What we collect, and what you can turn off.
GetTheBag is a product of Mboma Financial Services, built for South African SMMEs and operated in line with the Protection of Personal Information Act (POPIA).
Analytics on these public pages
Google Analytics 4 counts visits from the moment you open one of these pages, in what Google calls consent mode. Until you accept it runs without cookies: a visit is counted, nothing is stored in your browser and nothing follows you from one page to the next. If you accept, it also sets cookies so we can tell a returning visitor from a new one. If you decline, it is switched off entirely and stops sending anything at all.
Microsoft Clarity is different and is treated differently. It records how pages are used, so it is only ever loaded after you accept. Decline, or simply never answer, and it is never requested and sets no cookie.
This applies to our public pages only: the home page, the readiness assessment introduction, the marketplace and the programme application page.
Where analytics is never used
We do not run analytics of any kind inside the SMME portal or the manager portal. That includes your assessment answers, uploaded documents, identity and tax numbers, bank details, statements, invoices and customers.
Microsoft Clarity records how pages are used, which is exactly why it is kept away from anything holding your business or personal information.
Signals we honour automatically
If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a decline. You will not be asked, and nothing will load.
Your choice
Checking…
Getting your data out, or deleted
Every document you upload is listed under My Documents in the portal, where you can download your own copy or delete it. Deleting removes it from our storage.
Still to be confirmed
The following need to be completed by Mboma Financial Services before this page stands as the platform's full privacy policy: the registered operator and information officer details, data retention periods, the list of third-party processors beyond the two named above, and the process for a data subject access or deletion request.