Privacy Policy

Creative Media Agency ("we", "us", "our") is committed to protecting your personal information and processing it responsibly, lawfully, and transparently in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African data protection laws.

This Privacy Policy applies to all personal information collected through the CMART™ App platform, the website cmart-app.co.za, and any associated services, communications, or lead magnets offered by Creative Media Agency.

By accessing or using the CMART™ App, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Policy.

1. Who We Are

Responsible Party (as defined in POPIA):
Creative Media Agency, a Division of Digital Business Solutions (Pty) Ltd
196 Willson Street, Fairland, Johannesburg, 2170
Gauteng, South Africa

Information Officer:
Yvette Pretorius
Email: support@creativemediagency.co.za
Website: cmart-app.co.za

2. Personal Information We Collect

We collect only the personal information necessary to provide our services and communicate with you effectively. The categories of personal information we may collect include:

2.1 Information You Provide Directly

• Identity information: First name, last name, business name
• Contact information: Email address, phone number (including WhatsApp number)
• Business information: Industry or niche, business type, business location
• Account information: Username, password (encrypted), subscription plan, billing details
• Assessment data: Responses provided in the CMART Growth Score™ assessment
• Communication data: Information contained in emails, form submissions, support requests, or WhatsApp messages sent to us
• Payment information: Billing address and payment method details (processed securely through PayFast or Stripe — we do not store raw card data)

2.2 Information Collected Automatically

• Technical data: IP address, browser type, device type, operating system
• Usage data: Pages visited, features accessed, time spent on the platform, click behaviour
• Cookie data: As described in Section 8 of this Policy

2.3 Information From Third Parties

We may receive information about you from third-party services such as Facebook Lead Ads, Google, or referral partners where you have consented to that information being shared. We use such information only for the purposes described in this Policy.

3. How We Use Your Personal Information

We process your personal information only for specific, lawful purposes. Our legal bases for processing under POPIA include your consent, the performance of a contract, compliance with a legal obligation, and our legitimate interests where these do not override your rights.

We use your personal information to:

• Create and manage your CMART™ App account
• Deliver the services you have subscribed to or requested
• Process payments and manage your subscription billing
• Provide onboarding, setup, and technical support
• Send transactional communications (account confirmations, receipts, service notifications)
• Send marketing communications, newsletters, and educational content — where you have opted in (you may opt out at any time)
• Personalise your experience on the platform and in our communications
• Deliver your CMART Growth Score™ report and associated nurture content where you have consented
• Deliver free resources, guides, or downloads you have requested
• Improve, develop, and test our platform and services
• Conduct analytics and usage reporting to enhance our offerings
• Comply with our legal obligations under South African law
• Prevent fraud, abuse, or security incidents on the platform

4. How We Share Your Personal Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We may share your information with:

4.1 Service Providers (Operators under POPIA)

We engage trusted third-party service providers who process data on our behalf solely to deliver our services. These include:

• GoHighLevel — platform infrastructure, CRM, email, SMS, and automation delivery
• PayFast / Stripe — payment processing (PCI DSS compliant)
• Google Analytics — website analytics and usage tracking
• Meta (Facebook/Instagram) — advertising and social integration where applicable
• WhatsApp (via LC Phone or 360Dialog) — WhatsApp message delivery
• Zapier / Make — integration automation where you have configured such integrations

All service providers are contractually required to process your data only as instructed by us, to maintain appropriate security measures, and to comply with applicable data protection legislation.

4.2 Legal and Regulatory Authorities

We may disclose personal information to law enforcement, courts, or government authorities where required to do so by law, or where necessary to protect our legal rights or the safety of our users.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business assets, personal information may be transferred to the acquiring entity, subject to the same protections described in this Policy.

5. Your Data as a CMART™ App User (Client Data)

When you use the CMART™ App to manage your own business, you store and process personal information about your clients within the platform (such as their contact details, booking history, and communication records). In this context:

• You are the Responsible Party for your clients' data under POPIA
• We are the Operator — we process that data on your behalf, as instructed by your use of the platform
• You are responsible for ensuring you have a lawful basis for processing your clients' personal information and that you have complied with all applicable POPIA obligations
• Your client data is not used by us for our own marketing or purposes beyond delivering your contracted services

6. Data Retention

We retain your personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

• Active account data: Retained for the duration of your subscription
• Post-cancellation data: Retained for 30 days to allow you to export your data, then permanently deleted
• Marketing data (where consent was given): Retained until you withdraw consent or unsubscribe
• Financial records: Retained for 5 years as required by South African tax and financial legislation
• Legal compliance data: Retained for as long as required by applicable law

7. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights in relation to your personal information:

• Right of access: You may request a copy of the personal information we hold about you
• Right to correction: You may request that we correct inaccurate or incomplete personal information
• Right to deletion: You may request deletion of your personal information, subject to our legal obligations to retain certain records
• Right to object: You may object to the processing of your personal information for direct marketing purposes at any time
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing
• Right to data portability: You may request your data in a portable format within the retention window
• Right to lodge a complaint: You have the right to lodge a complaint with the Information Regulator of South Africa if you believe your personal information rights have been violated

Information Regulator of South Africa
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

To exercise any of your rights, please contact our Information Officer at:
Email: support@creativemediagency.co.za
Subject line: POPIA Data Request — [Your Name]

We will respond to all legitimate requests within 30 days. In complex cases, this may be extended by a further 30 days with notice.

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us recognise you, remember your preferences, and improve your experience. We use both first-party cookies (set by us) and third-party cookies (set by our service providers).

8.2 Types of Cookies We Use

• Strictly necessary cookies: Required for the platform to function. These cannot be disabled. They include session authentication and security cookies.
• Functionality cookies: Remember your preferences and settings (such as login state and language).
• Analytics cookies: Collect anonymised data about how visitors use our website to help us improve it. We use Google Analytics for this purpose.
• Marketing cookies: Used to track visits and show you relevant advertising (including Meta Pixel where applicable). These are only active where you have consented.

8.3 Managing Cookies

When you first visit cmart-app.co.za, you will be presented with a cookie consent banner. You may accept all cookies, reject non-essential cookies, or manage your preferences. You can also control cookies through your browser settings at any time. Note that disabling certain cookies may affect the functionality of the platform.

9. Security of Your Personal Information

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption on all web pages and data transmissions
• Encrypted storage of account passwords (we never store passwords in plain text)
• Secure, SOC 2 compliant cloud infrastructure via GoHighLevel
• Role-based access controls limiting staff access to personal data
• Regular security reviews and updates
• PCI DSS compliant payment processing (we do not store raw card data)

While we take every reasonable precaution, no system is completely immune to security risks. In the unlikely event of a data breach affecting your rights and freedoms, we will notify you and the Information Regulator as required by POPIA within the prescribed timeframes.

10. Cross-Border Data Transfers

Some of our service providers, including GoHighLevel, are based outside of South Africa. Where personal information is transferred to a third country, we ensure that appropriate safeguards are in place to protect your data in accordance with POPIA Section 72, including contractual protections requiring equivalent data protection standards.

11. Children's Privacy

The CMART™ App is intended for business use by persons 18 years of age and older. We do not knowingly collect personal information from children under the age of 18. If you believe a minor has submitted personal information to us, please contact us at support@creativemediagency.co.za and we will delete such information promptly.

12. Direct Marketing and Opt-Out

We may send you marketing communications about our services, features, educational content, and promotions where you have:

• Explicitly opted in at the time of sign-up or form submission, or
• Previously engaged with our services (existing client relationship under POPIA Section 69)

You may opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email
• Replying "STOP" to any SMS or WhatsApp marketing message
• Emailing support@creativemediagency.co.za with the subject "Unsubscribe"

Opting out of marketing communications does not affect transactional or service-related communications related to your active subscription.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Where changes are material, we will notify you via email or an in-platform notification before the changes take effect. The updated Policy will always be available at cmart-app.co.za/privacy-policy with the revised effective date.

Your continued use of the CMART™ App after the effective date of any updated Privacy Policy constitutes your acceptance of the changes.

14. Contact Our Information Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Information Officer:

Information Officer: Yvette Pretorius
Creative Media Agency, a Division of Digital Business Solutions (Pty) Ltd
196 Willson Street, Fairland, Johannesburg, 2170
Gauteng, South Africa
Email: support@creativemediagency.co.za
Website: cmart-app.co.za

We are committed to resolving any privacy concerns promptly and fairly.

This Privacy Policy was last updated in May 2026 and is effective from 1 June 2026.

Creative Media Agency (a Division of Digital Business Solutions (Pty) Ltd) · cmart-app.co.za · Powered by Creative Media Agency

Questions about this policy?

Our team is happy to help.

We use cookies to improve your experience

We use necessary cookies to make our site work and optional analytics cookies to understand how you use it. By clicking 'Accept All', you consent to our use of cookies. You can manage your preferences or read more in our Privacy Policy.