1. Scope & Responsible Party
This Privacy Policy and Compliance Manual sets forth the protocols and legal standards by which Bona Phandle Media (Pty) Ltd (“Bona Phandle Media”, “we”, “us”, or “our”) processes, stores, protects, and disposes of personal information in connection with our out-of-home (OOH) advertising network, digital billboard properties, mobile commuter transit inventory, campaign planning tools, and online web platforms.
Bona Phandle Media is a registered proprietary limited company in the Republic of South Africa and operates as the Responsible Party as contemplated in Section 1 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). We are committed to upholding the constitutional right to privacy and safeguarding all personal data entrusted to us by clients, advertisers, media agencies, property landlords, and web visitors.
2. POPIA Compliance Framework Notice
When you submit an inquiry, request a billboard rate proposal, execute an advertising contract, or use our digital inventory cart, you are notifying us of personal information. Bona Phandle Media adheres strictly to the 8 lawful conditions for processing personal information under POPIA:
- Accountability
Ensuring total compliance across all OOH operations and personnel.
- Processing Limitation
Lawful, reasonable processing with explicit justification or consent.
- Purpose Specification
Collecting data solely for defined advertising and commercial purposes.
- Further Processing Limitation
No processing beyond the original intended business scope.
- Information Quality
Maintaining accurate, complete, and up-to-date client records.
- Openness & Transparency
Clear notification of collection, processing, and Information Officer details.
- Security Safeguards
Enterprise-grade technical, administrative, and physical defenses.
- Data Subject Participation
Unconditional rights to access, correct, or object to personal data.
3. Personal Information We Collect
Depending on your interaction with Bona Phandle Media, we may collect and process:
A. Advertiser & Inquirer Information
Full name, company / organization name, business email address, direct telephone and WhatsApp mobile numbers, job designation, target geographic preferences (e.g. Buffalo City, Nelson Mandela Bay, N2 corridor), campaign budget tier, and specialized brief requirements.
B. Billing, Accounting & Contracting Data
Company registration number, VAT number, registered office address, accounts payable contact details, billing statements, payment receipts, and contractual authorizations for out-of-home media space.
C. Landowners & Structural Site Partners
Property ownership verification, title deed references, land lease agreements, municipal site approvals, and banking disbursement credentials for billboard lease rental payments.
D. Digital & Technical Telemetry
IP address (anonymized/hashed for security monitoring), browser category, operating system, pages visited, billboard locations saved in cart, referral URLs, and duration of visit.
4. How We Collect Data
We collect personal information directly from you through the following touchpoints:
- Direct website inquiries submitted through our contact forms or rate proposal generators.
- Direct communications via our official WhatsApp business desk (+27 60 793 8868).
- Campaign planning briefs and billboard site selections added to our multi-site quote drawer.
- Telephone conversations, email inquiries, or in-person briefings with our sales directors.
- Formal execution of outdoor advertising space agreements and master service contracts.
- Automated website telemetry cookies and performance diagnostics.
5. Lawful Purpose for Processing
Under Section 11 of POPIA, we process personal information strictly for legitimate commercial and operational purposes, including:
- Contractual Performance: Generating custom billboard proposals, verifying site availability, scheduling print and flighting dates, and issuing monthly invoices.
- Customer Support & Consultation: Providing media recommendations, demographic traffic impact figures, and production proof updates.
- Statutory & Regulatory Compliance: Complying with South African revenue laws (SARS), municipal by-laws, and South African outdoor advertising regulations.
- Platform Security & Cyber Defense: Protecting our servers against denial-of-service attacks, automated bot scrapers, brute force attempts, and fraudulent requests.
6. Direct Marketing & Communications
In strict compliance with Section 69 of POPIA, Bona Phandle Media does not engage in unsolicited electronic direct marketing (“spam”). We only communicate marketing updates, new billboard site releases, or promotional rate cards to:
- Existing clients who have contracted or engaged with us previously.
- Prospective advertisers who have explicitly opted in or requested outdoor media consultations.
Every marketing transmission includes a clear, immediate opportunity to opt-out or unsubscribe at no cost. You may opt out at any time by emailing privacy@bonaphandle.co.za.
7. Information Security Safeguards (POPIA Section 19)
Bona Phandle Media maintains comprehensive technical, physical, and organizational measures to prevent unauthorized access, loss, alteration, or interception of personal information:
Enforced TLS 1.3 encryption across all website endpoints, APIs, and client portals.
Strict credential authentication with exponential rate-limiting and audit logging.
Multi-tenant isolation, automated vulnerability scanning, and daily offsite encrypted backups.
Active honeypot traps, SQLi/XSS pattern scrubbers, and intrusion anomaly detection.
8. Third-Party Sharing & Cross-Border Transfers
We never sell, rent, or trade your personal information to third parties. Personal data is shared solely with trusted operators who perform essential operational functions on our behalf under strict written non-disclosure agreements:
- Professional large-format printing partners for billboard vinyl flighting.
- Structural engineering and rigging crews responsible for site installations.
- Accredited cloud hosting and enterprise database providers (e.g. Supabase, Google Cloud).
- Law enforcement or municipal regulators when strictly required by a court order or South African statute.
Where cross-border data transfer occurs (e.g. international enterprise cloud hosting), we ensure compliance with Section 72 of POPIA by confirming that the recipient territory enforces privacy protections substantially similar to POPIA.
9. Data Retention & Secure Destruction
Personal information is retained only for as long as necessary to fulfill the commercial purposes for which it was originally collected, or as required by South African statutory retention mandates (e.g. 5 years for tax and commercial accounting records under the Companies Act and Tax Administration Act).
Upon expiration of the retention schedule, records are irreversibly anonymized or securely deleted using industry-standard digital sanitization standards.
10. Your Rights as a Data Subject Under POPIA
Under Sections 23, 24, and 25 of POPIA, you possess unconditional legal rights regarding your personal information:
12. Information Officer Contact & Regulator Details
To exercise any of your statutory rights, submit a formal PAIA request, or address privacy inquiries, please contact our designated Information Officer:
Physical Address: East London, Eastern Cape, South Africa
Direct Telephone: +27 60 793 8868
Privacy Email: privacy@bonaphandle.co.za
General Inquiries: info@bonaphandle.co.za
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints Email: POPIAComplaints@inforegulator.org.za
General Inquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za