Growth Logic — Privacy Policy (Review Booster)

Growth Logic (Pty) Ltd ("Growth Logic," "we," "us") is committed to protecting personal information in line with the Protection of Personal Information Act, 2013 (POPIA). This policy explains what personal information we process through Review Booster, why, and your rights.

1. Who we are

Growth Logic (Pty) Ltd, registration number 2024/828057/07, a company registered in South Africa.

Information Officer: Sadiq Munshi, contactable at sadiq@growthlogic.co.za.

Address: 5 Gorse Road, Robertsham, 2091.

2. The two roles we play

Review Booster processes personal information in two distinct capacities, and your rights differ depending on which applies:

• As responsible party — for the personal information of our own customers (the businesses who subscribe to Review Booster). We decide how and why this information is processed.
• As operator — for the personal information of your customers (the end users who receive review requests). When a subscribing business uploads or sends us an end user's name and number, that business is the responsible party and remains responsible for having a lawful basis and consent to contact them. We process that end-user information only on the business's instruction, to deliver the service. We do not use it for our own purposes.

If you are an end user who received a Review Booster message and want your information corrected or deleted, contact the business that messaged you in the first instance as they control that data. We will assist that business in giving effect to your request.

3. What we collect

From subscribing businesses (we are responsible party):

• Account details: name, business name, email, mobile number.
• Billing information: processed via PayFast; we do not store your full card details.
• Usage data: log-ins, review requests sent, ratings received, dashboard activity.

From/about end users (we are operator, on the business's instruction): the name and mobile number as supplied by the subscribing business; the rating the end user gives (1–5) and any feedback they send in reply; and message delivery status. We do not knowingly collect special-category personal information (e.g. health, race, religion) or the personal information of children through Review Booster.

4. Why we process it, and our lawful basis

We process personal information to:

• Provide the Review Booster service by sending review requests and routing responses (performance of our contract with the business; and, for end users, on the instruction of the business who holds their consent).
• Take payment and manage your subscription (contract).
• Maintain the dashboard, statistics, and duplicate-contact protection (legitimate interest in providing and securing the service).
• Comply with legal obligations and respond to lawful requests.
• Communicate with subscribing businesses about the service (contract / legitimate interest).

We rely on the subscribing business's confirmation that it has the end user's consent to be contacted. We do not obtain that consent ourselves.

5. Who we share it with (operators we use)

We use trusted third parties to run the service. Each processes personal information only as needed to provide their function:

• WaSender — message delivery over WhatsApp.
• PayFast — payment processing.
• Vercel and Supabase — hosting the application and storing data.
• Google — end users who choose to leave a review do so on Google's platform, subject to Google's own privacy terms.

We do not sell personal information, and we do not share it for third-party marketing.

6. Cross-border transfers

Some of our service providers (e.g. Vercel, Supabase, WaSender) may process or store personal information outside South Africa. Where this happens, we take reasonable steps to ensure the information receives a level of protection comparable to POPIA, through the provider's data-protection commitments and applicable contractual safeguards. By using Review Booster, subscribing businesses acknowledge this transfer and confirm they have the necessary basis to permit it for their end users' information.

7. How long we keep it

We keep personal information only as long as needed for the purposes above:

• Business account and billing data: for the life of the account and as long afterwards as law requires (e.g. tax records).
• End-user data: for as long as needed to provide the service to the business, including the three-month duplicate-contact window, after which it is retained or deleted in line with the business's instructions and our retention schedule.

We delete or anonymise personal information when it is no longer needed.

8. How we protect it

We apply reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and misuse, including access controls, secure hosting, and encryption in transit. No system is perfectly secure; in the event of a compromise affecting personal information, we will notify the Information Regulator and affected parties as POPIA requires.

9. Your rights under POPIA

Subject to the roles described in section 2, you have the right to:

• Ask what personal information we hold about you and request access to it.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, or out of date.
• Object to processing in certain circumstances.
• Withdraw consent (where processing relies on consent), without affecting past lawful processing.
• Lodge a complaint with the Information Regulator.

To exercise these rights, contact our Information Officer at sadiq@growthlogic.co.za. End users should first contact the business that messaged them (see section 2).

10. The Information Regulator

You may contact the Information Regulator (South Africa). Website: inforegulator.org.za

11. Changes

We may update this policy as our service or the law changes. Material changes will be communicated via the dashboard or email, and the "last updated" date above will change.

12. Contact

Growth Logic (Pty) Ltd · Information Officer: Sadiq Munshi – sadiq@growthlogic.co.za