Privacy Policy

This Privacy Policy explains how Xoliswa Masuku, trading as Xquisite Creations ("we", "us", "our") collects, uses, and protects personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.

1. Information We Collect

We collect personal information in the following categories:

• Account information: your name, email address, phone number, and business details provided at registration.
• Business data you upload: client records, appointment details, transaction history, product catalogues, and any other data you enter into the Platform.
• Usage data: pages visited, features used, login timestamps, and device/browser information — collected to improve the Platform.
• Programme applications: if you apply to a programme such as the Founding 20, your name, role, phone number, email, business details, your answers to our questions, and the reasons you give for applying.
• Payment information: billing amounts and payment status. Card details are processed directly by PayFast and are never stored on our servers.

2. How We Use Your Information

• To provide, maintain, and improve the Platform and its features.
• To process your subscription and send billing-related communications.
• To send you service announcements, security alerts, and support messages.
• To comply with legal and regulatory obligations.
• To detect, prevent, and investigate fraud or misuse of the Platform.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

3. Your Business Data

Data you upload — including your clients' personal information — is processed by us as an operator on your behalf under POPIA. You remain the responsible party for that data. You are responsible for ensuring you have lawful grounds to upload and process your clients' personal information through the Platform.

4. Data Sharing & Third Parties

We share personal information only in these limited circumstances:

• PayFast — for payment processing. Subject to PayFast's own Privacy Policy.
• Cloud infrastructure providers — for hosting and data storage. All providers are contractually bound to protect your data.
• Legal requirements — where disclosure is required by South African law, court order, or regulatory authority.

5. Data Security

We implement appropriate technical and organisational measures to protect personal information against loss, unauthorised access, disclosure, or alteration. These include encrypted connections (HTTPS), access controls, and regular security reviews. However, no system is completely secure and we cannot guarantee absolute security.

6. Data Retention

We retain your account and business data for as long as your account remains active, plus a further period as required by applicable law (typically 5 years for financial records). Upon account closure, you may request an export of your data within 30 days. After that period, data is securely deleted.

If you apply to a programme and are not selected, or you start an application and do not finish it, we keep your application for up to 12 months so we can offer you a place if one opens up, and then delete it. You can ask us to delete it sooner at any time.

7. Your Rights Under POPIA

You have the right to:

• Request confirmation of whether we hold personal information about you.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of your personal information (subject to legal retention obligations).
• Object to the processing of your personal information.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact our Information Officer at admin@xquisite.brightfinance-x.co.za.

8. Cookies

The Platform uses essential session cookies to keep you logged in and to protect against cross-site request forgery. We do not use third-party advertising or tracking cookies.

We count visits to understand which pages are useful. This is done on our own servers without cookies. We do not store your IP address, name or account details with a visit. Each visit is tagged with a one-way code that changes every day, so a person cannot be followed from one day to the next or identified from it. We record the page, how far it was scrolled, how long it was open, where on the page clicks landed, and roughly where the visit came from (for example a WhatsApp link). This information is deleted after 180 days. If your browser sends a Do Not Track or Global Privacy Control signal, we do not count your visit at all.

9. Children

The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact & Information Officer

For privacy-related queries, data access requests, or complaints, contact our Information Officer:
admin@xquisite.brightfinance-x.co.za
Xoliswa Masuku, trading as Xquisite Creations, South Africa.