Legal

Privacy Policy

Effective date: 20 April 2026

The Bold Desk (“The Bold Desk”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information we collect, process and store. This Privacy Policy explains what information we collect, how we use it, the lawful basis for processing, who we share it with, and your rights under applicable data-protection law, including the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

This Policy also covers information we receive when you contact us through WhatsApp, the WhatsApp Business Platform, Facebook Messenger, Instagram, or any other Meta Platforms, Inc. (“Meta”) service. By contacting us on these channels you acknowledge that you have read and understood this Policy.

1. Who we are

The Bold Desk provides medical billing (Rhino & Panacea), accounting (Sage), debtors & creditors management, personal-assistant services and AI business automation to healthcare practices and businesses, primarily in South Africa.

2. Information we collect

2.1 Information you give us

2.2 Information collected automatically

2.3 Information from WhatsApp, Meta and third parties

When you message us on WhatsApp or a Meta-operated channel, we receive the phone number or profile identifier you message from, your profile name (if you set one), message content and the timestamps of your messages. Meta processes this data according to its own WhatsApp Privacy Policy and Meta Privacy Policy. We only receive what Meta makes available to business accounts; we do not receive your WhatsApp contacts, social graph, or unrelated account data.

3. How we use your information

We process personal information only for specific, lawful purposes:

4. Lawful basis for processing

We rely on one or more of the following lawful bases under POPIA and equivalent legislation:

5. How we share information

We do not sell your personal information. We share it only with:

All third parties are required to safeguard personal information and process it only for the purpose we specify.

6. International transfers

Some of our service providers (including Meta) operate servers outside South Africa. Where personal information is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses or the provider’s binding corporate rules, in line with section 72 of POPIA.

7. How long we keep information

We retain personal information only for as long as necessary for the purposes set out in this Policy, or for the period required by law (e.g. South African tax and accounting legislation generally requires records to be kept for at least five years). WhatsApp messages and attachments are retained only for as long as needed to service the related enquiry or client engagement.

8. Your rights

Subject to applicable law, you have the right to:

To exercise any right, email info@thebolddesk.co.za.

9. Security

We implement appropriate technical and organisational measures to protect personal information against loss, unauthorised access, alteration and disclosure. No transmission over the internet is fully secure, so we encourage you to use strong passwords and avoid sending sensitive data over unsecured channels.

10. Children

Our services are directed at businesses and healthcare practices and are not intended for children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can remove it.

11. Cookies

Our website uses a minimal set of cookies to provide essential functionality and to analyse traffic. You can disable cookies through your browser settings; doing so may limit certain features of the site.

12. Changes to this Policy

We may update this Policy from time to time. The latest version will always be posted on this page with a revised “Effective date”. Material changes will be communicated by email or via a prominent notice on our website.

13. Contact us

Questions, requests or complaints about this Privacy Policy or our handling of personal information should be directed to: