PRIVACY NOTICE
14 October 2026
1. Who we are
Bigfoot-IT Consulting (Pty) Ltd, registration number 2013/050376/07, trading as Bigfoot-IT ("Bigfoot", "we", "us"), is the company responsible for this notice.
263 Glover Avenue
Centurion
0163
South Africa
Email: support@bigfoot-it.com
Telephone: 087 802 9000
Directors: Shan Lauryssen and Johann Steyn.
We are the responsible party for personal information that we decide how to use. That includes subscriber accounts, billing, security of the apps, and our own marketing.
When a business uses our apps to store information about its own customers, staff, or contacts, that business is the responsible party for that information. We then process it as an operator, on the business's instructions, so that the app can run. The business must have a lawful reason for the information it uploads, and it must give its own customers the explanation those customers need.
2. What this notice covers
This is the central privacy notice for our apps, and for every Bigfoot-IT website that links to it.
The apps covered now are:
- BigStudio, including bigstudio.bigfoot-it.com, the iOS and Android apps, and the browser app at pwa-bigstudio.bigfoot-it.com
- BigCRM
- MessageHub
It also covers bigfoot-it.com.
When we release another app, we will add its name to this notice. Until that update is posted, this notice still applies to any Bigfoot-IT app that links here.
3. The apps
BigStudio is a management platform for appointment-based businesses. Depending on the features a business switches on, it handles online bookings, customer profiles, messages, payments and deposits, digital documents and consent forms, stock, staff, reports, appointment reminders, and marketing tools.
BigCRM is a customer-relationship platform. Depending on the features a business uses, it handles companies and contacts, sales opportunities, communication history, meetings and tasks, service agreements, documents, workflow automation, and reports.
MessageHub is our messaging and communications app. It handles messages between a business and the people it communicates with, including the content of a message, who sent and received it, and whether it was delivered.
4. Personal information we process
The information we process depends on which app you use and which features are switched on.
People who log in to an app:
- name, email address, telephone number, and role
- username and password, stored in a protected form rather than as readable text
- business name and billing contact
- support messages you send us
Information a business may store in BigStudio about its customers or staff:
- identity and contact details
- appointment history, preferences, and notes
- photographs the business uploads
- allergy notes, medical questionnaire answers, consent forms, indemnities, and signatures, where the business uses those features
- messages sent inside BigStudio
- payment status, deposits, refunds, and wallet balances
- staff details needed to run the diary
Card numbers are collected by the payment provider that processes the payment. We do not store full card numbers on our own servers.
Information a business may store in BigCRM:
- company and contact details, including branches
- opportunity and sales records
- emails, call notes, meeting notes, and messages from a channel the business connects, such as email, Microsoft Teams, or WhatsApp
- tasks, documents, and service-agreement records
- records created by a workflow the business has set up
Information processed in MessageHub:
- message content and attachments
- sender and recipient names, numbers, or addresses
- the time, channel, and delivery status of a message
- the business's account and routing settings
Information collected from the device or browser:
- IP address, device and browser type, app version, and the approximate area derived from the IP address
- log and diagnostic data, such as the screens you use, timestamps, and crash reports
- cookie and similar identifiers on our websites
On bigfoot-it.com we use a Google tag, identifier GT-MJMFGRF, to measure use of the marketing site.
We do not buy personal information from data brokers.
Allergy notes, medical questionnaire answers, and similar health information are special personal information under the Protection of Personal Information Act (POPIA). We process that information only when a business uses the feature, the person was asked for it for the service, and a condition in POPIA allows it. We do not use health information to advertise Bigfoot-IT.
5. Why we process it
We process personal information for these purposes:
- to provide the app you or your business subscribed to, including accounts, hosting, bookings, messages, reminders, documents, and reports
- to charge for the subscription and keep tax and accounting records
- to protect the apps, investigate faults, and keep backups
- to send service and security messages about an account
- to tell a subscriber about Bigfoot-IT products, where the law allows it, and to stop when you opt out
- to understand how the apps are used so we can fix and improve them
- to comply with a law, a court order, or a lawful request
We rely on the contract with the subscriber, a legal duty, consent where we ask for it, or our legitimate interest in running a secure service. We do not use a business's customer list to advertise Bigfoot-IT.
If you are a customer of a salon, clinic, or other business that uses one of our apps, that business decides why your information is in the app. You can ask that business, and you can also contact us. Where we only hold the information for that business, we will involve the business in the response.
A business must not upload information it has no right to store.
6. Who we share it with
We do not sell personal information.
We share it only as far as the service requires:
- with a hosting, email, backup, or support provider that processes it for us under contract
- with the payment provider that collects a subscription or in-app payment
- with Google, for the tag on our marketing website
- with a channel the business has chosen to connect, such as email, WhatsApp, or Microsoft Teams, so that channel can deliver the message
- with a professional adviser, insurer, or auditor who is bound to keep it confidential, where we need them
- with a buyer, if we sell or restructure the business, so the service can continue
- with a court, regulator, or law-enforcement body when the law requires it
A provider who processes personal information for us may use it only on our instructions.
7. Where it is processed
We are a South African company. A provider may process information outside South Africa. We transfer personal information across a border only in the way section 72 of POPIA allows. That includes a recipient that is bound by a law, binding corporate rules, or an agreement that gives protection comparable to POPIA, or a transfer you or the business customer have agreed to.
8. How long we keep it
We keep a subscriber's account information while the subscription is active. After it ends, we keep what we still need to finish the contract, resolve a dispute, and meet tax and accounting duties. Tax records are generally kept for five years.
Records a business stores in an app remain until that business deletes them, or until the account is closed. After closure we delete or de-identify them within a reasonable time, except where the law, a dispute, or a backup copy requires us to keep them. Backup copies are overwritten on the backup cycle.
Security logs are normally kept for no longer than 12 months, unless we need a log for a security investigation.
9. How we protect it
We use access control, role-based permissions, encryption in transit, protected passwords, backups, and a duty of confidentiality for our staff. No method of sending or storing information is completely secure. Use a unique password, and email us if you think someone else has used your account.
10. Children
The apps are business tools. We do not knowingly market them to children under 18.
A business may store a child's details, for example when a parent books an appointment. That business must have the parent or guardian's authority. If you believe a child has given us information without that authority, contact us. Where we are the responsible party we will delete it. Where a business customer is the responsible party we will help that business do so.
11. Your rights
Under POPIA you may ask us to:
- tell you whether we hold personal information about you
- give you a copy in a reasonable format
- correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully
- stop processing it in the cases the Act allows
- withdraw consent, where we rely on consent
Withdrawal of consent does not undo processing that was already lawful.
We may ask you to confirm your identity before we act. Where a business customer is the responsible party, we may refer the request to that business or complete it with them. We will respond as soon as reasonably possible, and within the time POPIA requires.
We do not make a decision that has a legal effect on you based only on automated processing.
12. Cookies
On bigfoot-it.com we use cookies and similar tools that the site needs in order to work, and the Google tag described above to measure use of the marketing site. You can block cookies in your browser. Parts of the site may not work if you block cookies the site needs.
An app may store a session or device identifier on your device so that you can stay signed in and so that we can protect the account.
13. Changes to this notice
We will update this notice when we add an app or change the way we use personal information. The date at the top will change. If a change materially affects you, we will post a notice in the app or email account holders.
14. Contact us, or complain
Email support@bigfoot-it.com with the subject "Privacy request", or write to the address in section 1. You can also phone 087 802 9000.
You may lodge a complaint with the Information Regulator of South Africa:
Website: https://inforegulator.org.za
Email: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
15. If you are outside South Africa
POPIA is the law that governs this notice. If the law of the country where you live gives you an additional right over our processing, contact us and we will honour a right that applies.