Privacy policy

What we collect, and why

When you browse: a random session identifier, your market choice and your bag. These are essential; the shop cannot hold a bag or a market without them, and none of them says who you are.

Where you are browsing from: the country of your connection, read from the request so the site can show the store that delivers to you. If we do not deliver to your country the site says so in one line and remembers the answer for a day. We keep the country, never the address of your connection.

When you order, ask for a quote, join the waitlist or apply as a dealer: your name, contact details and delivery or trading address, used to build, deliver, fit and support what you bought and kept for the five-year warranty and for as long as tax law requires records to be held. A phone number given on the waitlist is stored sealed and opened only for staff.

When you type an address at checkout or on the dealer application: what you type is sent to Google Places to find the address, and Google receives it under its own terms. You can type the address in full instead and nothing is sent.

With Measurement on the cookie bar: an anonymous attribution cookie that remembers which campaign first brought you here, so we know which advertising is worth paying for, and Google Analytics. The cookie is random, it is not derived from anything about you, and it is never joined to your identity without a separate, recorded consent.

Also with Measurement: when an order you placed is paid, or you ask for a quote or send us an enquiry, our server tells Google Analytics, because a payment often arrives after you have left the site. It sends the random id Google Analytics gave your browser, the order or quote number, the kind of enquiry, the products and the amount. It never sends your name, email address, phone number or address.

Also with Measurement: Microsoft Clarity records how pages are used, as a replay of the page, the cursor, scrolls and clicks, and as heatmaps. Before anything is uploaded, every box you type into, every number and every email address on the page is replaced with a mask character, and the checkout, the waitlist form and the contact form are masked whole; a recording never contains a name, an address or an amount you entered. Recordings are kept by Microsoft for 30 days, heatmaps for 13 months, in Microsoft’s Azure cloud. Microsoft Corporation is in the United States, so this is a disclosure of information overseas under section 72 of POPIA, made only with your consent. Turning Measurement off stops recording at once and removes Clarity’s cookies.

With Advertising on the cookie bar: we tell Meta (Facebook and Instagram) what you looked at, put in your bag, asked us for and bought, so the adverts you see follow your interest, stop once you have bought, and so we can measure which adverts led to a sale.

What Meta receives, and how

The event (a product viewed, a bag, a quote, an order, a payment, a fitting booked or done), the products and the amount, the page it happened on, your IP address and browser, and the identifiers Meta’s own code sets in your browser.

Where you have given them to us: your email address, phone number, name, suburb, state, postcode and country. Each is hashed with SHA-256 before it leaves, so Meta receives a fingerprint it can match against its own accounts, never the words. A hashed email is still personal information and we treat it as such.

Half of this goes from your browser through Meta’s pixel and half from our server, with one shared event id, so each event is counted once. Nothing is sent without your Advertising consent, and a payment or a fitting that happens weeks after your visit is sent only if that consent stood when you placed the order.

Meta Platforms, Inc. is in the United States. This is a disclosure of personal information overseas under section 72 of POPIA, made on Meta’s Business Tools terms and only with your consent. Our own copy of what was sent is kept for seven days for a website event and 62 days for a fitting, then deleted.

Who else handles it

Our site and our database are hosted in Sydney, Australia (Vercel and Supabase), and email is sent through Resend in the United States. Each processes your information on our instructions and under a contract, and each is a transfer outside South Africa under section 72 of POPIA, to a recipient bound by a written agreement. Nothing is sold or rented, and no other advertising network runs on this site.

A support query you send us is kept on your query, with our replies, so the next person who answers you can read what was said.

The cookies themselves

bt_sid: a random session identifier. Essential; one year.

bt_consent: your answer on the cookie bar, so we do not ask again. One year.

bt_geo: the country of your connection, set only when we do not deliver there, so the one-line notice does not have to be worked out on every page. One day.

bt_customer and bt_dealer: your signed-in session on the customer account or the dealer portal, set only after you sign in with a one-time link. Thirty days and fourteen days.

bt_attr: which campaign brought you here. Only with Measurement, one year, and declining removes the choice at the door rather than after collection.

_fbp and _fbc: set by Meta’s pixel, only with Advertising. _fbp identifies your browser to Meta for 90 days; _fbc records the Meta advert you clicked, for 90 days.

_ga and _ga_ followed by our property id: set by Google Analytics, only with Measurement, for two years. They tell Google which visits are one browser and which pages are one visit.

_clck and _clsk: set by Microsoft Clarity, only with Measurement. _clck remembers your browser to Clarity for one year; _clsk joins the pages of one visit into one recording for one day.

Microsoft also sets its own cookies on its domains when Clarity loads (MUID and four companions), only with Measurement. They identify your browser to Microsoft across the sites that use its services; we do not read them.

bt_staff and bt_staff_preview exist only for signed-in Bushtech staff and are never set for customers.

Saying no, and changing your mind

Choose Manage on the cookie bar and leave Advertising off: no pixel loads, nothing is sent to Meta, and nothing is kept to send later. Choosing Only necessary does the same for everything but the essential cookies.

To change an answer you have given, choose Cookie settings at the foot of any page: the bar comes back with your current answer ticked. Turning Measurement off removes the attribution cookie and Google’s cookies; turning Advertising off removes Meta’s and stops every future event. Neither can recall an event already sent, which Meta then holds on its own terms; Meta’s ad preferences at facebook.com/ads/preferences control what Meta does with it.

If your browser sends Global Privacy Control we treat that as a decline and the cookie bar never asks.

Your rights

Under POPIA you may ask what we hold about you (section 23), ask for it to be corrected or deleted (section 24), and object to processing, including direct marketing (sections 11 and 69). Deletion covers what we no longer need or should not hold; a tax invoice is kept for five years because the law requires it, with your name removed where it allows. You may also complain to the Information Regulator.

The quickest way is Your data: enter your email, open the link we send, and choose what you want done. We answer within 30 days; stopping marketing email takes effect at once.

Or write to info@bushtech.co.za, on Form 1 (objection) or Form 2 (correction or deletion) of the POPIA Regulations, from the Information Regulator, if you prefer; the online page asks the same things. Our PAIA manual names the Information Officer. Requests about a dealer account go through the same address.