Privacy and POPIA Notice
Last updated 18 August 2026
This notice explains what personal information Ten Thousand Businesses collects, why, who we share it with, and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).
1. Who is responsible
Ten Thousand Businesses is the responsible party for the information described here. Contact: privacy@10thousand.co.za
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, email, mobile number, role, password (stored encrypted, never in readable form) | To create and secure your account |
| Business | Business name, registration number, sector, province, turnover, employees, ownership percentages, trading history | To match you to funding you may qualify for |
| Documents | CIPC registration, tax clearance, B-BBEE affidavit, financial statements, bank statements you choose to upload | To show you which programmes you qualify for, and to provide them to a funder when you ask us to |
| Activity | Programmes you view or watch, questions you ask the coach, applications you record | To improve matching, and to research questions we could not answer |
| Payment | Transaction reference, amount, date and outcome | To confirm what you have paid for |
3. Why we are allowed to process it
- To perform our agreement with you — you asked us to match you to funding, so we must process your business information to do it.
- Your consent — we share your business information with a specific funder, corporate or member only when you tell us to. You may withdraw that consent at any time.
- Our legitimate interest — keeping the platform secure and preventing fraud.
- Legal obligation — where a law requires us to keep or produce records.
4. Who we share it with
| Who | What | When |
|---|---|---|
| Funders and investors | Your business information and the documents you have uploaded | Only when you ask us to introduce you, or agree to an introduction |
| Corporates running a supplier development programme | Your supplier information and assessment | Only if you have joined that programme |
| Other members | What you choose to publish — your directory listing, service listing or business card | When you publish it |
| Payfast (Payfast by Network) | Your name, email address and the transaction amount, so that a payment can be processed and confirmed | When you make a payment |
| Supabase | Hosting of the database that stores this information | Continuously, as our processor |
| Netlify | Hosting of the website and application | Continuously, as our processor |
We do not sell your personal information. We do not share it with advertisers.
5. Where it is stored
Our database and hosting providers may store information on servers outside South Africa. Where information leaves the country we rely on the provider's contractual safeguards, as POPIA permits.
6. How long we keep it
- Account and business information: while your account is open, and for three years afterwards.
- Documents you upload: until you delete them, or your account closes.
- Payment records: five years, as tax law requires.
- Coach questions: retained without your name attached, so we can research what members need.
7. Your rights under POPIA
- Ask what we hold about you.
- Correct anything wrong.
- Ask us to delete it, where we are not required to keep it.
- Object to processing.
- Withdraw consent to an introduction or a share.
- Complain to the Information Regulator of South Africa.
To exercise any of these, email privacy@10thousand.co.za. We will respond within 30 days.
8. Security
Access rules are enforced inside the database itself, not in the web page, so one member cannot reach another member's information even by altering the page in their browser. Passwords are stored encrypted. Connections are encrypted in transit.
9. Children
The platform is for people aged 18 and over. We do not knowingly collect information from children.
10. Changes
We will notify you in the platform if this notice changes materially.