Privacy Policy
Last updated: June 2026
Who we are
Brug is a platform that helps NGOs, co-ops and community organisations manage
members, programmes, sessions, tasks, documents, communication, resources and
operational records. The responsible party under the Protection of Personal
Information Act (POPIA) is the organisation using Brug to manage its operations.
What personal information we collect
- Account data: email address.
-
Organisation data:
organisation name, contact details, membership or participant records, programme
information, files and operational records stored while using the platform.
-
Communication data:
emails sent to you are logged (sender, recipient, subject, status) for up to 2 years.
-
Session data: login tokens and timestamps used at login.
Why we process your information
-
To provide the platform services you have signed up for (lawful basis: contract performance).
-
To send you service notifications and updates (lawful basis: contract performance).
- To maintain security and detect abuse (lawful basis: legitimate interest).
Who we share your data with
Your data is shared only with the organisation you belong to on the platform.
We do not sell or share personal data with third parties for marketing.
Emails are sent via MailPace
(MailPace Ltd, United Kingdom), who process email delivery on our behalf
and are bound by a data processing agreement.
SMS delivery for phone verification is handled by Clickatell (Pty) Ltd,
a South African messaging provider. The phone number is shared with Clickatell
solely to deliver verification codes. See their privacy policy at clickatell.com.
How long we keep your data
- Account data: until you delete your account.
- Email logs: purged after 2 years.
- Login session tokens: expire automatically after 14 days.
Your rights under POPIA
You have the right to:
-
Access
the personal information we hold about you — email privacy@brug.co.za.
-
Correct inaccurate information — update your profile in Account Settings.
-
Delete your account and personal data — available in Account Settings.
-
Object
to processing — email privacy@brug.co.za.
-
Lodge a complaint
with the Information Regulator of South Africa at inforegulator.org.za.
Security
All data is transmitted over HTTPS. Passwords are hashed using Argon2.
Access to personal data is restricted to authenticated users and organisation members.