PRIVACY
POLICY

We keep it straight: this document tells you exactly what personal information we collect, why we collect it, how we protect it, and what rights you have over it — in plain language, not legalese.

Effective: 1 May 2026
Jurisdiction: South Africa · POPIA
BlakFire Management Solutions
// Contents
// 01
Who We Are

BlakFire Management Solutions ("BlakFire", "we", "us", "our") is an IT services company registered in South Africa and based in Gauteng. We provide Microsoft 365 setup and management, Power Apps development, custom web application development, Intune device management, and technology consulting services.

We operate the public marketing website at www.bfms.co.za and a secure client project portal at client-portal.bfms.co.za (the "Portal"). This Privacy Policy applies to both.

For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), BlakFire Management Solutions is the Responsible Party — the entity that determines the purpose and means of processing your personal information.

Information Officer contact: hello@bfms.co.za · +27 83 770 6388
Gauteng, South Africa
// 02
What Data We Collect

We only collect information that is necessary to provide our services or respond to your enquiries. Below is a full breakdown of every category of personal data we process.

A — Website Contact Form (www.bfms.co.za)

When you submit an enquiry through our website contact form, we collect:

FieldWhy it's collectedStored in database?
Full NameTo address you correctly in our replyNo — emailed to us only
Email AddressTo respond to your enquiryNo — emailed to us only
Company NameOptional context for your enquiryNo — emailed to us only
Service InterestTo route your enquiry appropriatelyNo — emailed to us only
MessageThe content of your enquiryNo — emailed to us only

Contact form submissions are delivered to our internal inbox via PHP mail() and are not stored in any database. We also send you an auto-confirmation email to acknowledge receipt.

B — Client Portal Accounts (client-portal.bfms.co.za)

Portal accounts are created by BlakFire staff — clients do not self-register. When we create your account and during the course of delivering your project, we process the following:

Data CategorySpecific FieldsPurpose
Account identity Full name, email address, username Authentication and personalisation
Contact details Phone number, company name Project communications and invoicing
Session metadata Last login timestamp, timezone Security and session management
Project data Project name, description, service type, dates, financial amounts Project delivery and progress tracking
Documents File name, file type, file size, storage path, upload/review metadata Document exchange required for project delivery
Notes & communications Message body, author name, timestamp Project communication records
Activity log Event type, description, actor name, role, IP address, timestamp Security audit trail and project accountability
Notifications Title, body text, read status Keeping you informed of project updates
Password Bcrypt hash only (never stored in plain text) Authentication
We never store payment card numbers, banking details, or South African ID numbers in our systems. Financial transactions are handled through separate, certified payment processors.
// 03
Why We Collect It

Under POPIA, we must have a lawful basis for processing your personal information. We rely on the following grounds:

Processing ActivityLawful Basis
Responding to website enquiriesLegitimate interest / pre-contractual steps at your request
Delivering contracted project servicesPerformance of a contract to which you are a party
Portal authentication and securityLegitimate interest in protecting our systems and your data
Audit logging including IP addressesLegitimate interest in security and accountability
Sending project notificationsPerformance of a contract / legitimate interest
Auto-acknowledgement emailsLegitimate interest in good customer communication

We do not send marketing emails, newsletters, or promotional communications unless you have explicitly consented to receive them. We do not use your data for profiling, automated decision-making, or advertising purposes.

// 04
Cookies & Session Data

We keep our use of cookies to the absolute minimum required for functionality. We do not use advertising cookies, tracking pixels, or analytics cookies of any kind.

Cookies we set:

Browser storage we use:

No cookie consent banner is displayed because we set no analytics, advertising, or non-essential cookies. The only cookie we set (bos_session) is strictly necessary for portal login and is exempt from consent requirements under POPIA. You are free to disable cookies in your browser, but doing so will prevent you from signing into the client portal.
// 05
Third-Party Services

Our website and portal load resources from the following third-party CDN providers. These are limited to fonts and icons — we use no analytics, advertising, or social-tracking scripts.

ProviderWhat Is LoadedTheir Privacy Policy
Google Fonts
fonts.googleapis.com
Bebas Neue, Rajdhani, JetBrains Mono typefaces. When your browser requests a font file, Google's servers receive your IP address and browser user-agent. No cookies are set by Google Fonts. policies.google.com/privacy
Cloudflare CDN
cdnjs.cloudflare.com
Font Awesome icon library. Cloudflare may log your IP address as part of CDN delivery. No tracking cookies are set. cloudflare.com/privacypolicy

We do not use Google Analytics, Meta Pixel, LinkedIn Insight Tag, HotJar, Intercom, or any other behavioural tracking or analytics service on any of our pages.

Our web hosting is provided through a South African cPanel hosting environment. Your data resides on servers in South Africa unless you have uploaded documents hosted on an external storage provider (e.g. Google Drive, SharePoint, Dropbox) — in which case that provider's own privacy policy applies to those files.

// 06
How We Store & Protect It

We take the security of your personal information seriously and implement technical and organisational measures appropriate to the risk, including:

  • Encrypted transport: All pages are served exclusively over HTTPS (TLS). HTTP requests are automatically redirected to HTTPS via server-level rules.
  • Password hashing: Passwords are stored using bcrypt with a cost factor of 12 — never in plain text or reversible formats.
  • CSRF protection: All Portal form submissions and API calls are protected by cryptographically-random per-session CSRF tokens.
  • Hardened session cookie: The bos_session cookie is flagged HttpOnly, Secure, and SameSite=Strict — preventing cross-site request forgery and JavaScript-based cookie theft.
  • Error suppression: PHP errors and stack traces are never displayed to the browser. All errors are written to a private server-side log file.
  • Directory protection: Sensitive files (config, auth helpers, SQL schema) are blocked from direct browser access via .htaccess deny rules.
  • Principle of least privilege: Portal database credentials are scoped to the minimum permissions required for application operation.
  • Input sanitisation: All user inputs are validated and sanitised server-side before use in database queries (PDO prepared statements throughout).
No method of transmission over the internet or electronic storage is 100% secure. While we implement industry-standard protections, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator as required by POPIA.
// 07
How Long We Keep It
Data CategoryRetention PeriodReason
Contact form enquiriesRetained in our email inbox — typically 3 yearsBusiness records and follow-up
Portal account dataDuration of the client relationship + 3 years after project completionLegal and contractual obligations
Project records, documents, notes3 years after final project sign-offDispute resolution and contractual obligations
Activity log (including IP addresses)12 months rollingSecurity audit and fraud prevention
Session data2 hours from last activityAuthentication — automatically expired
Portal notifications6 months after creationOperational — no longer relevant after this period

When retention periods expire, data is securely deleted or anonymised. You may request earlier deletion — see Section 9 (Your Rights) below.

// 08
Sharing Your Information

We do not sell, rent, or trade your personal information to any third party.

We may disclose your information in the following limited circumstances:

  • Service delivery: We may share project-relevant information with contractors or sub-processors engaged to deliver your specific project (e.g. a specialist developer). Any such parties are bound by confidentiality obligations no less protective than this policy.
  • Legal obligation: We may disclose information where required by South African law, court order, or regulatory authority — including the Information Regulator.
  • Business transfer: In the unlikely event of a merger or acquisition, your information may be transferred to the new entity, which will be required to honour this policy or notify you of any changes.
// 09
Your Rights (POPIA)

As a data subject under POPIA, you have the following rights regarding your personal information:

  • Right of access: You may request a copy of the personal information we hold about you.
  • Right to correction: You may ask us to correct inaccurate or incomplete personal information.
  • Right to deletion: You may request that we delete your personal information, subject to any legal retention obligations we must satisfy.
  • Right to object: You may object to the processing of your personal information where it is based on legitimate interest.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to complain: You have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have processed your information unlawfully.
To exercise any of these rights, email us at hello@bfms.co.za with the subject line "POPIA Request". We will respond within 30 days. We may need to verify your identity before processing the request.

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001
www.justice.gov.za/inforeg · inforeg@justice.gov.za

// 10
Children

Our services are intended for use by businesses and adults. We do not knowingly collect personal information from persons under 18 years of age. If you believe a minor has submitted personal information to us, please contact us immediately at hello@bfms.co.za and we will delete it promptly.

// 11
Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do:

  • The "Effective Date" at the top of this page will be updated.
  • For material changes that affect how we use your data, we will notify active portal clients via the in-portal notification system.
  • Your continued use of our website or portal after the effective date constitutes acceptance of the revised policy.

We encourage you to review this page periodically. The current version is always available at www.bfms.co.za/privacy.html.

// 12
Contact & Complaints

If you have any questions about this Privacy Policy, want to exercise your rights, or have a concern about how we have handled your personal information, please contact our Information Officer:

BlakFire Management Solutions hello@bfms.co.za +27 83 770 6388 Gauteng, South Africa

We will acknowledge your request within 3 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you have the right to escalate your complaint to the Information Regulator of South Africa.