Privacy notice: BuyTheBest referral links

Who we are

We are K2026800654 (South Africa) (Pty) Ltd (registration number 2026/800654/07; a change of company name is pending [TO CONFIRM]), trading as BuyTheBest. We run a referral network: publishers link to shops that are members of the network, and when a reader clicks one of those links, or buys after clicking, the shop pays a fee and we pass most of it to the publisher.

Contact us about privacy at hello@buythebest.co.za. Our Information Officer: [TO CONFIRM]. Our postal and physical address: [TO CONFIRM].

What we hold

When you click one of our links, we record one line about that click:

• a random click id that we create for the click (it does not come from you);
• which link you clicked: the publisher, the article, the shop and the product;
• the date and time;
• a scrambled, one-way code made from your internet (IP) address with a secret key (a salted hash). We never store the address itself;
• your browser's "user agent" (a short description of the browser and device type that every browser sends);
• the address of the page you clicked from, without anything after a "?" in it;
• whether the click looked automated (a yes or no).

A browser id, where switched on [TO CONFIRM]: a random code in a cookie called __session on go.buythebest.co.za, so that repeated clicks from one browser are counted once. It expires 25 hours after your last click. We store only a scrambled one-way code made from it, never the code itself.

The referral id. The click id is added to the shop's web address as btb_ref=…. The shop's website keeps it in its own cookie, _btb_ref, and, if you buy, saves it with your order.

If you buy after clicking, the shop tells us about that order: the order number, the amounts and currency, and the products (product code, quantity and price), with the referral id. Shops also tell us about refunds of those orders.

What we never store: your name, email address, phone number or postal or delivery address. A shop's order report that contains any of them is refused. Shopify's own notifications to our Shopify app (an order, or a request to erase or report a customer's information) can contain them; we remove them before anything is stored or logged.

If you opt out, a cookie on go.buythebest.co.za that says only that you opted out (see "Opting out").

Why we hold it

We use this information for three things only:

• Commission: to work out what each publisher has earned from the clicks and sales its links produced, and to pay it;
• Billing: to bill each shop for the clicks and referred sales it agreed to pay for, and to let the shop check our figures;
• Fraud prevention: to find and leave out clicks that are automated, repeated or otherwise not genuine readers, so that nobody pays for them.

We do not use it for advertising, retargeting, profiling, building audiences or anything else. We never give it to an advertising platform, never sell it, and never combine what one shop tells us with another shop's information.

Our lawful basis

We rely on legitimate interests (section 11(1)(f) of the Protection of Personal Information Act, POPIA): our interest, the shops' and the publishers' in being paid correctly for referrals, and in keeping fraudulent clicks out of everyone's bills. We have weighed those interests against yours and keep what we collect to the minimum the three purposes above need. Because we rely on legitimate interests, you may object at any time (section 11(3)); see "Opting out".

Who receives it

• The shop you click through to receives the referral id in its web address, keeps it in its own cookie and saves it with your order if you buy. The shop already has your order; we do not send it anything else about you.
• The publisher whose article you were reading receives totals only: numbers of clicks and sales, and amounts, per article and per link. Never anything about an individual reader.
• Google Cloud, our hosting provider, stores and processes the information for us, under its data processing terms.
• Shopify, for shops that run on Shopify: with the shop's permission we read that one referred order from the shop's Shopify store to check its figures, and Shopify bills those shops for our fees. The billing charges we send Shopify carry no referral id.

No advertising platform, data broker or audience builder receives any of it from us. The shop's own analytics and advertising tools (for example a Meta Pixel or Google Analytics on its website) can read the referral id from the address of the page you land on and from its _btb_ref cookie; the shop's own privacy notice covers what they do with it.

Where it is kept, and for how long

Our hosting is operated by Google (Google Cloud). The information we store — our databases (Google BigQuery and Firestore) and our service's secrets — is kept in South Africa, in Google Cloud's Johannesburg region (africa-south1). The requests your browser makes to us — following one of our links, or opting out — are processed by Google Cloud in Belgium (its europe-west1 region), outside South Africa, and our service's logs may be held outside South Africa.

• Click records: [TO CONFIRM]; no automatic deletion is set up yet. If you object, we delete the parts that describe you (the scrambled IP code, the scrambled browser code, the user agent and the page you came from) and keep the click id, link, time and amounts as billing records.
• The browser-id cookie: 25 hours after your last click.
• The shop's _btb_ref cookie: the period in that shop's agreement with us, 30 days unless agreed otherwise (between 1 day and 90 days). It is on the shop's website, so you remove it by clearing that shop's cookies.
• Order records from shops: the order number and amounts are tax records and are kept for 5 years [TO CONFIRM]; deleting them automatically after that is not built yet. When a shop tells us you asked it to erase your information, we delete the product lines and the referral id from the shop's order reports; our record of the commission that order earned keeps its click id, with the amounts, as a billing record [TO CONFIRM].
• Order details we hold while checking whether an order came through one of our links: up to 48 hours. Refund details waiting for their order: up to 7 days.
• Your IP address: used in our server's memory for up to 60 seconds to limit abuse, and never written down by our application. Our hosting platform's own request logs: [TO CONFIRM].
• The opt-out cookie: It is set to last about 5 years, but browsers may delete it sooner: Chrome keeps any cookie for at most about 13 months, and because you normally only pass through our link address on the way to a shop, Safari and Chrome may delete its cookies after roughly 30 to 45 days in which you have not used our pages directly. We reset the cookie each time you click one of our links, but that does not stop those browsers deleting it, so come back to the opt-out page and press "Renew my opt-out" from time to time.
• Our record of an objection you sent us by email: [TO CONFIRM].

Your rights

Under POPIA you may:

• object to our use of your information at any time (section 11(3)): opt out on our opt-out page, or email us;
• ask what we hold about you (section 23);
• ask us to correct or delete it (section 24).

Email hello@buythebest.co.za. Because we never hold your name or email address, we can find your records only if you give us something that points to them: the referral id (the btb_ref= value in the address of the shop page you landed on), or the shop and the date of your click. We will reply within a reasonable time [TO CONFIRM]. When we delete, we keep only what tax and billing records require (ids and amounts) [TO CONFIRM].

Complaining to the Information Regulator

If you are unhappy with how we have handled your information, please tell us first at hello@buythebest.co.za. You may also complain to the Information Regulator (South Africa):

• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200 (toll free 0800 017 160)
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: https://inforegulator.org.za/

Opting out

Use our opt-out page. After you opt out, our links still take you to the shop, but we add no referral id and record nothing about your clicks. The shop is not told about your purchases through us, and the publisher is not paid for your clicks.

If your browser sends the Global Privacy Control signal, we treat every click from it exactly as if you had opted out.

The opt-out is a cookie, so it applies to the browser and device you used, and clearing your cookies removes it. It does not remove a _btb_ref cookie a shop's website already set from an earlier click; clear that shop's cookies, or email us with the referral id.

Children

Our links are meant for adults. We ask publishers not to place them on content aimed at children. If you are under 18, please use the opt-out page, or ask a parent or guardian to contact us at hello@buythebest.co.za.

Changes to this notice

We will update this notice when what we do changes. Last updated: 2026-10-12.