Home / Privacy
Privacy notice
How BS Vision handles the personal information you share with us, under the Protection of Personal Information Act (POPIA).
Last updated: 25 October 2026
Updated October 2026, under review. This version adds Google Analytics, which runs only if you agree to it, and updates what Brevo holds for us. The changed sections are the website section, the operators table, transfers outside South Africa and how long we keep information. The wording is with our legal advisers and may change.
This notice explains what personal information we collect through this website and in dealing with you, why we collect it, who we share it with, how long we keep it and what your rights are. It is the notification required by section 18 of POPIA. It should be read with our cookie policy, our website terms of use and our training and consultation booking terms.
Who we are
BS Vision (Pty) Ltd, trading as BS Vision Corporate Consulting (registration number 2015/226171/07) ("BS Vision", "we", "us"), is the responsible party for the personal information described in this notice. This means we decide why and how it is processed.
- Address: 50 Constantia Boulevard, Quadrum Office Park, Quadrum 4, Constantia Kloof, Johannesburg (Roodepoort), Gauteng
- Phone: 010 500 0909
- Email: sales@bsvision.co.za
- Information Officer: Katleho Baloyi, Managing Director, contactable at sales@bsvision.co.za (please mark your email "For the Information Officer")
The principles we follow
POPIA sets eight conditions for the lawful processing of personal information. In practice, this means we:
- are accountable for how we handle your information;
- collect only what we need, for a lawful reason, and mostly directly from you;
- use it only for the purpose you gave it to us for, or a closely related one you would reasonably expect;
- take reasonable steps to keep it accurate and up to date;
- tell you openly what we do with it (this notice);
- keep it secure; and
- let you see, correct or delete it, and object to its use.
Whose information we process
We process personal information about:
- people who request a consultation, book a course or enquire about a learnership through this website;
- delegates who attend our training courses, whether booked by themselves or by their employer;
- contact people at our clients, prospective clients, suppliers and funding partners;
- people who email or phone us, or ask to receive our newsletter, The Blueprint; and
- visitors to this website, to the limited extent described under what the website does and does not do.
POPIA also protects juristic persons, such as companies. Where this notice refers to "you", it includes an organisation whose information we hold.
What we collect, and why
We collect only what you choose to send us, or what your organisation sends us about you when it books a service.
| Source | Information | What we use it for |
|---|---|---|
| Consultation requests | Name, company, email address, phone number (optional), the topics you select, how you prefer to be contacted and any notes you add | To reply to you, arrange the conversation and prepare for it |
| Course bookings | Name, company, email address, phone number, the course, the number and names of attendees, and any notes | To confirm the booking, send joining instructions, issue an invoice and certificates of attendance, and keep training records |
| Learnership enquiries | Name, company, email address, phone number, the learnership of interest, the number of learners and any notes | To respond to the enquiry and, if you go ahead, to prepare a proposal or agreement |
| Emails, calls and meetings | Whatever you share with us, and our notes of the conversation | To respond, provide our services and keep a record of our dealings |
| Newsletter subscriptions | Your email address and, if you give it, your name and company | To send you The Blueprint until you unsubscribe |
| Client engagements | Business contact details, and the information needed to perform the work you engage us for (set out in the relevant engagement letter) | To perform the engagement, invoice for it and meet our legal obligations |
| Website security | A one-way hashed form of your internet (IP) address, kept for up to 24 hours | To stop automated abuse of the forms (rate-limiting) |
| Website analytics, only if you choose Accept analytics | A random cookie identifier, the pages you view, the buttons and links you use, the website you came from, campaign tags, your type of device and browser, and your approximate location (country and city). Not your name, email address, phone number or anything you type | To understand which pages and features help visitors, find what does not work and improve the site |
| Campaign tags | If you arrived through a tagged link, the campaign tags in it (for example utm_source=newsletter), sent with a quote request or booking | To know which of our campaigns bring enquiries |
We do not sell personal information, and we do not use it for any purpose you would not reasonably expect.
Our lawful reasons (section 11)
We process personal information only where POPIA allows it, namely where:
- you consent, for example when you ask to receive our newsletter, tick "Send me BS Vision training updates", or choose Accept analytics on this website;
- it is needed to take steps you asked for before entering into an agreement, or to carry out an agreement with you, for example confirming and delivering a course;
- the law requires it, for example keeping tax and accounting records; or
- it serves a legitimate interest of ours or of the person we share it with, for example replying to business enquiries, keeping training records our clients rely on, protecting the website from abuse, and establishing or defending legal claims.
Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect processing that took place before you withdrew it.
Information about your employees or colleagues
If you book a course or engage us on behalf of your organisation and give us details of other people (for example delegates), please make sure you are entitled to share them and that those people know about this notice.
Special personal information and children
We do not ask for special personal information, such as information about race, religion, health, trade union membership, biometric information or criminal behaviour, through this website. Please do not send it to us through the forms or by email. Where an engagement genuinely requires it (for example, aggregated employment equity or B-BBEE data supplied by a client), it is dealt with under the engagement letter, only to the extent the law permits, and with appropriate safeguards.
This website is aimed at businesses and adults. It is not intended for children (people under 18). If a person under 18 wishes to enquire about a learnership or course, a parent or guardian should contact us on their behalf. If we learn that we have received a child's information without the consent of a competent person, we will delete it.
Direct marketing (section 69)
We send electronic marketing, such as The Blueprint newsletter, only:
- to people who have asked to receive it; or
- to our existing clients, about our own similar services, where they were given the chance to refuse it when we collected their details.
Every newsletter includes an unsubscribe link. You may also opt out at any time, free of charge, by emailing sales@bsvision.co.za with the word "Unsubscribe". We will stop promptly once we receive your request.
When you press "Subscribe" on this website, your email address is sent to us, we email you a welcome message and we add your address to our newsletter list (held by Brevo). If you did not subscribe yourself, reply to the welcome email or use the unsubscribe link, and we will remove the address.
What the website does and does not do
- It uses Google Analytics only if you choose Accept analytics in the cookie banner or in Cookie settings. Until then, nothing is loaded from Google and no analytics cookies are set. Google signals and advertising features are switched off, and we never send Google your name, email address, phone number or anything you type. You can switch analytics off at any time from Cookie settings at the foot of every page, which also deletes the analytics cookies. It uses no advertising cookies. Our cookie policy has the details.
- Your cookie choice is kept in your browser's local storage (or, if that is blocked, in a first-party cookie) for 12 months, so that we do not ask on every page.
- If you arrive through a link with campaign tags (for example from our newsletter), the tags are kept in your browser's session storage for the current tab, and sent to us only with a quote request or booking you choose to send.
- The home page uses your browser's session storage to remember, for the current tab only, that you have already seen the opening animation. This stays on your device, is never sent to us and is cleared when you close the tab.
- The website assistant ("Ask BS Vision") answers from the content of this website and runs entirely in your browser. What you type into it is not sent to us or to any AI service. The conversation is kept in your browser's session storage for the current tab only, with anything that looks like an email address, phone number or ID number removed, and is cleared when you close the tab. To contact us, use the booking form or email us.
- The forms do not store what you type on our web server. Each request is emailed to our team, with a confirmation email to you, and then discarded by the website. Newsletter subscriptions are also added to our newsletter list.
- To prevent abuse, the website keeps a salted, one-way hashed version of your internet address for up to 24 hours. It cannot practically be turned back into your address, and it is deleted automatically.
- Videos play from YouTube's privacy-enhanced service (youtube-nocookie.com) and load only when you press play. Once a video plays, YouTube (Google) may set its own cookies and collect information under its own privacy policy.
Who else handles your information (operators, section 21)
We use a small number of service providers, called operators in POPIA, who process information only on our instructions and must keep it confidential and secure under written agreements:
| Provider | What it does for us | Where |
|---|---|---|
| Afrihost | Hosts this website and processes form submissions in transit | South Africa |
| Microsoft 365 | Hosts our email and business documents | South Africa and, for some services, other countries |
| Brevo | Sends The Blueprint newsletter if you subscribe, and delivers the website's form emails (your request to our team and the confirmation to you). It also holds the contact details of people who book a course, so that we can send booking reminders, and of people who tick "Send me BS Vision training updates", so that we can send those updates until they unsubscribe | European Union |
| Google Analytics (Google LLC and Google Ireland Limited) | Measures how the website is used, only for visitors who choose Accept analytics. It receives a random cookie identifier, the pages viewed, the buttons and links used, device and browser details and an approximate location. Google signals and advertising features are switched off | United States, European Union and other countries where Google operates |
We may also share information, where necessary and lawful, with:
- registered funding partners, but only with your agreement and only where you have asked us to help arrange funding;
- training providers, assessors, accredited bodies or SETAs, where needed to deliver a course or learnership you have booked or to register your results;
- our professional advisers, auditors and insurers, under a duty of confidentiality; and
- regulators, courts or law enforcement, where the law requires it.
Transfers outside South Africa (section 72)
Some of our providers store or process information outside South Africa, in particular Brevo in the European Union, Microsoft for some services and, if you choose Accept analytics, Google in the United States and elsewhere. We transfer personal information across the border only where the recipient is subject to a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA (for example, the European Union's General Data Protection Regulation), or where another ground in section 72 applies, such as your consent or the need to perform an agreement with you.
For Google Analytics, we rely on Google's data processing terms, which bind Google to protect the information and include the European Union's standard contractual clauses for transfers, and on the consent you give when you choose Accept analytics. Analytics data sent to Google is limited to what is described above, and never includes your name or contact details.
How long we keep it (section 14)
- Enquiries that do not go further: up to 12 months after our last contact, so that we can follow up on the same matter.
- Bookings, invoices and client records: for as long as the engagement lasts and then for the periods tax, company and other laws require, which is generally five to seven years.
- Training attendance records: for as long as clients and delegates may reasonably need them for skills development and B-BBEE verification, and in line with all applicable laws.
- Newsletter addresses: until you unsubscribe. We may keep a record that you unsubscribed, so that we do not contact you again.
- Hashed IP addresses: up to 24 hours.
- Website analytics: the analytics cookies on your device last up to 13 months, or until you switch analytics off. Google keeps the event data for 14 months at most, after which it is deleted. Reports we take from it contain only totals.
- Your cookie choice: 12 months, after which we ask again.
We may keep information for longer where it is needed to establish, exercise or defend a legal claim. When information is no longer needed, we delete or de-identify it.
How we protect it (section 19)
We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, and unauthorised access or use. These include serving the website over an encrypted (HTTPS) connection, not storing form content on the web server, limiting access to our mailbox and records to the people who need it, using reputable service providers with strong built-in security, including Microsoft's multi-factor authentication where our software and applications use it, and requiring our operators to apply their own security safeguards.
No method of sending information over the internet is completely secure. Please do not send us passwords, banking details or special personal information through the website forms.
If something goes wrong (section 22)
If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, unless the law or a law enforcement agency requires us to delay. We will tell you what happened, the likely consequences, what we are doing about it and what you can do to protect yourself.
Automated decisions (section 71)
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you. Where we use AI tools in our reporting work, a person reviews the output and remains responsible for it.
Your rights (sections 23 to 25, and 11(3))
You have the right to:
- ask whether we hold personal information about you, free of charge;
- ask for a copy of that information and a description of the third parties who have had access to it (a prescribed fee may apply, and we will tell you of it in advance);
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
- ask us to destroy or delete information we are no longer authorised to keep;
- object, on reasonable grounds, to processing based on our legitimate interests;
- object at any time to processing for direct marketing;
- withdraw your consent where we rely on it; and
- complain to the Information Regulator.
To exercise any of these rights, email sales@bsvision.co.za, marked "For the Information Officer". You may also use the forms prescribed under POPIA (Form 1 for objections and Form 2 for correction or deletion), available from the Information Regulator's website. We may need to verify your identity before acting, and we will respond within a reasonable time and within any period the law sets.
Complaints
If you are concerned about how we handle your information, please contact our Information Officer first so that we can try to put it right. You may also lodge a complaint with the Information Regulator (South Africa). Its contact details and complaint forms are on its website: inforegulator.org.za.
Access to records (PAIA manual)
Our manual under section 51 of the Promotion of Access to Information Act, 2000 (PAIA) explains which records we hold and how to request access to them. It is available on request from sales@bsvision.co.za and at our offices.
Changes to this notice
We will update this notice when the way we handle personal information changes, and show the date of the latest version at the top. If a change materially affects how we use information we already hold about you, we will tell you directly where we reasonably can.
Contact
Questions about this notice or your information: sales@bsvision.co.za, 010 500 0909, or 50 Constantia Boulevard, Quadrum Office Park, Quadrum 4, Constantia Kloof, Johannesburg (Roodepoort), Gauteng.