Privacy Policy

Effective 13 September 2026. This notice is issued in terms of the Protection of Personal Information Act 4 of 2013 (POPIA).

Before this page is published, four details must be filled in. They are marked in this same colour further down: the designated Information Officer, the Google Cloud region, BMR's company registration number and registered address, and confirmation of the retention periods in the table.

1. Who is responsible for your information

The responsible party is the Bureau of Market Research (Pty) Ltd ("BMR"), a research company of the University of South Africa, which operates the BMR Data Room at bmrdataroom.co.za.

To confirm: the name and email address of BMR's designated Information Officer under POPIA, and BMR's company registration number and registered physical address. The Electronic Communications and Transactions Act requires the registration number and address to appear on a commercial site.

Questions about this notice, or any request described in section 8, may be sent to zjanz@bmr.co.za.

2. What this notice covers

It covers personal information processed through the BMR Data Room: the public pages, the request-access form, the signed-in application, and MIA, the assistant inside the application. It does not cover the estimates themselves. Those are statistical figures about places and populations and contain no information about identifiable people.

3. What we collect, and how

When you ask for access

The request form collects the name, email address, organisation and any message you provide, together with the datasets and options you selected so that a quotation can be prepared. The form asks for your agreement before it is sent.

When you have an account

BMR creates accounts for the users named in a signed agreement. We hold the user's name, email address, the organisation they belong to and the datasets they are licensed for. Sign-in is handled by Google Firebase Authentication, either by email address and password or by signing in with Google. BMR never sees or stores your password.

While you use the Data Room

Each request to the application is recorded in a usage log: the time, the signed-in email address, the request method and path, the dataset involved, the response status, how long it took, how many bytes were returned, and whether the request was a download or was refused by a limit or a permission. The log never records the contents of a request and never records the data returned. Its purpose is security and abuse prevention, licence compliance, and understanding which parts of the product are used.

When you ask MIA a question

MIA is the assistant inside the Data Room. When you send it a question we record the date and time, your email address, the dataset on screen, the question you asked, the answer MIA gave, and how long the answer took. This record exists so that BMR can review what was asked and answered in its name, and so that the questions people ask can be studied to improve the product and understand what the market needs.

Please do not type personal information about other people into MIA. It is a tool for asking about statistics, and anything typed into it is recorded as described here.

4. Why we are allowed to process it

To perform our agreement with you. Creating and maintaining your account, giving you the datasets you are licensed for, and supporting you.
Our legitimate interests. Keeping the service secure, detecting automated extraction or shared credentials, enforcing licence terms, and improving the product.
Your consent. Contacting you about an access request you submitted, and any marketing you have agreed to. Consent may be withdrawn at any time.
Legal obligation. Where a law requires us to keep or produce a record.

5. MIA, and the third party behind it

MIA is built on Anthropic's Claude API. When you ask MIA a question, the question and the relevant statistical context are sent to Anthropic to generate the answer. According to Anthropic's published policy, inputs and outputs on their systems are deleted within 30 days, and retained data is not used to train their models without express permission. Content their systems flag as violating their usage policy may be kept for up to two years. Anthropic's own documentation is linked at the end of this notice.

BMR does not send Anthropic your name, your organisation or your account details. It sends the question and the statistical context needed to answer it.

6. How long we keep it

To confirm: the periods below are the ones BMR intends to apply. Each one must be enforced by a storage lifecycle rule before this page is published, so that the promise is kept by the system rather than by memory.

Record	Kept for
Access requests that do not become subscriptions	24 months from the request
Account details of a current subscriber	For as long as the subscription runs
Account details after a subscription ends	7 years, as business records
Usage log, with the email address	12 months
MIA records, with the email address	12 months
MIA questions with the email address and any other identifier removed	Kept indefinitely, as research material

The last row matters and we would rather state it plainly than bury it. The questions people ask are how BMR learns what the market needs. Once a question has had the email address and every other identifier stripped from it, it is no longer information about a person, and BMR keeps it and studies it. What is deleted on the schedule above is everything that connects a question to you.

7. Where it is stored, and who else sees it

The Data Room runs on Google Cloud Platform. Account records, usage logs and MIA records are held in a private Google Cloud Storage bucket that only BMR can read.

To confirm: the Google Cloud region the service and the storage bucket run in. If it is outside South Africa, POPIA section 72 requires this notice to say so and to explain the basis for the transfer.

Personal information is shared only with the providers needed to run the service:

Google (Firebase Authentication, Cloud Run, Cloud Storage): hosting and sign-in.
Anthropic (Claude API): generating MIA's answers, as described in section 5.

BMR does not sell personal information, and does not share it with anyone for their own marketing.

8. Your rights

Under POPIA you may ask BMR to:

tell you what personal information we hold about you, and where we got it;
correct anything that is wrong or incomplete;
delete information we no longer have a lawful reason to keep;
object to processing based on our legitimate interests;
withdraw a consent you gave.

Send any of these to zjanz@bmr.co.za. We will respond within a reasonable time and will confirm what was done.

Some information cannot be deleted on request while it is still needed: records we must keep by law, records needed to enforce an agreement, and records needed to investigate misuse. Where that applies we will say so and explain why.

If you are not satisfied with how BMR has handled your information, you may complain to the Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191, POPIAComplaints@inforegulator.org.za, telephone 010 023 5200.

9. Security

Access to the Data Room requires an account created by BMR for a named person. Passwords are handled by Google Firebase and are never seen by BMR. Data in transit is encrypted. Logs and account records are held in a private bucket that is not publicly reachable. Requests are rate limited, and unusual patterns are visible in the usage log so that a shared or scripted account can be identified.

No system is perfect. If a breach affects your personal information, BMR will notify you and the Information Regulator as POPIA requires.

10. Changes to this notice

If this notice changes materially, the effective date above changes and subscribers are told. Previous versions are available on request.

11. References

Anthropic, API and data retention: platform.claude.com
Anthropic, how long organisation data is stored: privacy.claude.com
Information Regulator (South Africa): inforegulator.org.za