Privacy Policy

Buzz Communities (Pty) Ltd t/a JollyBee (hereafter referred to as “JollyBee”) provides software as a service in the form of a community management platform (“Platform”) that provides a dynamic suite of digital tools and services to assist Community Owners in the administration, monetisation, and engagement of their respective communities. In order for JollyBee to provide its services, it is required to process personal information of data subjects, specifically their customers, service providers and employees. This policy covers the people who use the Platform; our privacy policy for service providers covers our service providers and suppliers.

JollyBee constitutes a Responsible Party and is required to handle personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). POPIA aims to give effect to the constitutional right to privacy by balancing the right to privacy against that of the right to access to information. POPIA requires that personal information pertaining to individuals be processed lawfully and in a reasonable manner that does not infringe on the right to privacy. As a Responsible Party, JollyBee is committed to protecting your right to privacy. The purpose of this Privacy Policy is to set out how we collect, use, share and otherwise process your personal information, in accordance with POPIA.

We, us and our

Buzz Communities (Pty) Ltd t/a JollyBee, Registration Number 2024/689754/07.

You and your

means any data subject as defined by POPIA which includes but is not limited to a user of any of our products or services / any supplier, vendor or service provider / any employee and prospective employee.

Your personal information

Includes, but is not limited to, first name, surname, phone number, identity number; payment information and banking details and user generated content generated by you on the Platform. Personal information is not general, statistical, aggregated or anonymised information.

Process information

means the automated or manual activity of collecting, recording, organising, storing, updating, distributing and removing or deleting personal information.

A data subject is the person to whom the personal information relates. This may be a natural person or a juristic person. For purposes of this Privacy Policy, JollyBee has identified five categories of data subjects, namely:

1. Prospective Users (section 4);
2. Members (section 5);
3. Guest Users: guest purchasers (section 6) and guest event attendees (section 7);
4. Community Owners & Administrators (section 8);
5. Community Groups (section 9).

Each of these data subjects will be dealt with separately in the headings below.

We are the Responsible Party for your login credentials and your JollyBee account profile (see section 3). Our Terms of Service set out your responsibility for keeping your sign-in credentials secure. We determine the purpose for which your account information and login credentials are processed to provide you with access to the Platform. All other information inputted, shared or managed within the platform by whichever community group you form part of is determined and controlled by the Community Group. For this data we act purely as an Operator, processing the information solely on their behalf and according to their instructions.

If a third party asks us for any of your personal information, we will share it with them only if:

We shall, as far as possible, always collect your personal information directly, save where your information is collected from a public source, or with your written consent. If we collect personal information from a source other than you, we shall record in writing the details of that source, including the full names and contact details of that source where applicable. We may collect personal information from you at any time you interact with our website, or send us an enquiry, when you complete information, when you request goods or services, send an e-mail enquiry, provide a review, when requesting further services, or when making a complaint. A community you deal with can also give us information about you, as its operator (see section 3).

For purposes of retention, we distinguish between natural person users and Community Groups.

We have physical, technological and procedural security safeguards in place and will do our best to ensure the protection of your personal information. We will take all reasonable steps to prevent the loss, abuse or misuse of your personal information. We will review our security controls and related processes on a continuous basis, to ensure that your information remains secure. These safeguards include:

• The website, app and terminals talk to JollyBee over encrypted HTTPS connections, and browsers are told to use only HTTPS.
• Browser security headers stop other sites from framing our pages.
• Your sign-in session is kept in a cookie that page scripts cannot read and that is sent only over HTTPS. It lasts 30 days and is renewed while you use JollyBee.
• Database access rules limit each person to their own records and each community’s team to its own community, according to the permissions the community gives them.
• Card numbers never pass through JollyBee. Card tokens saved for members’ payments are kept where only our server can read them. A community’s payment provider keys and an identity number on your account profile are stored encrypted.
• Sign-up and sign-in are rate limited, and suspicious new accounts are held for review.
• Our test environment is a separate database that is never refreshed from live. The copy of live records it was created from on 8 October 2026 was replaced with made-up details on 9 November 2026, apart from our own staff test accounts. It uses different encryption keys, so stored payment credentials cannot be read there.

No system is completely secure. If you think your account has been misused, contact our Information Officer.

In the event of a data breach, where personal information has been compromised, we will notify the Information Regulator and the data subject as soon as possible, as POPIA section 22 requires. We notify the Regulator through its eServices portal. Where we process the information for a community as its operator, we tell the community straight away (section 21(2)) and help it notify the Regulator and the people affected. Communities can also keep a breach register in the JollyBee console. The notification of breach will be in writing in one of the following ways:

We will only provide you with direct marketing in the instance that you subscribe to our mailing list or opt in on the website and / or app. You may opt out of direct marketing at any time by unsubscribing from our mailing list or opting out on the website and / or app.

Communities send their own marketing through JollyBee. POPIA section 69 allows marketing by email, SMS, WhatsApp or push notification only with your consent, or to an existing customer who was given a chance to refuse it. On JollyBee:

• Since 29 October 2026, everyone who joins JollyBee or a community starts with marketing off on email, SMS, WhatsApp and push. For them, only a yes from you, or one recorded by the system a community imports you from, turns a channel on. The marketing box at guest checkout starts unticked.
• You can change your choice for each channel at any time: in your profile on the community’s page, in the app’s communication preferences, or on the preferences page linked from a message.
• Every marketing email has an unsubscribe link.
• If a community has its own MailerLite account start a flow when someone buys tickets in its raffles, those buyers are sent there too, marked as not having said yes to email news (see 10.5). Opting out unsubscribes you there too.
• Messages about something you bought or booked, sign-in codes and security notices are not marketing, so they do not need a marketing yes. If you have opted out, we also leave out renewal reminders, invitations to sign in and requests to update your details.

You have the right to know what personal information we hold about you, and asking whether we hold it is free (POPIA section 23). If you wish to receive a copy of the information, you will have to lodge a request with our information officer via e-mail; you can also download what a community holds about you yourself (see below). We will take all reasonable steps to confirm your identity before providing details of your personal information. A copy may carry the access fee prescribed under the Promotion of Access to Information Act (see our PAIA manual), and we will let you know what it is at the time of your request, before we do the work.

You have the right to ask us to update, correct or delete your personal information. We will require proof of identification or authority prior to making any of the requested changes. If you are aware of any personal information in our custody which is incorrect, inaccurate or which needs to be updated, you can update your JollyBee profile yourself on your profile page, or make a written request to our information officer at phil@jollybee.buzz to update or correct the relevant information. If you contest the accuracy of any personal information being used by us, we shall immediately stop using that information until its accuracy has been verified.

Under POPIA you can also:

• ask us to correct, delete or destroy information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we may no longer keep (section 24). This is free. The regulations require us to tell you in writing what we did within 30 days;
• object to processing based on a legitimate interest (section 11(3)(a)), and object to direct marketing at any time (section 11(3)(b));
• withdraw a consent you gave, which does not affect processing before then;
• ask for a person to review a decision made solely by automated processing that affects you substantially (section 71);
• complain to the Information Regulator (section 74; see section 20).

You can do much of this yourself:

• update your JollyBee profile on your profile page;
• in a community’s “Your data & privacy” section, download what it holds about you, see your marketing-consent history and ask to be erased;
• change your marketing choices per channel in your preferences;
• ask for your whole account to be deleted on our account deletion page.

For anything else, email our Information Officer at phil@jollybee.buzz. You can use the Information Regulator’s Form 1 (objection) or Form 2 (correction or deletion), or write to us with the same details. We check that a request comes from you before acting on it. A request about a community’s records goes to that community, and we help it respond.

We may change this Privacy Policy at any time. The most updated version will always be published on this page, with the date at the top, and is available upon request. Earlier versions are available from our Information Officer on request.

If you believe that we have used your personal information contrary to this Privacy Policy or in contravention of POPIA, we ask that you first attempt to resolve any concerns with us. You also have the right to lodge a complaint with the Information Regulator in accordance with POPIA at any time, whether or not you have contacted us first.

Please contact the Information Regulator at:

• The Information Regulator (South Africa)
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Post: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Tel No.: 010 023 5200; toll free 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• Complaints: on POPIA Form 5, through the Regulator’s eServices portal or by e-mail to POPIAComplaints@inforegulator.org.za (see the Regulator’s complaints page)
• Website: inforegulator.org.za

JollyBee uses AI models from Anthropic (Claude) for features a community switches on and for some of our own work. These features send the information they need to the model provider:

• Drafting text and layouts for a community’s team: offerings, tours from documents, newsletters, print designs, product and class timetable imports, and an assistant in the console.
• Replies to WhatsApp messages sent to a community, if it switches this on. The community chooses the model, which can be from Anthropic or OpenAI.
• Member insights: if a community switches them on, a nightly job reads each person’s purchases, visits and holdings with that community and suggests interests and favourite products. The lifecycle stage (such as new, active or lapsing) is worked out by fixed rules, not by the model, except for a person with no dated activity, for whom the model’s estimate is kept. The community can use these to choose who receives its messages.
• Reading documents: receipts uploaded for loyalty rewards, identity documents at the till or on a registration form, and a business’s documents when our team verifies it.
• Reviewing proof of eligibility: if a community chooses automatic review for a membership that needs proof (for example, a student card), the model can approve or decline the application, or pass it to the community’s team. If a decision was made this way, you can ask the community to have a person review it and tell you why.

Under their commercial terms, Anthropic and OpenAI do not use this information to train their models. Anthropic deletes what it receives through its API within 30 days, except where its own policy allows longer, such as content flagged for misuse. The models may run outside South Africa.

We use AI-assisted engineering tools (Anthropic’s Claude) to build and support JollyBee. These sessions run on our own systems under our control. When diagnosing a fault, a session can read live records, including personal information. Our rules for these sessions allow reading live records only, and forbid changing them or sending messages to real people.

With your device permission, JollyBee accesses approximate or precise location (latitude and longitude). Route recording also collects timestamps and, where available, altitude, speed and location accuracy. Bluetooth beacon detection can identify that you are near a particular community location or partner venue. The location features you use determine which information is processed:

• Nearby discovery and maps: show your position and help you find nearby communities, events and partner venues. You can also provide a location for your profile or a community listing.
• Route recording: record a ride, walk or tour you start, display its route, and calculate distance, duration, speed and elevation. You can choose to save the route to a community, export it or share it.
• Automatic check-in and community activities: detect entry to or departure from a configured area to record attendance, support session check-ins and reminders, and record progress through trails or checkpoints.
• Partner rewards: recognise visits to participating venues for loyalty activities and rewards.
• Nearby offers: use arrival at or departure from a configured area, or proximity to a Bluetooth beacon, to deliver relevant community or partner offers and promotional notifications when you enable this feature.

Location data is processed on the ground of your consent, given through your device’s permission prompt (POPIA section 11(1)(a)).

JollyBee collects and uses location data in the background, even when the app is closed or not in use, to support the background location features you enable and permit on your device. These include automatic check-in, partner rewards, session reminders and nearby offers based on entering or leaving a configured area. With background route recording enabled, a recording you start can continue while you use another app or your screen is locked.

Area monitoring reports entry and exit events rather than continuously uploading a GPS route to JollyBee. A continuous route is recorded when you start a route recording. Android displays a foreground-service notification while background route recording is active. Bluetooth beacon scanning takes place while the app is in the foreground.

• On your device: the app keeps your last retrieved location and a local backup of an active route recording so it can be recovered after an interruption.
• With JollyBee and your community: entry and exit reports identify the area or beacon and are linked to your record with that community. Area reports can include the configured area’s coordinates. We store check-in and activity records on our servers; authorised community administrators can use these records for attendance, community activities, rewards and offers.
• Workouts you record: a workout you save in the app or from a paired watch is stored on our servers, with its GPS track if it has one. It is private to you. You can share a summary with a community, never the track. Deleting a workout removes it and its track.
• Routes you publish or share: saving a recording to a community uploads its route coordinates to JollyBee. Routes saved this way are public and downloadable by default, so others can see the places along your route. Exporting or sharing a route or route image also reveals location information to the recipients or audience you choose.
• Map services: JollyBee uses Mapbox to display maps and create route images. Map requests send information such as the requested map area, IP address and device information to Mapbox. Creating a route image for a feed post sends sampled route coordinates to Mapbox. Its mobile map software can also receive device location and usage information when location access is permitted, for providing and improving its services. See the Mapbox Privacy Policy.
• Service providers: hosting, database and notification providers process information needed to store these records and deliver location-related services and messages. JollyBee does not sell your personal information, including your location data.

Location features are optional. You can turn each one on or off in the app on the Location & Beacons screen (in the app’s menu, under Account & Support), and change or revoke location and Bluetooth permissions in your device settings. Denying permission limits the features that depend on it; you can still use other parts of JollyBee. Use Pause, Stop or Discard on the route-recording screen to end an active recording’s location updates. Turning off a feature or revoking permission does not delete records already saved or shared.

Some communities ask for health information, such as medical aid details, allergies, chronic medication, blood type or answers to an event’s health questions, and some ask about ethnicity. POPIA calls these special personal information (section 26). The community decides which questions to ask and whether an answer is required. It may process them only on a ground in section 27, usually your consent (section 27(1)(a)), or, for health information, a ground in section 32. If you are unsure why a community asks, ask it before you answer.

At some tills and registration forms, staff or you can photograph an identity document so that the name, date of birth and other details are filled in automatically. The image is sent to our AI provider to be read and is not stored by JollyBee.

Children’s information is covered in section 5.6.