Who we are
Bona is a trading name, run from South Africa. This policy explains how we handle personal information under the Protection of Personal Information Act (POPIA).
- For information about our own customers and the people who contact us, we are the responsible party.
- When a business uses Bona to help its customers, that business is the responsible party, and we are its operator: we process information only to run the service for it.
What we never see: the page
Bona is built so that there is very little personal information for anyone to hold, including us.
- Passwords, card numbers, one-time codes and any field the business marks as private are masked on the customer’s own device, before anything is sent.
- The page itself travels over an end-to-end encrypted, peer-to-peer connection, browser to browser. If a firewall blocks a direct link, the stream goes through an encrypted relay that can’t read it either.
- Our servers only connect the two sides and never see the page.
What we do process
- To connect a session: the page address and title, plus any visitor name or email the business’s website chooses to pass to Bona.
- Agent accounts: the names and email addresses of agents and the details they need to sign in.
- Enquiries: what you send through our contact form, such as your name, work email, company, team size and message.
- Billing: card payments are handled by PayFast. We receive confirmation of payments and subscription status, never your full card number.
- Technical data: like any web service, our servers see IP addresses and basic connection details, which we use to connect sessions and protect the service from abuse.
This website does not use advertising or analytics cookies.
Why we use it
We use personal information to provide and secure Bona, to reply to enquiries, to bill for paid plans, and to meet our legal obligations, such as keeping tax records. We don’t sell personal information, and we don’t use it for advertising.
Who we share it with
- Cloudflare hosts this website and the servers that connect sessions. Its network runs in many countries, so some information may be processed outside South Africa.
- PayFast processes card payments.
- Authorities, when the law requires us to.
How long we keep it
We keep personal information only as long as we need it for the purposes above, or as long as the law requires. Enquiries we no longer need are deleted.
Security
Information is encrypted in transit, access is limited to the people who need it, and the most sensitive fields never leave the customer’s device in the first place.
Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete it;
- object to us processing it, including for direct marketing;
- withdraw consent where we rely on your consent; and
- complain to the Information Regulator.
If you were helped by a business that uses Bona, that business is responsible for your information, so please contact them first. We’ll help them respond.
Our information officer
To use any of these rights or ask a privacy question, contact our information officer through the contact form on our homepage. Start your message with “Information officer” so it reaches the right person.
Changes to this policy
We’ll post any changes on this page and update the date at the top.