Privacy Policy
Last updated
This policy explains how The Cutting Edge Group CC, trading as Bridgebos, handles personal information: what we collect, why, who we share it with, how long we keep it, and the rights you have wherever you live. The short version:
- If your school, employer or another organisation uses Bridgebos, that organisation controls your information. Please contact it first.
- The application and its database run in South Africa, and backups, once enabled, are kept there too.
- Some services we use, and integrations our customers choose, are in other countries, including the United States, the European Union and China.
- We do not sell personal information, and we use no analytics or advertising cookies.
Who we are
Bridgebos (also Bridgebos.ai) is an AI business operating system for businesses and schools. It is provided by The Cutting Edge Group CC, registration number 2009/036136/23, registered in South Africa (“we”, “us”, “our”).
- Registered address: 57 Main Road, Paarl, Western Cape, South Africa.
- Information Officer: Francois van Niekerk.
- Privacy and legal requests: privacy@bridgebos.ai.
We have not appointed an EU or UK representative or a Data Protection Officer at this time; contact our Information Officer at privacy@bridgebos.ai.
This policy covers the Bridgebos platform (the “Service”): its web addresses, including bridgebos.ai and the addresses we give customers, its public pages, its API and command-line tool, and its integrations. Our Terms of Service govern customers’ use of it.
Our two roles
Privacy law gives different duties to the party that decides why and how personal information is used, and to the party that processes it on that party’s behalf. South Africa’s Protection of Personal Information Act (POPIA) calls them the responsible party and the operator; the GDPR and most other laws call them the controller and the processor.
We are the responsible party (controller) for:
- account and user information about the people who use the Service;
- billing and contract information about our customers;
- information about visitors to our public pages, and the security records our systems keep;
- support requests and other messages people send us.
We are the operator (processor) for “Customer Data”: the information our customers — schools and businesses — put into the Service about their own contacts, learners, parents, employees, job applicants, clients and others. For Customer Data, the customer is the responsible party (controller). It decides what to collect and why, and we process it only on its instructions and under our agreement with it.
If you are one of a customer’s contacts, learners, parents, employees or clients and you want to see, correct or delete your information, or ask how it is used, please contact that customer first: it controls that information. If you write to us instead, we will pass your request to the customer where we can tell which one it concerns, and help it answer.
What the Service does
Customers switch on the parts they need. Depending on that, the Service can hold:
- CRM: contacts, companies, deals, activities, tasks, projects, notes, files, products and reports.
- Marketing: email, WhatsApp and SMS campaigns and broadcasts, automated sequences, audience segments, and Content Studio for social media posts.
- Help desk, forms and websites: support tickets, satisfaction surveys, voice notes, web forms, booking pages, and websites the customer publishes.
- HR: employees, onboarding, leave, timesheets, pay and other employment records, performance reviews and check-ins, recruitment (vacancies, applications and CVs), and employment-equity reports.
- Schools: learners, parents and staff synced from D6; Presence, which records when people sign in and out at hostels and other sites using face recognition; meal ordering, including dietary needs; a portal where a customer’s clients, such as parents, can sign in; and fundraisers synced from Fundify.
- Payments, contracts and e-signing: payment requests paid on Yoco’s or PayFast’s own payment pages, contract drafting, and documents signed online with a one-time code.
- The AI assistant, and integrations with the services listed in “Services we use”.
Information we collect for ourselves
- Account information: name, email address, phone number, role and preferences. Passwords are stored only as a one-way hash. Two-step sign-in secrets are encrypted, and recovery codes are hashed.
- Customer and billing information: the organisation’s name and contact people, what it subscribes to, invoices and payments. We do not receive or store card numbers.
- Usage and security records: sign-ins, the actions people take in the Service (the audit trail), the IP address and browser details recorded with those actions, and error logs. The IP addresses of requests to our public pages and sign-in pages are also held briefly — up to a day — for rate limiting and security.
- Support: what you write to us, and any files you send.
- Visitors to our public pages: our servers and Cloudflare see your IP address and browser details in order to deliver the page. We do not run analytics on them.
Giving us personal information is voluntary, and no law requires you to. Some of it is a contractual requirement: without a name and email address for each user, and billing details for the customer, we cannot open an account or provide the Service. Usage and security records are created automatically as the Service is used. Whether you must give information to one of our customers is for that customer to tell you.
Information customers put into the Service
What Customer Data contains is up to each customer. It can include names and contact details, messages and their history, notes, files, payment records, employment and pay records, CVs, and information about children. It can also include special personal information (sensitive data), for example:
- Biometric information. Presence turns a person’s photo into a face template — a list of numbers — so that a camera at the customer’s site can recognise them. Video is analysed on the customer’s own device at that site and is never stored or sent to us; only the result (who passed which door, and when) and the face templates reach the Service. Faces it does not recognise are counted, not kept. Removing a person from Presence deletes their template.
- Health information, such as dietary needs and allergies for meal orders.
- Race, where a South African employer records population group for employment-equity reports.
- Children’s information, such as learners at a school (see “Children’s information”).
Sensitive areas such as pay, Presence, dietary needs and employment equity are open only to the roles a customer grants, and are closed to everyone until it does. We process Customer Data only to provide the Service to the customer, keep it secure, support the customer and meet our legal duties. We do not sell it or use it for advertising, and we do not use Customer Data to train our own models.
How we use our own information
We use the information in “Information we collect for ourselves”:
- to provide the Service under our contract with the customer;
- to keep accounts and the Service secure, prevent fraud and abuse, and find and fix errors (our legitimate interests, and our legal duties);
- to support customers and answer requests (contract, or legitimate interests);
- to bill, and to keep financial records (contract, and legal obligation);
- to tell customers about changes to the Service and their account (contract, or legitimate interests);
- to send our own news to business contacts, with a way to opt out in every message — in South Africa under POPIA section 69: with your consent, or, if you are an existing customer, about similar products and services; elsewhere only as local law allows;
- to comply with the law and to protect our rights (legal obligation, or legitimate interests).
Email open and click tracking
Every email a customer sends to one of its contacts through the Service includes a tiny invisible image — one-to-one emails, help desk replies and satisfaction surveys, automated emails, notices such as Presence alerts to parents, campaigns and sequences alike. When an email program loads it, the Service records that the email was opened, when, the kind of device (mobile, desktop or tablet) and the email program, read from the request’s browser details.
Links are rewritten only in campaign and sequence emails: there, a link passes through the Service, so that a click is recorded before the reader is sent on to the address the sender chose. Links in every other email are left as they are.
Some opens and clicks are made by machines, not people — for example Apple Mail Privacy Protection, which loads images as soon as an email arrives, and the link scanners some email providers run. The Service flags these as machine opens and clicks and shows them apart from people’s. To recognise Apple’s service it looks at the IP address of the request at that moment. We do not store an IP address with an open or a click.
When a customer sends email through Mailgun, Mailgun reports back whether each email was delivered, bounced or marked as spam, and the Service records that against the email. When an address can no longer be delivered, the Service sends it no further email for that customer until its staff check or correct the address — except transactional and account mail, such as sign-in codes and signing invitations. Marking any email as spam opts the address out of that customer’s marketing (see the next section), and Mailgun may also refuse further mail to it. Emails sent through Office 365 report none of this.
Open and click records are kept for 24 months and then reduced to totals that identify nobody. Emails about a transaction you are part of — a document to sign, a code you asked for — carry no tracking. If you would rather not be tracked, turn off automatic image loading in your email program.
Marketing messages and opting out
Customers send email, WhatsApp and SMS messages through the Service. It is built to respect what people choose:
- Every marketing email carries an unsubscribe link, and WhatsApp marketing messages can carry a button to stop them.
- Replying STOP — or “unsubscribe”, or “stop asseblief” — to a WhatsApp or SMS message opts that number out.
- Marking any email from a customer as spam opts that address out of the customer’s marketing, just as the unsubscribe link does. Mailgun, which carries the email, may then refuse all further mail to that address.
- An opt-out stops marketing only: campaigns, broadcasts and automated sequences. Service messages — about an account, a booking, an invoice, or a child’s safety — still reach you.
- A customer’s staff can also record “Stop all messages” for a person on a channel. That stops every message the customer sends that person on that channel, marketing and service alike, safety notices included. Only the customer’s staff can lift it. It does not cover messages about a transaction you are part of — such as a document to sign or a one-time code you asked for — or a customer’s internal messages to its own staff.
- Once you have opted out, only you can opt back in, by filling in the customer’s web form yourself. A staff member, an import or a sync cannot sign you up again.
WhatsApp information we receive from Meta — messages, delivery and read receipts, and the sender’s WhatsApp profile name — is used only to deliver and record the customer’s conversations.
Customers remain responsible for having consent or another lawful basis for the messages they send (see our Terms of Service).
AI features
The Service includes an AI assistant and AI features: answering questions about records, drafting messages and documents, summarising, reading CVs and suggesting a score for job applications, turning speech into text, and carrying out actions a person allows.
- Each customer chooses its AI provider in settings — Anthropic, OpenAI, Google Gemini, Moonshot AI (Kimi) or Z.ai (Zhipu AI) — or none. The settings page and the assistant say where data goes for the provider chosen.
- When someone uses an AI feature, their request and the parts of the customer’s records needed to answer it are sent to the chosen provider. Some providers can also run web searches to answer.
- Each provider processes that data under its own business or API terms. Customers should read those terms before choosing one.
- We do not use Customer Data to train our own models.
- The AI never decides on a job application or moves one on: its scores for applications are advice for a person.
- Customers decide what the AI may do without a person’s approval. Their permission settings control what it can propose. A change the assistant proposes waits for a person to approve it, unless that person has switched on auto-approve, which lets the changes their permissions allow go ahead without a click; auto-approve is off by default, and deleting something always needs a click. A multi-step AI plan runs only after a person approves it. Some AI work runs in the background — for example, estimating how complex a help desk ticket is.
- Speaking to the assistant uses your browser’s own speech recognition first, which your browser’s maker may run on its own service; otherwise the audio goes to the customer’s chosen speech provider. An answer is read aloud by ElevenLabs only when someone presses play.
Who we share information with
We share personal information only:
- with the service providers in “Services we use”, which process it for us or for our customers;
- with the integrations a customer turns on, which receive what the customer sends them;
- with the customer whose account holds it, or as that customer instructs;
- when the law requires it, or to protect people’s safety, our rights or the security of the Service;
- with a buyer or successor of our business, under the same protections.
We do not sell personal information, and we do not share it for advertising.
Services we use
Each of these receives only what it needs for the job it does. Where we could not confirm where a service processes data, we say it may process data outside South Africa.
Used for every customer
- Fly.io — Hosts the application and its primary database. Location: Johannesburg, South Africa. Fly.io, Inc. is a United States company.
- Amazon Web Services (S3) — Stores encrypted nightly backups of the database, once enabled. Location: Cape Town, South Africa. Amazon Web Services is a United States company.
- Cloudflare — Runs DNS for our domain and carries web traffic to the application through its network, which protects the site and secures the connection. Location: A global network; visitors in South Africa are normally served from Johannesburg. May process data outside South Africa.
Only when a customer turns them on
- Mailgun — Sends email, when a customer chooses it as their email service. Location: The United States or the European Union, whichever region the customer chooses.
- Microsoft 365 — Sends email from, and brings email into the platform from, a customer’s own Microsoft 365 mailbox once the customer connects it. Location: Wherever the customer’s own Microsoft 365 tenant keeps its data.
- Meta WhatsApp Cloud API — Sends and receives WhatsApp messages. Location: Meta Platforms (United States). May process data outside South Africa.
- 360dialog — An alternative route for sending WhatsApp messages through Meta. Location: 360dialog GmbH (Germany). May process data outside South Africa.
- BulkSMS — Sends SMS messages. Location: BulkSMS.com (South Africa). May process data outside South Africa.
- Yoco — Takes card payments on its own hosted payment page. We never receive full card numbers. Location: Yoco (South Africa). Card networks may process data outside South Africa.
- PayFast — Takes payments on its own hosted payment page. We never receive full card numbers. Location: PayFast (South Africa). Card networks may process data outside South Africa.
- Anthropic — Runs the AI assistant and AI features when chosen as the AI provider, and may run web searches. Location: United States.
- OpenAI — Runs the AI assistant and AI features when chosen as the AI provider, and turns voice notes into text. Location: United States.
- Google Gemini — Runs the AI assistant and AI features when chosen as the AI provider, turns speech into text, and may run web searches. Location: Google (United States). May process data outside South Africa.
- Moonshot AI (Kimi) — Runs the AI assistant and AI features when chosen as the AI provider. Location: China.
- Z.ai (Zhipu AI) — Runs the AI assistant and AI features when chosen as the AI provider, turns speech into text, and may run web searches. Location: China.
- ElevenLabs — Reads an AI answer aloud, only when a person presses play. Location: ElevenLabs (United States and United Kingdom). May process data outside South Africa.
- Higgsfield — Generates images and video in Content Studio from a customer’s prompts. Location: Higgsfield (United States). May process data outside South Africa.
- Postiz — Schedules and publishes social media posts to the networks a customer connects. Location: The Postiz service the customer sets up, self-hosted or Postiz’s own. The social networks it publishes to may process data outside South Africa.
- Cloudflare R2 — Stores the images and video generated in Content Studio. Location: Cloudflare’s storage network. May process data outside South Africa.
- Google Maps Platform — Shows maps and finds addresses on resources, booking pages and published websites, when a customer adds a Google Maps key. Location: Google (United States). May process data outside South Africa.
- HubSpot — Imports and syncs records with a customer’s own HubSpot account. Location: Wherever the customer’s HubSpot account is hosted. HubSpot, Inc. is a United States company.
- Zapier — Lets the AI assistant run actions in the apps a customer has connected to Zapier. Location: Zapier (United States). May process data outside South Africa.
- D6 — Syncs learners, parents, staff and family links from a school’s D6 system, and writes back only if the school allows it. Location: D6 (South Africa). May process data outside South Africa.
- Fundify — Syncs fundraisers, sellers and their totals from Fundify. Location: Fundify (South Africa), whose service runs on Supabase. May process data outside South Africa.
- Entegral — Syncs property listings from a customer’s Entegral Base account. Location: Entegral (South Africa). May process data outside South Africa.
We tell customers in advance, by email or in the Service, before we add or replace a service provider that processes Customer Data, so that they can object.
Customers can also send their data to places they choose themselves — their own webhooks, other software through our API or command-line tool, or content embedded in websites they publish. Those destinations are the customer’s choice and responsibility.
International transfers
Our primary storage is in South Africa: the application and database run in Johannesburg, and backups, once enabled, are kept in Cape Town. Some services we use, and integrations a customer turns on, process information in other countries, including:
- the United States — for example Anthropic, OpenAI, Google, Meta, Zapier, HubSpot, Higgsfield, Mailgun’s US region, and the companies behind our hosting providers;
- the European Union — Mailgun’s EU region and 360dialog;
- the United Kingdom — ElevenLabs;
- China — Moonshot AI (Kimi) and Z.ai (Zhipu AI), only if a customer chooses one of them as its AI provider;
- other countries where a provider, or a customer’s own systems, operate.
How transfers are protected:
- From South Africa, we transfer personal information only as section 72 of POPIA allows: to a recipient bound by a law, binding corporate rules or an agreement that gives protection substantially similar to POPIA; where the transfer is needed to perform a contract with the person or in their interest; or with their consent.
- From the EU and EEA, to a country without an EU adequacy decision — South Africa does not have one — we rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one applies, such as for United States companies certified under the EU-US Data Privacy Framework.
- From the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, or on UK adequacy regulations where they apply.
- Where a provider offers these safeguards in its data processing terms, we rely on them.
- China. Moonshot AI (Kimi) and Z.ai (Zhipu AI) are used only if a customer chooses them. China has no adequacy decision from the EU or the UK, and its laws may allow access to data on terms that differ from POPIA and the GDPR. Under section 57 of POPIA, sending special personal information or children’s information to a country without adequate protection needs the Information Regulator’s prior authorisation. We recommend that customers subject to the GDPR or the UK GDPR, or holding special personal information or children’s information, do not choose them for personal information. A customer that does is responsible for the lawful basis for that transfer, and for any authorisation it needs.
You can ask for a copy of the safeguards that apply by writing to privacy@bridgebos.ai.
How long we keep information
- Account and customer information: while the customer’s agreement lasts, then deleted within 90 days after it ends, except what the law requires us to keep.
- Billing and financial records: as long as tax and company law require — in South Africa, generally five to seven years.
- The audit trail: kept as a record of who did what. The IP address and browser details in it are cleared after two years by default.
- Error logs: 30 days by default.
- WhatsApp messages as received from Meta: the raw delivery record is deleted after 30 days.
- Email open and click records: 24 months, then reduced to totals.
- Delivery reports from our email provider: the report as received is deleted after 30 days; the delivery, bounce or spam report stays with the email’s record.
- Rate-limit records: the IP address of a request to a public or sign-in page, up to a day.
- Backups: the design is encrypted nightly backups to Amazon Web Services in Cape Town, once enabled, each deleted automatically after a fixed period. Our hosting provider also keeps daily snapshots of the database disk for a few days.
- Customer Data: as long as the customer keeps it. Customers can set how long some data is kept — for example Presence door-by-door records (90 days unless the customer sets otherwise, up to 3 years; a one-line daily summary per person is kept for 3 years), help desk voice recordings, files in folders with a retention period, and job applications after a vacancy closes — and the Service deletes it when that period ends. When an agreement ends, Customer Data is deleted as our Terms of Service describe.
How we protect information
- Encryption in transit: every connection uses HTTPS, and the connection between Cloudflare and our servers is encrypted and verified.
- Encryption at rest: the database disk is encrypted; backups, once enabled, are encrypted with a key that only the owner holds, so the server that writes them cannot read them; and the keys customers save for their integrations are encrypted in the database.
- Customer separation: row-level security in the database keeps each customer’s data apart, and sensitive areas are open only to the roles a customer grants.
- Sign-in: two-step sign-in, with an authenticator app, is required for staff accounts by default; repeated wrong attempts lock the account for a while; and passwords are stored only as a one-way hash.
- Audit logs record significant actions, such as changes to records, settings and access.
No system is perfectly secure. If we have reason to believe Customer Data has been accessed or acquired by someone not authorised to, we tell the customer immediately, as POPIA section 21 requires, and help it notify the regulator and the people affected. For information we control ourselves, we notify the regulator and the people affected as soon as reasonably possible.
Cookies and browser storage
We use only the cookies the Service needs to work. There are no analytics or advertising cookies, and no third-party tracking on our pages.
super_crm_session— keeps a staff member signed in. Lasts 7 days.super_crm_mfa— holds the first step of a two-step sign-in. Lasts 5 minutes.super_crm_portal_session— keeps a customer-portal user signed in. Lasts 7 days.run_dock_dismissed— remembers that a staff member closed the AI task panel. Lasts 7 days.
The staff app also keeps a few preferences in your browser’s own storage, such as whether the menu is pinned, a running timer and a chosen voice. They stay in your browser.
Websites and booking pages that customers build with the Service can include content from other services, such as YouTube (in its privacy-enhanced mode), Vimeo, Google Maps or OpenStreetMap. Those services may set their own cookies under their own policies.
Children’s information
Bridgebos is a business tool. It is not directed at children, and our own accounts are for adults acting for an organisation.
Schools and other customers may put children’s information into the Service — for example learners’ names, classes, family links, photos, sign-in and sign-out records, meal orders and dietary needs. For that information the customer is the responsible party. Under section 35 of POPIA it must have the consent of a competent person (usually a parent or guardian), or another lawful basis that section allows, before processing a child’s information, and it must meet the equivalent rules in other countries, such as Article 8 of the GDPR. If a customer gives children access to any part of the Service, the customer is responsible for that consent.
A parent or guardian with a question about a child’s information should contact the school or organisation first. You can also write to us at privacy@bridgebos.ai.
How to delete your information
If an organisation contacted you through Bridgebos — a school, a business or another customer of ours — ask that organisation to delete your information. It controls that information and can remove your record. If you cannot reach it, or do not know which organisation it is, write to privacy@bridgebos.ai with the email address or phone number the messages reached; we will pass your request to the organisation within 5 working days and help it act. To stop messages without deleting anything, use the unsubscribe link or reply STOP.
If you have a Bridgebos account, write to privacy@bridgebos.ai from the address on your account and ask us to delete it. If you use Bridgebos through your employer or school, we tell that organisation too, because deleting the account ends your access.
Timelines. We confirm we have your request within 5 working days and complete it within 30 days. When an organisation deletes a record in Bridgebos, it is removed from use at once; to have it erased from our database completely, the organisation can ask us, and we do so within 30 days. Copies in backups, once enabled, are deleted as those backups expire.
What we keep. If you opted out of messages, we keep your email address or number on a do-not-contact list so that you are not messaged again. We also keep what the law requires us or the organisation to keep, such as financial records.
Your rights
Depending on where you live, you may have the right to know what information we hold about you and get a copy; to correct it; to delete it; to object to or restrict some uses; to withdraw consent; to take your information to another service; and not to be subject to decisions made solely by automated means that have legal or similarly significant effects. The sections below set out the rights, and the regulator, in each place.
To use your rights, write to privacy@bridgebos.ai. We will confirm who you are before we act, and answer within the time the law that applies to you sets — for example one month under the GDPR, or 45 days under California law. We will not treat you differently for using your rights. If your request is about Customer Data, we will pass it to the customer concerned and help it answer. You can also complain to a regulator; we would appreciate the chance to help first.
South Africa
Under the Protection of Personal Information Act, 2013 (POPIA) you have the right to be told when information about you is collected; to ask whether we hold information about you and for a copy of it (section 23); to ask us to correct or delete it (section 24); to object to processing on reasonable grounds, and at any time to direct marketing (section 11); not to receive unsolicited electronic direct marketing except as section 69 allows; and not to be subject to a decision based solely on automated processing that affects you significantly (section 71).
Requests for access to records under the Promotion of Access to Information Act, 2000 (PAIA) can be sent to our Information Officer, Francois van Niekerk, at privacy@bridgebos.ai.
To complain, contact the Information Regulator at inforeg.org.za.
European Union and European Economic Area
Under the General Data Protection Regulation (GDPR) you have the rights of access, rectification, erasure, restriction, data portability and objection — including to direct marketing, at any time — and you may withdraw consent at any time without affecting processing that happened before.
The lawful bases we rely on under Article 6 are: performance of a contract (Article 6(1)(b)), to provide the Service; legal obligation (Article 6(1)(c)), for example keeping tax records; legitimate interests (Article 6(1)(f)), in keeping the Service secure and supporting customers, always weighed against your rights; and consent (Article 6(1)(a)), where we ask for it — including for our own marketing emails, unless the EU or UK electronic-marketing rules let us write to an existing customer about similar services.
Article 22 gives you the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. The AI in Bridgebos never decides on a job application or moves one on; its scores are advice for a person. Customers decide what the AI may do without a person’s approval, through their permission and auto-approve settings (see “AI features”), and a customer that uses AI in decisions about people is responsible for meeting Article 22.
To complain, contact the supervisory authority where you live or work, or where you think the law was broken. The European Data Protection Board lists them at edpb.europa.eu.
United Kingdom
Under the UK GDPR and the Data Protection Act 2018 you have the same rights, and we rely on the same lawful bases, as in the European Union section above, including the right not to be subject to solely automated decisions with legal or similarly significant effects.
To complain, contact the Information Commissioner’s Office at ico.org.uk.
United States
California. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the right to know what personal information we collect, use and disclose; to access, delete and correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights.
In the last 12 months we collected, for our own purposes, these categories: identifiers (such as name, email address, phone number and IP address); customer records (organisation and billing details); commercial information (subscriptions and payments); internet or network activity (sign-ins and actions in the Service); professional information (job role); and sensitive personal information limited to account sign-in credentials, used only to provide and secure the Service. We collect them from you, your organisation and our own systems, for the purposes in “How we use our own information”, and disclose them only to the service providers in “Services we use”.
We do not sell or share personal information, as the CCPA defines those terms, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of sale and sharing.
You, or an agent you authorise, can make a request at privacy@bridgebos.ai. We will verify the request before acting on it. If we decline it, you can appeal by replying to our answer. You can also contact the California Privacy Protection Agency at cppa.ca.gov, or the California Attorney General.
Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with comprehensive privacy laws have similar rights: to confirm whether we process their personal information, to access, correct and delete it, to get a portable copy, and to opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects. We do not sell personal information or use it for targeted advertising or such profiling. If we decline a request, you can appeal by replying to our answer, and if you are not satisfied with the outcome you can contact your state Attorney General.
Canada
Under the Personal Information Protection and Electronic Documents Act (PIPEDA) you can ask to access the personal information we hold about you and to have it corrected, and you can withdraw consent, subject to legal and contractual limits.
In Quebec, Law 25 also gives you the right to be informed about how your information is used, to data portability, to have information de-indexed, and to be told when a decision about you is made solely by automated processing. The person in charge of the protection of personal information is our Information Officer, Francois van Niekerk.
To complain, contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or in Quebec the Commission d’accès à l’information at cai.gouv.qc.ca.
Australia
Under the Privacy Act 1988 and the Australian Privacy Principles you can ask to access and correct the personal information we hold about you. Personal information may be disclosed overseas — including to South Africa, where it is stored — as described in “International transfers”.
To complain, write to us first at privacy@bridgebos.ai; we will answer within 30 days. If you are not satisfied, contact the Office of the Australian Information Commissioner at oaic.gov.au.
Brazil
Under the Lei Geral de Proteção de Dados (LGPD, Law 13,709/2018) you have the right to confirmation that we process your data; to access it; to correct it; to anonymisation, blocking or deletion of data that is unnecessary, excessive or unlawfully processed; to portability; to information about whom we share it with and about the consequences of refusing consent; and to revoke consent. Our Information Officer, Francois van Niekerk, is our contact person (encarregado).
To complain, contact the National Data Protection Authority (ANPD) at gov.br/anpd.
India
Under the Digital Personal Data Protection Act, 2023 you have the right to a summary of the personal data we process and whom we share it with; to have it corrected, completed, updated or erased; to have a grievance addressed; and to nominate someone to exercise your rights if you die or cannot act.
Send a grievance to privacy@bridgebos.ai. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Japan
Under the Act on the Protection of Personal Information (APPI) you can ask us to disclose the personal information we hold about you and our records of providing it to third parties, and to correct, add to or delete it, or to stop using it or providing it to third parties. Information is transferred to South Africa and other countries as described in “International transfers”; you can ask us for details of the safeguards.
To complain, contact the Personal Information Protection Commission at ppc.go.jp.
Singapore
Under the Personal Data Protection Act 2012 (PDPA) you can ask to access and correct your personal data, and withdraw your consent on reasonable notice. Personal data transferred outside Singapore is protected to a standard comparable to the PDPA.
To complain, contact the Personal Data Protection Commission at pdpc.gov.sg.
Nigeria
Under the Nigeria Data Protection Act 2023 you have the rights to be informed, to access, to rectification, to erasure, to restrict processing, to object, to data portability, to withdraw consent, and not to be subject to a decision based solely on automated processing.
To complain, contact the Nigeria Data Protection Commission at ndpc.gov.ng.
Kenya
Under the Data Protection Act, 2019 you have the rights to be told how your personal data is used, to access it, to object to its processing, to have false or misleading data corrected, and to have false, misleading or unlawfully processed data deleted.
To complain, contact the Office of the Data Protection Commissioner at odpc.go.ke.
Other countries
Wherever you live, you have the rights your local law gives you, and we will honour them. Write to privacy@bridgebos.ai. You can also complain to the data protection authority in your country.
Changes to this policy
We update this policy when the Service or the law changes. The date at the top shows the current version. If a change matters to customers, we will tell them in advance by email or in the Service.
Contact us
- Privacy and legal requests: privacy@bridgebos.ai
- Information Officer: Francois van Niekerk
- The Cutting Edge Group CC, registration number 2009/036136/23, South Africa.
- Registered address: 57 Main Road, Paarl, Western Cape, South Africa.