, exercise or defend a legal claim, or where you have agreed to it, as permitted by section 14 of POPIA. Information kept for historical, statistical or research purposes is kept only with appropriate safeguards against its use for any other purpose.

7. Analytics

We use Plausible Analytics to understand how the website is used (for example, which pages are visited). Plausible is cookieless: it does not set cookies or similar identifiers on your device and does not track you across other websites. It reports aggregated visit statistics only.

We also keep our own first-party visit statistics so our leadership team and investors can see how bigfivegroup.africa is used. We do not store your IP address, GPS location, street address, or anything you type into a form.

On a visit we record:

• the page, the language, the device type, the browser and operating-system family, and a screen-size band (not the exact pixels);
• country, region, city and timezone, taken from our host’s coarse network location (not GPS);
• the referring website, whether that was a search engine, a social network or a shared link, and the campaign tags (UTM) on the link you followed;
• how far the page was scrolled, how long it stayed visible, the landing page, the exit page and the path through the site;
• PDF downloads, the name of an outbound website (not the full link) and a short label for a button you clicked;
• the name of the organisation that operates the network you are on and, when the lookup provides them, its industry and size. Our server asks IPinfo to translate the network address into that label and then discards the address. If that lookup is not configured, we skip it. A home or mobile connection often names the internet provider, not your employer.

Repeat visits on the same day are also grouped by a one-way code made from a random value that changes every day and is then discarded, so that code cannot identify you on another day. Separately, we set one first-party cookie, bfg_vid, holding a random id for up to 180 days, so we can tell a new visit from a returning one and see how often someone comes back. It is not your name, it is not shared with advertisers, and it is not derived from your IP address.

If your browser sends a Do Not Track or Global Privacy Control signal, we set no visitor cookie and record nothing about that visit.

When you are signed in to the investor or partner portal, we also keep a record in your name of the portal pages and documents you open, and when. That record is visible to investor-portal administrators and to leadership inside Website Insights. It is kept for 12 months. Public pages do not attach your name.

super-cube.me and www.supplieradvisor.com are counted by Vercel Web Analytics as daily totals (pages, country, device, referrer, campaign tags, browser and system). Those totals do not include your name, an organisation, a city, or a path through the site.

We do not show a cookie banner. You can refuse visit statistics with Do Not Track or Global Privacy Control, or by emailing the Information Officer. The only other cookies we set are strictly necessary sign-in cookies for the investor, partner and customer feedback portals, used only when you sign in there. We do not sell data collected via analytics.

8. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Information Officer: Dr Craig Ross Muller, contactable at craig@bigfivegroup.africa.

Our manual under section 51 of PAIA, which explains how to request access to records we hold, is available at /paia.