Privacy and data
The structure ReconReady should use to explain personal-information processing in plain language.
Pre-launch document
This notice is still being finalised. The operating entity is confirmed, but the sections marked below are pending completion and South African legal review.
Last updated: 21 July 2026
ReconReady is operated by Bluubin (Pty) Ltd (registration 2013/232939/07, VAT 4050266958), a South African company at Reizis Square, 1 Torbet Street, Noordhoek, Bloemfontein, 9301. Privacy requests can be sent through the contact page.
Still to confirm: the Information Officer and Deputy Information Officer registered with the Information Regulator, and the analysis of when Bluubin (Pty) Ltd acts as responsible party, operator, or both.
The implemented service may process account and profile information, uploaded source PDFs, extracted transaction rows, conversion history, technical and security logs, support correspondence, usage analytics, and payment or billing records.
The final notice must distinguish mandatory information from optional information and state whether special personal information or financial information appears in uploaded statements.
The final notice should tie each information category to an actual purpose: performing the requested conversion, managing accounts, providing customer-requested support, securing the service, preventing abuse, processing payments, improving reliability within the stated scope, and meeting legal obligations.
Do not use a broad “business purposes” clause where a specific purpose can be stated.
List each material subprocessor or a meaningful category, the service supplied, the information involved, the processing location, and the safeguards used for any cross-border transfer.
Before launch: complete the provider inventory for hosting, file storage, extraction or OCR, email, support, analytics, payments, monitoring, and backups.
Publish separate, exact retention periods for source PDFs, extracted files, conversion history, support records, account data, payment records, security logs, and backups. Explain any early-deletion control and the difference between deletion from the live service and expiry from backups.
No precise period appears here because the operating configuration has not been verified.
Describe only controls that are deployed and evidenced, including encryption scope, access management, multi-factor authentication where used, approval for exceptional support access, logging, monitoring, backup protection, incident response, and testing.
Explain the limits of security and the customer’s responsibility to protect credentials, remove local PDF passwords, and avoid sending confidential data through general support channels.
The final notice should explain how a person can request access, correction, deletion where applicable, objection, restriction, or a copy of relevant information, how identity is verified, expected response handling, and how to contact the Information Regulator.
Add the verified Information Officer contact and PAIA Manual route before launch.
State how material changes are communicated, how the effective date is maintained, and how privacy or security questions can be sent without attaching an unredacted bank statement.
Until a dedicated privacy channel is published, use the contact page to identify the appropriate operational owner.
