BOCO (operated by BOCO SA (Pty) Ltd, Registration No. 2025/967932/07, a company incorporated in the Republic of South Africa) is committed to protecting the personal information of all users of our Platform, wherever they are located in the world. We comply with the Protection of Personal Information Act 4 of 2013 (POPIA) as our primary legal framework, and we additionally meet our obligations under the EU/UK General Data Protection Regulation (GDPR), the Australian Privacy Act 1988, the California Consumer Privacy Act (CCPA/CPRA), and all other applicable data protection laws in jurisdictions from which we actively accept clients.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what your rights are as a data subject. It applies to all users of the BOCO website and mobile application (collectively, the "Platform"), including coaches and clients, regardless of where you are located.
By accessing or using our Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, please do not use the Platform.
| Entity Name | BOCO SA (Pty) Ltd |
| Registration Number | 2025/967932/07 |
| Physical Address | 2 Highwoods, 10 Seventh Avenue, Highlands North, Johannesburg, Gauteng 2192. |
| Email Address | support@myboco.app |
| Website | www.myboco.app |
| Primary Regulator | Information Regulator of South Africa |
| Governing Law | Laws of the Republic of South Africa |
As required by POPIA (section 55), BOCO has appointed an Information Officer responsible for ensuring compliance with this Policy and the Act. EU/UK users may also contact this person for GDPR-related queries:
| Information Officer | Cindy Seabrook |
| support@myboco.app |
We collect personal information that is adequate, relevant, and not excessive for the purposes described in this Policy (POPIA section 10; GDPR Article 5). What we collect depends on whether you are a coach or a client.
POPIA (section 26) and GDPR (Article 9) place additional restrictions on special categories of personal information. BOCO processes the following special personal information:
| Category | Purpose | Lawful Basis |
|---|---|---|
| Criminal records (coaches only) | Assessing suitability to provide coaching services on the Platform | Explicit consent |
| Health information (if voluntarily provided in coaching profile) | Enabling relevant coach-client matching | Explicit consent |
We do not otherwise intentionally collect special personal information. Where you voluntarily provide any other special personal information through the Platform, you consent to its processing for the purposes described in this Policy.
We process your personal information only for specific, lawful purposes, and only to the extent necessary for those purposes:
| Purpose | POPIA Basis | GDPR Basis |
|---|---|---|
| Create and manage your account | Contractual necessity | Contract (Art.6(1)(b)) |
| Facilitate bookings between coaches and clients | Contractual necessity | Contract (Art.6(1)(b)) |
| Process client payments via TradeSafe; remit coach payouts by bi-monthly EFT | Contractual necessity | Contract (Art.6(1)(b)) |
| Verify identity and qualifications of coaches (KYC) | Legal obligation; legitimate interest | Legal obligation (Art.6(1)(c)) |
| Conduct criminal background screening of coaches | Explicit consent | Explicit consent (Art.9(2)(a)) |
| Communicate about bookings, account and services | Contractual necessity | Contract (Art.6(1)(b)) |
| Send service-related notifications | Contractual necessity | Legitimate interest (Art.6(1)(f)) |
| Provide customer support and resolve disputes | Legitimate interest; legal obligation | Legitimate interest (Art.6(1)(f)) |
| Improve the Platform and conduct analytics | Legitimate interest | Legitimate interest (Art.6(1)(f)) |
| Comply with SA and international legal obligations | Legal obligation | Legal obligation (Art.6(1)(c)) |
| Enforce our Terms and Conditions; prevent fraud | Legitimate interest | Legitimate interest (Art.6(1)(f)) |
We may send you marketing communications if you have provided explicit consent. You may withdraw consent and opt out at any time by clicking the unsubscribe link in any marketing email, updating your communication preferences in your account settings, or contacting us at support@myboco.app. Withdrawal of marketing consent does not affect service-related communications.
We do not sell your personal information to any third party. We share your personal information only as described below.
When a booking is made, limited profile information (name, professional biography, qualifications, profile photograph and session contact details) is shared between the coach and client to enable delivery of the coaching service. Both parties are responsible for handling each other's personal information lawfully and only for the purpose of the booked session.
We engage third-party operators who process personal information on our behalf under data processing agreements. These include:
| Provider | Data Shared | Purpose | Standard Terms |
|---|---|---|---|
| TradeSafe – payment processing | Identify verification data (email, name, ID/passport number, address, banking details) | To process payments and verify identity per FICA requirements | PCI DSS compliant; DPA in place |
| FICA @ WORK – risk screening | Full name, ID/passport number, date of birth | Criminal record and PEP screening for coach suitability assessment | DPA in place; data deleted within 1 year of screening completion |
| Supabase – core platform operations | All user account data, including name, email, contact details, coaching profiles, KYC verification status, transaction records, and communications between coaches and clients | To operate the Platform, facilitate bookings, store user data, process transactions, and enable platform functionality. Data is retained according to the retention schedule in Section 7. Automated deletion procedures are implemented at the end of each retention period | Data Processing Agreement in place; GDPR Standard Contractual Clauses apply for EU/UK users |
| Customer.io — Email and communication service provider for marketing communications | Name, email address, contact preferences, coaching category, and session booking history | To send personalised recommendations, educational content, and promotional offers | DPA in place; GDPR Standard Contractual Clauses apply |
| Resend — Email and communication service provider for transactional communications | Name, email address, session confirmation details, and refund notifications | To send account confirmations, booking updates, and service-related notifications | DPA in place |
| Google Analytics | IP address (anonymized), device type, browser, pages visited, session duration, referrer source, and approximate location (region level only) | To understand how users interact with the Platform, identify technical issues, measure engagement, and improve user experience | DPA in place with Google; GDPR Standard Contractual Clauses apply for EU/UK users |
All operators are contractually required to process personal information only on BOCO's instructions and in compliance with applicable data protection law, including POPIA and GDPR where applicable.
We may disclose personal information where required by South African law, court order, or where necessary to protect the rights, property, or safety of BOCO, our users, or the public.
In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify users of any such change in accordance with this Policy and applicable law.
BOCO is operated from South Africa. It is sometimes necessary for us to transfer your personal information to countries outside of South Africa, the United Kingdom (UK), United States of America (USA) and the European Economic Area (EEA). This may include countries that do not provide the same level of data protection as your home jurisdiction.
We will transfer personal information across international borders only where:
You can contact our Information Officer if you would like more information about the specific transfer mechanisms used or a copy of the safeguards protecting your data abroad.
We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by applicable law.
| Category | Retention Period | Legal Basis |
|---|---|---|
| Active account data | Duration of account + 5 years | Contractual; legitimate interest |
| Transaction and financial records | 7 years | Income Tax Act 58 of 1962 (SARS) |
| KYC and identity verification records | 5 years from verification date | FICA; legitimate interest |
| Criminal clearance records | Coach relationship + 1 year, then secure deletion | POPIA proportionality; explicit consent scope |
| Support and dispute records | 3 years from resolution | Legitimate interest; CPA |
| Marketing consent records | Until withdrawn + 2 years | POPIA accountability |
When personal information is no longer required and no legal retention obligation applies, it is securely deleted or irreversibly anonymised. For EU/UK users exercising the right to erasure, we will action deletion requests within 30 days subject to any overriding legal retention obligations.
BOCO implements appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or destruction (POPIA section 19; GDPR Article 32). Our measures include:
In the event of a personal information breach that poses a risk to data subjects, BOCO will notify the Information Regulator of South Africa and affected data subjects without undue delay. For EU/UK users, we apply the GDPR standard of notification to the relevant supervisory authority within 72 hours of becoming aware of the breach where feasible (GDPR Article 33).
Your rights depend on your location. All users have rights under POPIA. Users in the EU, UK, Australia, Canada, and California have additional rights under applicable local law. We honour all rights regardless of which law applies to you.
| Right | Who It Applies To | How to Exercise |
|---|---|---|
| Access — obtain a copy of your personal information | All users (POPIA s23; GDPR Art.15; CCPA; APPs) | Contact Information Officer — 30-day response |
| Correction — correct inaccurate or incomplete data | All users (POPIA s24; GDPR Art.16) | Contact Information Officer — 30-day response |
| Deletion / Erasure — request deletion of your data | GDPR users (Art.17); CCPA users; All users where retention period expired | Contact Information Officer — 30-day response |
| Data Portability — receive your data in machine-readable format | GDPR users (Art.20); CCPA users; Quebec residents | Contact Information Officer |
| Restriction of Processing — limit how we process your data | GDPR users (Art.18) | Contact Information Officer |
| Object to Processing — object on grounds of legitimate interest | All users (POPIA s11; GDPR Art.21) | Contact Information Officer — 30-day response |
| Withdraw Consent — withdraw previously given consent | All users | Account settings or contact Information Officer |
| Automated Decision Making — not be subject to solely automated decisions with legal effects | GDPR users (Art.22) | Contact Information Officer — low risk at MVP |
| Non-Discrimination — not be discriminated against for exercising rights | California (CCPA) users | Contact Information Officer |
| Lodge a Complaint — complain to a supervisory authority | All users | See Section 9.1 below |
To exercise any right, contact our Information Officer at the details in Section 2.2. We will respond within 30 days (extendable by a further 30 days with written notice).
You have the right to lodge a complaint with a data protection supervisory authority. Contact details for relevant authorities:
| Jurisdiction | Authority | Contact |
|---|---|---|
| South Africa (all users) | Information Regulator of South Africa | www.inforegulator.org.za | inforeg@justice.gov.za | JD House, 27 Stiemens Street, Braamfontein, JHB 2001 |
| European Union | Your local EU Member State supervisory authority | See: edpb.europa.eu/about-edpb/about-edpb/members_en |
| United Kingdom | Information Commissioner's Office (ICO) | www.ico.org.uk | 0303 123 1113 |
| Australia | Office of the Australian Information Commissioner (OAIC) | www.oaic.gov.au |
| Canada | Office of the Privacy Commissioner of Canada (OPC) | www.priv.gc.ca |
BOCO acts as the merchant of record for all transactions processed through the Platform. When you make a payment as a client, that payment is processed by our TradeSafe provider and funds are received into BOCO's business bank account.
BOCO is not a bank, payment institution, registered financial services provider, or trust account holder. Funds received on behalf of coaches are held in BOCO's business account and disbursed to coaches by EFT on a bi-monthly payout cycle, net of BOCO's platform commission, subject to the BOCO Payout Schedule and Process Policy. A two-week holding period applies between session delivery and payout to allow for dispute and refund resolution.
Card and payment details are handled by our TradeSafe provider in accordance with Payment Card Industry Data Security Standards (PCI DSS). BOCO does not store card numbers or full payment credentials on its own systems.
For international clients, payment may be displayed and charged in ZAR. Currency conversion is handled by the TradeSafe provider at the prevailing exchange rate at the time of transaction. BOCO is not responsible for foreign transaction fees charged by your bank or card issuer.
Our Platform uses cookies and similar tracking technologies. A cookie is a small text file stored on your device. Our full Cookies Policy is available at www.myboco.app/cookies and explains what cookies we use, why, and how to manage them.
We obtain your consent before setting any non-essential cookies. Our cookie consent banner allows you to accept all cookies, reject all non-essential cookies, or customise your preferences. You may update your preferences at any time. This approach meets the requirements of both POPIA and GDPR for cookie consent.
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
BOCO does not sell or share your personal information with third parties for their own marketing purposes. We do not and will not sell personal information as defined under the CCPA. To exercise your California rights, contact our Information Officer at the details in Section 2.2.
If you are located in Australia, BOCO's handling of your personal information is also subject to the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). BOCO's practices are designed to comply with the APPs.
Where BOCO discloses personal information to overseas recipients (including cloud hosting providers and third-party processors), BOCO takes reasonable steps to ensure those recipients comply with privacy standards equivalent to the APPs, or obtains your consent to the disclosure.
If you have a privacy concern that is not resolved to your satisfaction, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
The BOCO Platform is strictly for users aged 18 years and older. This age minimum applies globally without exception. We do not knowingly collect personal information from any person under the age of 18. If you are under 18, do not register or provide personal information through the Platform.
If we become aware that we have inadvertently collected personal information from a person under 18, we will delete that information immediately. This global 18+ minimum exceeds the age of digital consent requirements under GDPR (16), COPPA (13), and other applicable laws.
We may update this Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. Where changes are material, we will provide prominent notice on the Platform and, where required, notify you by email or seek fresh consent. For EU/UK users, material changes that alter the basis on which we process your data will be communicated at least 30 days before taking effect.
The version number and review date at the top of this Policy indicate when it was last updated. Your continued use of the Platform after any update constitutes your acceptance of the revised Policy, subject to applicable mandatory notice requirements.
For any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact our Information Officer:
| Information Officer | Cindy Seabrook |
| support@myboco.app | |
| Physical Address | 2 Highwoods, 10 Seventh Avenue, Highlands North, Johannesburg, Gauteng 2192. |
| Website | www.myboco.app |
.svg)
.svg)
