Privacy and data protection

1. Who is responsible for your information

GrowthCred (Pty) Ltd, registration number 2026/229279/07, of Rosebank, Johannesburg, South Africa, is the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).

Information Officer: Phila Ngwenya. info@growthcred.co.za. Every request, question or complaint about your personal information reaches a person at that address. It is not a no-reply box.

2. What we actually collect, and where

We only hold what you type in. We do not buy lists, we do not scrape, and we do not build a profile of you from anywhere other than your own submissions.

• Free class opt-in. Your email address, and which page you came from.
• Live class registration. Your name, email address, WhatsApp number, and which class you booked. The WhatsApp number is collected for one reason: the reminder an hour before, which is the thing that stops people missing it.
• Workshop checkout. Your name, email address, what you ordered, the amount, and an order reference we generate. Your card details are entered inside our payment provider’s own secure form and are never sent to us, stored by us, or visible to us — see section 4.
• Custom system request. Your name, email address, WhatsApp number, your industry, when you are looking to start, when you are free for a call, and any notes you add.
• Done-for-you application. Your name, email address, WhatsApp number, your business and what it does, your team size, and your answers about what made you apply, what a good outcome looks like, and what has been most frustrating. These answers are about your business, and we treat them as confidential.
• When you email or WhatsApp us. Whatever you send, and our reply.

What we never collect. This site has no accounts and no login, so we hold no username or password of yours. We never ask for and never store card numbers, CVV codes, banking login details, ID or passport numbers, or your address. If a page claiming to be us ever asks you for any of those, it is not us — tell us at info@growthcred.co.za.

3. Why we hold it, and on what basis

POPIA requires us to have a lawful reason for every use. Ours are:

• To do what you asked. Sending the class joining link and the reminder, giving you access to what you bought, running the workshop, replying to an application. This is necessary to carry out the agreement between us.
• Because you consented. Where you gave us a detail we did not need for the above, you gave it voluntarily and may withdraw that consent at any time.
• To keep the records the law requires. Invoices, payment records and tax records, kept for the periods set out in section 9.
• To run and protect the business. Answering support, preventing fraud and abuse, and defending a legal claim if one is ever made. This is our legitimate interest, and we weigh it against your privacy each time.

We do not use your information to make an automated decision about you that has a legal or similarly significant effect, as described in section 71 of POPIA.

4. Payments

Payments are taken by Whop, our payment provider. The card form on our checkout is served by Whop inside a secure frame on the page. Your card number, expiry and CVV go directly to Whop and their payment partners. They do not pass through our website, our servers, or our database, and no one at GrowthCred can see them.

What we receive back is the fact that a payment succeeded, matched to the order reference we generated. Whop processes your payment information as a responsible party in its own right, under its own privacy terms.

5. Who else touches your information

We share it only with the providers we need to run the service, and only so they can provide that service to us. We do not sell your personal information, and we do not share it for anyone else’s marketing.

• Whop — payments and checkout, and a page-view measurement script that runs on this site (see section 7).
• Supabase — the database that stores your form submissions.
• Our email and WhatsApp providers — so we can reach you the way we said we would.
• YouTube — the videos on our pages are embedded from YouTube in its no-cookie mode, which does not set tracking cookies until you press play. If you press play, YouTube receives that request and applies its own privacy terms.
• Google Analytics (optional) — when configured and you choose to allow analytics, it measures page visits and completed actions. You can change this choice using Analytics preferences in the footer. We do not send form answers or email addresses to this analytics integration.
• Our web host — which serves these pages and keeps ordinary server logs.

We will also disclose information where the law requires it, or to establish, exercise or defend a legal claim. If we are ever bought or merged, your information moves with the business and this policy continues to apply to it.

6. Information that leaves South Africa

Some of the providers above operate outside South Africa, so your information may be stored or processed in another country. Section 72 of POPIA allows this where the recipient is bound by rules or a contract that provide protection substantially similar to POPIA, or where you consented, or where the transfer is necessary to perform our agreement with you. We rely on those grounds and choose providers who contract to protect your information accordingly.

7. Cookies and measurement

We keep this deliberately light, and we would rather tell you exactly what runs than hide it behind a banner.

• Your browser’s session storage. While you move through the checkout we keep your order details in your own browser so the next page knows what you bought and any promo code still applies. It is deleted when you close the tab and it never leaves your device except when you submit a form.
• Whop’s measurement script. Whop loads a small script on our pages that records that a page was viewed, so we can tell which pages lead to purchases. It runs on every page of this site.
• Embedded video. Described in section 5.

We do not run advertising retargeting pixels of our own, and we do not sell or share browsing data with data brokers. You can block any of the above with your browser settings or an extension, and the site will still work.

8. Marketing, and the promises we made when you signed up

Section 69 of POPIA restricts unsolicited electronic marketing, and we hold ourselves to what each form promised at the moment you filled it in:

• Free live class. That form says you get the joining link and a WhatsApp reminder an hour before, and nothing else. That is exactly what you get. We do not add live-class registrants to a newsletter.
• Customers. If you buy from us, we may email you about your purchase and about closely related offerings, as section 69(3) permits for an existing customer. Every one of those has a one-click way to stop, and stopping never affects what you already bought.
• Applications and requests. We contact you about the thing you applied for. Not about anything else.

To stop hearing from us entirely, reply to any message or email info@growthcred.co.za with “unsubscribe”. We action it, and we do not ask you why.

9. How long we keep it

• Payment and invoice records: five years from the end of the tax year they relate to, because South African tax law requires it.
• Customer records: for as long as you are a customer, and then for three years, so we can honour a guarantee claim and answer a later question.
• Class registrations and opt-ins: up to two years from your last interaction with us, then deleted.
• Applications we do not take forward: twelve months, then deleted.

You can ask us to delete sooner, and we will unless the law requires us to keep a specific record. If that happens, we will tell you which record and why.

10. How your information is protected

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. Concretely, on this site:

• Everything you send travels over an encrypted HTTPS connection, and is encrypted again at rest by our database provider.
• Our forms can write to the database and cannot read from it. Even someone who inspected our website’s code could not use it to read your submission, or anyone else’s. Reading requires a separate credential that never leaves our control and is not part of this website.
• Card data is out of scope entirely, because it never reaches us (section 4).
• Access to submissions is limited to the people who need it to deliver what you asked for.

No system is perfectly secure, and we will not pretend otherwise. If your personal information is ever accessed by someone unauthorised, section 22 of POPIA requires us to notify the Information Regulator and to notify you, and we will do both as soon as we reasonably can.

11. Your rights

Under POPIA you have the right to:

• ask whether we hold information about you, and to be given a copy of it;
• have information that is wrong or incomplete corrected;
• have information deleted where we no longer have a lawful reason to keep it;
• object, on reasonable grounds, to our processing of it;
• withdraw a consent you gave, at any time;
• not be subjected to unsolicited electronic marketing; and
• complain to the Information Regulator.

Email info@growthcred.co.za and we will respond within a reasonable time and in any event as the Act requires. We may need to confirm who you are first, so that nobody else can request your information. A request under the Promotion of Access to Information Act follows the procedure in our PAIA manual, available free on request from the same address.

You may complain directly to the Information Regulator (South Africa) at any time, and you do not have to come to us first. Their current contact details and complaint forms are published at inforegulator.org.za.

12. Children

This site sells to business owners and is not intended for anyone under 18. We do not knowingly collect the personal information of a child. If you believe a child has sent us information, tell us and we will delete it.

13. Changes to this policy

If we change how we handle your information, we change this page and the date at the top of it. Where a change materially affects information we already hold about you, we will tell you directly rather than relying on you noticing.