1. Who is responsible
This notice covers the Bizman website and web application at https://bizmancloud.com, and the account, payment and support activities relating to them. It does not replace privacy notices for other separately supplied products or services from Bizmantools (Pty) Ltd.
The Business information page identifies the Bizman operator, and Contact us lists the privacy contact. We are the responsible party under POPIA for account administration, subscription payments, service security, support and the supplier demand summaries described below. This notice covers visitors, account users and business contacts, including information about juristic persons where POPIA applies.
An organisation generally remains the responsible party for personal information it enters about its customers, staff, contacts and projects; we process that information as its operator to provide the workspace. If your information was entered by a fabricator or supplier, you can contact that organisation directly or ask us to help route your request. We will not disclose another organisation's records without verifying the legal basis and authority.
2. Information we receive
We collect information you provide directly when registering, administering a workspace, requesting supplier access, paying or contacting support. We also receive information from authorised organisation administrators, invited users, supplier publishers, our payment and security providers, and your browser as you use the service.
- Identity and account details: name, email address, password hash, verification and authentication records, organisation membership, roles and session allocations.
- Business and workspace information: organisation/contact details, quotations, project records, drawings, uploaded assets, catalogue data and activity needed to operate the service.
- Billing information: invoices, transaction references and status, payment consent, masked card brand/last digits/expiry, and an encrypted recurring payment token. Full card numbers and CVVs are collected by Peach Payments, not stored by Bizman.
- Security and technical information: IP address, browser/device information, timestamps, sign-in and session events, bot-verification results, audit events and diagnostic information.
- Support correspondence and preferences such as theme, report settings and recently used drawing references stored on your device.
3. Why we use it
We use information to provide accounts and the contracted service, verify email addresses and authority, manage subscriptions, process payments/refunds, respond to support and rights requests, secure the platform, investigate abuse, maintain reliable records and comply with legal duties. Depending on the purpose, processing is necessary to perform an agreement, comply with law, pursue a legitimate interest in a secure and effective service, or act on your consent where required. We consider the effect on your rights when relying on a legitimate interest.
Required form fields support account creation, security, billing or your requested service. If you do not provide the necessary information, we may be unable to supply that function. Optional details are voluntary. We do not treat acceptance of our terms as blanket consent to unrelated processing or marketing. You can withdraw consent where we rely on it, without affecting prior lawful processing; this may prevent a consent-dependent service from continuing.
Service and security messages are part of operating your account. Any electronic direct marketing must have a lawful basis under POPIA and provide an opt-out. We do not sell personal information or use customer content to build advertising profiles.
5. Security and processing outside South Africa
We use access controls, encryption for recurring payment tokens and security/audit records to protect information. No system can guarantee absolute security. We will investigate security incidents and give affected organisations, individuals and the Information Regulator the notifications required by law.
Our service providers may process information in countries outside South Africa. A transfer must meet POPIA section 72, for example through adequate legal or binding contractual protection, or another lawful ground applicable to that transfer. We do not promise that all data remains in South Africa. Contact our privacy contact for information about the providers, locations and safeguards relevant to your data.
6. How long information is kept
We retain personal information for the service and the specific purpose for which it is needed, then delete, de-identify or restrict it when there is no lawful reason to retain it. Billing, payment-authorisation and transaction records are retained for at least five years after the transaction to meet merchant and record-keeping obligations, and longer where a law or an unresolved dispute requires it. Access to retained records is limited to the relevant purpose.
Inactive Fabricator workspace data is retained for 90 days after paid or demo access ends, with a final warning at day 60 and permanent deletion at day 90. A workspace that has never had access is timed from its creation. Owners can return through normal payment at any time before deletion, including the final 30 days. We do not permanently delete the workspace earlier than 30 days after delivery of its final warning. Admins may document a necessary hold or an individual extension; owners can return through normal payment during that extension. Successful paid access or an authorised demo establishes a new access end date; sign-ins, failed payments and abandoned checkouts do not. Permanent workspace deletion removes its working records, reset archives and unshared uploaded files. Required billing, payment-authorisation and security evidence and the identity links needed to interpret it are kept separately with restricted access. Supplier-owned content and published releases follow their separate contractual retention obligations.
Ask for export, deletion or restriction through our privacy contact before the deadline. We verify authority and explain any records that must be retained. Backup copies have restricted access and expire according to the backup retention schedule; deletion is not immediate in every backup. A minimal deletion marker is kept outside database backups so recovery can reapply completed deletions before restoring files or reopening service. Exceptional recovery copies and legal holds require separate controlled disposal when their purpose ends.
8. Your rights and complaints
Subject to POPIA and other applicable law, you can request confirmation of whether we hold your personal information, access to it, correction of inaccurate information, and deletion or restriction where retention is no longer authorised. You may object on reasonable grounds to processing based on legitimate interests, object to direct marketing, withdraw consent where applicable, and complain to the Information Regulator.
Contact the privacy contact on our Contact page. Describe your request and relationship to Bizman; do not send sensitive identity documents until we explain a secure and proportionate verification process. We will verify identity and authority, respond within the applicable statutory period and explain any lawful refusal, extension or prescribed fee. The PAIA access guide linked below explains formal access-to-records procedures.
We may update this notice as the service or law changes. The date identifies this version. We will notify affected users of material changes through an appropriate service or account channel and obtain consent if the new processing requires it.
Privacy contacts and resources
For support, visit Contact us. For details of your service provider, see Business information.