Privacy notice
Buffels Bay SRA NPC · Registration 2026/571508/08 · Version 1.1, 3 November 2026
Buffels Bay SRA NPC ("BBSRA", "we") manages the Buffels Bay Special Rating Area under the Knysna Special Rating Areas By-law. This notice explains what personal information we hold, why we hold it, who we share it with and what your rights are under the Protection of Personal Information Act, 2013 (POPIA).
1. Who is responsible
Buffels Bay SRA NPC is the responsible party for the personal information described here. Our Information Officer is Carl Smit of JPS Trust, BBSRA's administrator. Contact the Information Officer at info@jpstrust.co.za or 021 887 2486, at 210 Valerida Centre, Piet Retief Street, Stellenbosch (postal address: PO Box 3075, Stellenbosch, 7602), or through info@bbsra.co.za or the contact form on www.bbsra.co.za, which pass your message on.
JPS Trust holds the register of members and sends all formal notices to members for us. BBSRA itself keeps no list of owners, members or members who have opted out. The only list we keep is our newsletter list.
2. What we collect
| Who | What we hold | Where it comes from |
|---|---|---|
| Property owners and members (held for us by JPS Trust) | Name, erf number and property address, municipal valuation and levy amount, postal address, email address, phone number, membership status. For trusts, companies and bodies corporate: the name of the representative | Knysna Municipality's valuation roll and rates records, and what owners tell us |
| Newsletter subscribers (held by BBSRA) | Name and email address | The email addresses owners have given us, and anyone who subscribes |
| Members who opt out, vote or appoint a proxy (handled by JPS Trust) | ID or passport number, signature and proof of authority, only to confirm who is acting for the property | The member |
| People who contact us | Name, email, phone, erf number, your message and any photos or videos you send | You |
| People at meetings | Attendance registers, proxies and votes | The meeting |
| People involved in incidents | Details in patrol and incident reports, kept for safety and to work with SAPS | Our security provider and the people involved |
| Directors and service providers | Business contact details, contracts, and banking details for payments | The person or company |
We do not ask for more than we need. We do not collect special personal information (such as health or religious information) and we do not knowingly collect information about children.
Website. The website sets no tracking or advertising cookies. Our hosting provider keeps standard server logs (IP address, browser and pages visited) for security. The weather on the home page and the News & Weather page loads its data from MET Norway (the service behind Yr) and Open-Meteo; those services can see your IP address when it loads.
3. Why we use it
| Purpose | Legal basis under POPIA |
|---|---|
| Keep the register of members (through JPS Trust), send notices of meetings, run meetings and record votes | Required by the Companies Act and our MOI (section 11(1)(c)) |
| Report to Knysna Municipality, keep financial records and have them audited | Required by the Knysna SRA By-law and Policy, the Companies Act and tax law (section 11(1)(c)) |
| Deliver SRA services: patrols, maintenance, environmental work, and reply to reports and questions | Legitimate interest of owners and the public in a safe, well-kept area (section 11(1)(f)) |
| Send newsletters and general updates from our newsletter list | Legitimate interest; you can unsubscribe at any time (section 11(1)(f)) |
We never sell personal information or use it for anyone else's marketing.
4. Who we share it with
We share only what each party needs:
- Knysna Municipality, which bills and collects the levy and receives the reports the Policy requires.
- Service providers acting for us, under confidentiality terms: JPS Trust (administration, including the register of members and formal notices), Smith & Assosiate (audit), Allsound Security (security and incident reports), IT Guys (website hosting and email), Google (file storage and email), MailerLite (email notices) and WhatsApp (the BBSRA WhatsApp Community).
- SAPS and emergency services, when needed to deal with a crime, an emergency or a safety risk.
- Anyone else the law requires, such as SARS, CIPC or a court.
Outside South Africa. Google, MailerLite and WhatsApp may store information on servers outside South Africa. We use them because they apply data-protection safeguards comparable to POPIA (section 72).
5. How long we keep it
| Record | How long |
|---|---|
| Register of members and opt-out applications (kept by JPS Trust) | For as long as the company exists |
| Newsletter list | Until you unsubscribe or ask us to remove you |
| Minutes, resolutions, financial and tax records | At least 7 years (Companies Act section 24; tax law) |
| Messages sent through the contact form or email | 2 years after the matter is closed |
| Incident reports | 3 years, or longer if a case is still open |
After that we delete or destroy the information safely.
6. How we protect it
Records are kept in accounts owned by the BBSRA or by JPS Trust, not by individuals. Access is limited to the directors and providers who need it, with two-step verification on our accounts and logins kept in a password manager. Members' contact details are never shared through "anyone with the link" sharing. In the WhatsApp Community, members' phone numbers are hidden from one another in the Announcements group. If we learn that personal information has been accessed without authority, we will tell the Information Regulator and the people affected as POPIA requires.
7. Your rights
You can:
- ask what personal information we hold about you and get a copy (see our PAIA manual for the process);
- ask us to correct, update or delete information that is wrong, out of date or no longer needed;
- object to our use of your information for newsletters, and opt out at any time;
- withdraw any consent you gave.
Members keep receiving formal notices, such as notices of meetings, from JPS Trust while they are members, because the law requires them. You can unsubscribe from the newsletter at any time, and this does not stop formal notices.
If you tell BBSRA that your contact details have changed, we pass the change to JPS Trust. To correct the newsletter list, use the link in any newsletter or write to us.
To use these rights, contact the Information Officer at info@jpstrust.co.za. We will reply within 30 days.
8. Complaints
If you are unhappy with how we handle your information, please tell us first. You may also complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · POPIAComplaints@inforegulator.org.za · 010 023 5200 · www.inforegulator.org.za.
9. Changes
We review this notice every year and whenever our use of information changes. The current version is always on www.bbsra.co.za.
Download the privacy notice (PDF)
Access to records (PAIA)
Our PAIA manual explains which records we hold and how to request access to them.