How we look after your information.
GetTheBag is a product of Mboma Financial Services, built for South African small businesses. This policy explains what personal information we collect, why we need it, who we share it with, how long we keep it and what you can ask us to do with it, as required by the Protection of Personal Information Act (POPIA).
Last updated: 26 September 2026
Who we are
The responsible party for your personal information is Mboma Financial Services, 15 Acacia Street, Midrand, 1682, South Africa.
What we collect and why
We only collect what we need to run GetTheBag for you.
- Your account. Your name, email address, phone number and password. The password is stored in scrambled form that nobody, including us, can read. We also record when you gave POPIA consent and the internet address you gave it from. We use this to sign you in and to contact you about your account.
- Your business profile. Business name, owner, province, sector, business structure, years operating, number of employees and turnover band. If you enter them, we also keep your CIPC registration number, SARS tax number, VAT number, bank account number, B-BBEE level, website and social media handles. We use this to build your readiness profile and to match you to support and funding opportunities.
- Your readiness assessment. Your answers and the scores worked out from them, so we can show where your business stands and what to work on next.
- Documents you upload. For example company registration, tax and VAT certificates, bank letters, bank statements, financial statements, ID copies and proof of address. Some certificates are read automatically so you do not have to type the details in.
- Bank statements you import. Your statement is read in your own browser. We keep only the bank name, the statement period, the opening and closing balances and the monthly totals per spending category. We do not keep the names of the people and businesses that appear on your statement.
- Identity verification, if you choose to do it. Your South African ID number and cell number are sent to a registered South African credit bureau, which confirms your identity with a selfie taken on your phone. We keep the result and the name the bureau returns. Your selfie and biometric data are not stored on GetTheBag.
- Invoices, quotes and customers. If you use the invoicing and customer tools, we store the customer details you enter, the banking details you put on your invoices, and the invoices and quotes themselves.
- Marketplace. If you list a product, the contact email and phone number on your listing are shown publicly. If someone enquires, we pass their name and contact details to you, and we tell them we are doing so.
- Programme applications, events and learning. What you submit when you apply for a programme, your event registrations and check-ins, and your course progress and certificates.
- The Advisor. The messages you send to the Advisor and its replies, so you can come back to the conversation.
- Technical information. Your internet address and the pages you request, recorded in server logs to keep the service running and secure.
Information about your own customers. When you store details of your customers in GetTheBag, you are responsible for that information under POPIA. We process it on your behalf, only to provide the tools you use.
Who can see your information
- You. Everything in your account.
- Mboma Financial Services programme staff. Your business profile, assessment results and programme applications, so they can support you, run programmes and report on progress. They cannot open your uploaded documents, your bank statement data, your identity verification or your Advisor conversations.
- Trainers. Your attendance and progress on the courses they run.
- The public. Only what you publish in a marketplace listing.
We do not sell your personal information, and we do not share it for advertising.
Service providers and where your information is stored
We use trusted service providers to host GetTheBag, store your information and documents, send emails, verify identity, run the Advisor, check sign-ups for bots and count visits to our public pages. They process your information on our behalf and only for those purposes.
Some of these providers are outside South Africa, including in the United States and Germany, so your information is transferred across borders. When you agree to this policy at sign-up, you consent to that transfer.
How long we keep it
| Information | How long we keep it |
|---|---|
| Account, business profile, assessments and Advisor conversations | While your account is open, then deleted 12 months after it is closed |
| Uploaded documents | Until you delete them or your account is closed |
| Identity verification result | While your account is open |
| Bank statement imports you did not finish | Deleted automatically after 30 days |
| Your POPIA consent record and our audit trail | 5 years, as proof of your consent and of what was done with your information |
Your rights, and how to use them
Under POPIA you may ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong or out of date;
- delete your information or close your account;
- stop using your information for a particular purpose, or withdraw your consent;
- stop sending you emails that are not needed to run your account.
Some of this you can do yourself in the portal. You can edit your profile and contact details, change your password, and delete uploaded documents, bank statement imports, customers, invoices and marketplace listings.
For anything else, email info@getthebag.co.za from the address on your account. We may ask you to confirm your identity first, and we will respond within 30 days. If you withdraw your consent or close your account, we can no longer provide GetTheBag to you. This does not affect anything we did lawfully before.
Cookies and browser storage
To keep you signed in, we set one secure cookie and store your sign-in details in your browser. The portal cannot work without them.
The personal finance tools (budget, black tax, cash flow and savings goals) keep your figures in your own browser only. They are not sent to us.
On our public pages, analytics cookies are only set if you accept them in the cookie banner. We never run analytics inside the portal.
How we protect your information
All traffic to GetTheBag is encrypted. Passwords are stored in a scrambled form that cannot be reversed. Sign-in sessions expire, repeated sign-in attempts are limited, and sign-ups are checked for bots. Staff access depends on their role, and the actions programme staff take on your account are logged.
If a breach puts your personal information at risk, we will tell you and the Information Regulator, as POPIA requires.
Complaints
Please contact us first at info@getthebag.co.za so we can put things right. You also have the right to complain to the Information Regulator:
- Complaints: POPIAComplaints@inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za, toll free 0800 017 160
- Website: inforegulator.org.za
Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use information you have already given us, we will email you before it takes effect.