Your data stays yours.

1. Who is responsible

Phil Town Production (Pty) Ltd (registration number 2017/036275/07), trading as Buka, Cape Town, South Africa, is the responsible party under the Protection of Personal Information Act, 2013 (POPIA) for the personal information described here. Our Information Officer is Philip Townsend, philip@watchbuka.com.

2. The short version

• You can watch without telling us who you are. There are no accounts.
• We count what happens on the site (which episodes are played, how far, which gate was accepted) against a random session id, not against a name.
• If you give us an email address or a WhatsApp number, that is the only personal detail we hold, and every message we send has a way to stop them.
• If you pay, Payfast handles your card. We never see it. We keep a record of the purchase and the email address Payfast gives us, so you can get back in.
• Facebook's Pixel and Google Analytics load only if you tap Accept on the banner. Tap Reject and they never load. Video still plays.
• We do not sell personal information. Ever.

3. What we collect

Measurement, with no name attached

When you use the site we record events such as arriving, tapping an episode, starting playback, reaching 10, 25, 50, 75 and 95 percent of an episode, seeing a gate and accepting or declining it. Each event carries a random session id from a cookie, the page it happened on, the series and episode, a rough classification of your browser (for example "TikTok in-app browser" or "Safari"), the campaign link that brought you here if there was one, and the time. It does not carry your name, your email address, your phone number or your card details, and it is never joined to them.

Contact details, only if you give them

Some gates ask for an email address, and some ask for a WhatsApp number. Both are optional: you can always choose a different way through, or none. If you give one, we store it with the date, the fact that you ticked the consent box, the page you were on, and a private unsubscribe token.

Purchases

If you pay, Payfast sends us a confirmation containing its payment reference, the amount, the fees, and the email address you used at checkout. We store that with the series or episode you bought and the session that bought it, so that the unlock works and so that we can restore it for you on another device. We do not collect or store your card number, expiry or security code. Card payments happen entirely on Payfast's systems.

Technical

Our hosting provider records the usual server logs (IP address, request, time) for security and to keep the site running. We do not use those logs to identify viewers.

4. Why, and on what basis

• To play the video and remember your unlock. Session and unlock cookies are needed for the site to work at all (legitimate interest, and performance of the purchase).
• To understand whether the series work, in aggregate, on the phones and networks our viewers actually use (legitimate interest; the data carries no name).
• To tell you when new episodes drop, if you asked us to (consent, which you can withdraw at any time).
• To send you the link that restores your unlock (performance of the purchase).
• To show Buka to people like you on Facebook, Instagram and TikTok, and to measure that advertising, only if you accepted the banner (consent).
• To meet our legal obligations, such as keeping tax records of sales.

5. Who we share it with

Only the providers that make the site work, and only as far as needed:

• Payfast processes your payment and gives us the confirmation described above.
• Cloudflare hosts the site, delivers the video and stores our records.
• Our email delivery provider sends the unlock and new-episode emails.
• Meta (Facebook and Instagram) and Google Analytics, only if you accepted the banner, receive the standard events their tools collect. We send them no email addresses, names, phone numbers or payment details.

Some of these providers process data outside South Africa. Where that happens we rely on providers that offer an adequate level of protection and on their contractual commitments. We may disclose information if the law requires it. We never sell it.

6. Cookies, by name

We keep cookies to a minimum and we can name every one of them.

If you accept the banner, Meta and Google set their own cookies under their own policies. If you reject it, they set none. Cloudflare's video player may store playback settings in your browser; it does not identify you.

7. The consent banner

The first time you visit you will see a banner with two choices. Accept loads Facebook's Pixel and Google Analytics. Reject means they never load. Either way, the site works and the video plays. You can change your mind by clearing the bconsent cookie in your browser, after which the banner appears again.

Our own first-party measurement, described in section 3, runs either way. It carries no name and exists so that we can tell whether the series work on real phones.

8. How long we keep it

• Measurement events are kept as anonymous statistics for as long as the series are on Buka.
• Contact details are kept until you unsubscribe, or until 12 months after we last contacted you, whichever comes first. When you unsubscribe we keep the address only on a suppression list, so we never add it back by mistake.
• Purchase records are kept for as long as tax law requires, currently five years, and for as long as your unlock is active.
• Server logs are kept by our hosting provider for a short period for security.

9. Your rights under POPIA

You have the right to:

• ask what personal information we hold about you, and get a copy;
• ask us to correct or delete it;
• object to processing, or withdraw a consent you gave, at any time. Every email has an unsubscribe link. For WhatsApp, reply STOP. For the banner, clear the bconsent cookie;
• complain to the Information Regulator if you believe we have handled your information unlawfully.

To use any of these rights, email the Information Officer at philip@watchbuka.com. We will respond within five working days and will not charge you.

10. Complaints

The Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. enquiries@inforegulator.org.za for enquiries and POPIAComplaints@inforegulator.org.za for complaints.

11. Security

The site is served over HTTPS. Contact details and purchase records are stored separately from the measurement events and are never joined to them. The unlock cookie is signed so it cannot be forged. Card details never reach us. No system is perfectly secure, and if we ever learn of a breach that affects you we will tell you and the Regulator as the law requires.

12. Children

The site is not aimed at children under 13, and we do not knowingly collect personal information from them. If you think a child has given us their details, tell us and we will delete them.

13. Changes

If we change this policy we will update the date at the top and, for a material change, tell the people on our list directly. We will never quietly reduce your protection.

14. Contact the Information Officer

Philip Townsend, Information Officer, Phil Town Production (Pty) Ltd trading as Buka, Cape Town. Email philip@watchbuka.com.