Last updated: 19 September 2026

SECTION 1 – INTRODUCTION AND RESPONSIBLE PARTY

This Privacy Policy is issued by BBRG (Pty) Ltd, registration number 2026/063390/07 (BBRG, we, us, our), a company incorporated under the laws of the Republic of South Africa, in its capacity as the responsible party as defined in the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains how we collect, use, store, share and protect the personal information of visitors to bbrg.co.za and users of our property investment education services and printed products, in accordance with POPIA and, where applicable, the Promotion of Access to Information Act 2 of 2000 (PAIA).

Information Officer: Stephen Brown, [email protected], +27 64 807 0548, 13 Electric Road, Wynberg, Cape Town, 7800. BBRG’s Information Officer is registered, or is in the process of being registered, with the Information Regulator of South Africa as required by section 55 of POPIA.

SECTION 2 – PERSONAL INFORMATION WE COLLECT

Depending on how you interact with our website and services, we may collect: full name, email address, telephone number; property investment goals and financial parameters you enter into our Deal Analyser tool; payment confirmation data (transaction reference, amount and the last four digits of your card – never your full card number); delivery name and physical address where you purchase physical goods; programme progress, quiz results and any posts you make inside our learning platform; IP address and device or browser data; cookies and similar tracking technologies (with your consent where required); and any information you voluntarily submit through our forms, including when booking a consultation call.

SECTION 3 – PURPOSE OF PROCESSING (POPIA SECTION 13)

We process your personal information for the following specified, explicitly defined and lawful purposes only: to provide access to our educational content, programmes, workbooks and the Deal Analyser tool; to process payments and deliver physical goods; to respond to enquiries and schedule consultation calls; to send marketing communications where you have consented in accordance with section 69 of POPIA; to comply with our legal and regulatory obligations, including under the Consumer Protection Act 68 of 2008 and the Electronic Communications and Transactions Act 25 of 2002; and to improve our website and service offering.

SECTION 4 – LAWFUL BASIS FOR PROCESSING

We rely on one or more of the following grounds under section 11 of POPIA: your consent; the processing being necessary to conclude or perform a contract to which you are a party; compliance with a legal obligation; or our legitimate interest in operating and improving our business, provided this does not override your interests, rights or freedoms.

SECTION 5 – DIRECT MARKETING (POPIA SECTION 69)

We will not send you direct marketing communications by electronic means unless you are an existing customer to whom we have marketed similar products or services before, or you have given your express consent (opt-in). You may object to the processing of your personal information for direct marketing purposes, or withdraw consent, at any time by using the unsubscribe link in any marketing email or by contacting our Information Officer.

SECTION 6 – SHARING OF PERSONAL INFORMATION AND OPERATORS

We use third-party service providers who act as operators as defined in POPIA and process personal information only on our instruction and under confidentiality and security obligations consistent with section 21 of POPIA: GoHighLevel / LeadConnector (United States) – website hosting, customer relationship management, email and SMS delivery and our learning platform; PayFast (South Africa) – payment processing; our courier partners – delivery of physical goods (name, address and telephone number only); and, only where you have consented via our cookie banner, Google and Meta – analytics and advertising measurement. We do not sell your personal information to third parties.

SECTION 7 – CROSS-BORDER TRANSFER OF PERSONAL INFORMATION (POPIA SECTION 72)

Because certain of our service providers, including our website, email and learning-platform infrastructure, are hosted outside South Africa, your personal information may be transferred to and processed in other countries, including the United States. We only make such transfers where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA’s conditions for lawful processing, or where you have consented to the transfer, or where the transfer is necessary to perform a contract with you.

SECTION 8 – DATA SECURITY (POPIA SECTION 19)

We implement appropriate, reasonable technical and organisational measures to secure personal information, including: transport-layer encryption (HTTPS) on all pages; payment card data handled exclusively by our PCI DSS compliant payment processor, PayFast, such that BBRG never stores full card numbers; role-based access controls and two-factor authentication on our internal systems; and contractual confidentiality and security obligations on our operators. In the event of a security compromise affecting your personal information we will notify you and the Information Regulator as required by section 22 of POPIA.

SECTION 9 – RETENTION OF PERSONAL INFORMATION

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required or permitted by law. Customer and transaction records are kept for 5 years after the last transaction (Tax Administration Act 28 of 2011; Companies Act 71 of 2008). Marketing consents and lead records are kept until consent is withdrawn or after 24 months of inactivity. Learning-platform accounts are kept for the life of the account plus 12 months.

SECTION 10 – YOUR RIGHTS AS A DATA SUBJECT (POPIA SECTIONS 23 TO 25)

Subject to POPIA, you have the right to: be notified that your personal information is being collected; access the personal information we hold about you; request correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, outdated, incomplete or unlawfully obtained; object, on reasonable grounds, to the processing of your personal information; and lodge a complaint with the Information Regulator if you believe we have processed your personal information unlawfully. To exercise any of these rights, contact our Information Officer.

SECTION 11 – COOKIES AND TRACKING

Our use of cookies and similar technologies, and how to give or withdraw consent, is described in our Cookie Policy at bbrg.co.za/cookie-policy. Strictly necessary cookies are set without consent; analytics and advertising cookies are set only if you click “Accept all” on our cookie banner. You can change your choice at any time via “Cookie settings” in the website footer.

SECTION 12 – INFORMATION REGULATOR

If you have concerns about how we handle your personal information, you may contact the Information Regulator (South Africa). Complaints: [email protected]. General enquiries: [email protected]. Website: www.justice.gov.za/inforeg.

SECTION 13 – CHILDREN

Our services are intended for persons 18 years and older. We do not knowingly collect personal information from children as defined in section 34 of POPIA. If you believe a child has provided us with personal information, contact our Information Officer and we will delete it.

SECTION 14 – CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page indicates when this policy was last revised.

SECTION 15 – CONTACT US

For any questions about this Privacy Policy or to exercise your rights under POPIA, contact our Information Officer, Stephen Brown, at [email protected] or +27 64 807 0548, or write to BBRG (Pty) Ltd, 13 Electric Road, Wynberg, Cape Town, 7800, South Africa.