Legal

Privacy Policy — Brandy and Co Media Social App

Effective date: 2 June 2026  ·  Responsible Party: Brandy and Co Media  ·  Country: South Africa

This Privacy Policy explains how Brandy and Co Media processes personal information when users connect the Brandy and Co Media Social App to Meta platforms, including Facebook, Instagram, Meta Business tools and related Meta APIs.

This policy is intended to support compliance with the Protection of Personal Information Act, 4 of 2013 ("POPIA"), applicable South African privacy requirements, and Meta Platform requirements.

1. Who we are

Brandy and Co Media operates the Brandy and Co Media Social App, a business social media workflow app used to support content planning, publishing, scheduling, analytics, campaign reporting and operational marketing support.

For the purposes of POPIA, Brandy and Co Media is the Responsible Party where it decides why and how personal information is processed.

Where the Brandy and Co Media Social App processes information on behalf of a client, business, agency, page owner or account owner, that client or business may also be a Responsible Party, and Brandy and Co Media may act as an Operator under POPIA.

2. Scope of this policy

This policy applies to personal information processed through the Brandy and Co Media Social App, including information received through Facebook, Instagram, Meta Business tools and related Meta APIs.

The app is intended for authorised business users, page administrators, marketing teams, agencies and clients managing business or company pages. It is not intended to collect unnecessary personal profile information.

3. Information we may collect

Depending on the permissions granted by the authorised user, business, Facebook Page, Instagram account or Meta Business account, the app may collect or access the information below.

3.1 Meta account and authorised user information

We may collect or access:

• authorised user name or display name;
• Meta user ID or app-scoped user ID;
• email address, where provided or authorised;
• account identifiers required to authenticate the integration;
• access tokens and permission scopes granted to the app; and
• role or permission information related to pages, businesses or connected accounts where required by Meta APIs.

3.2 Facebook Page information

Where authorised, we may collect or access:

• Facebook Page ID and Page name;
• Page profile information;
• Page access tokens;
• Page posts, captions, media, links and related metadata;
• scheduled or published post information;
• Page insights, analytics, reach, engagement, impressions and performance metrics; and
• Page administrator or authorised user relationship information where required by Meta APIs.

3.3 Instagram Business or Creator account information

Where authorised, we may collect or access:

• Instagram Business or Creator account ID;
• Instagram username and profile information;
• connected Facebook Page information;
• Instagram media, captions, comments, hashtags, mentions and metadata;
• publishing, scheduling and content status information; and
• Instagram insights, engagement metrics, reach, impressions and audience-related analytics available through Meta APIs.

3.4 Content, campaign and reporting information

Users may provide or generate content through the Brandy and Co Media Social App, including:

• draft posts, captions, images, videos, links, tags and publishing schedules;
• campaign names, campaign metadata and workflow status;
• client, brand or page labels used for internal organisation;
• approval notes, comments, instructions and audit trail information; and
• reports, summaries and performance analysis.

3.5 Technical and usage information

We may collect:

• login and authentication logs;
• API request logs and integration status;
• device, browser, IP address and system metadata;
• error logs and diagnostic information;
• security, audit and access records; and
• usage activity within the Brandy and Co Media Social App.

4. How we use information

We use the information described above to:

• connect the Brandy and Co Media Social App to Facebook Pages, Instagram Business accounts and Meta Business assets;
• authenticate authorised users and maintain secure access;
• schedule, publish, edit or manage social media content where authorised;
• retrieve insights, analytics, reporting and performance data;
• display connected pages, accounts, campaigns and post status to authorised users;
• support campaign planning, approval workflows and operational reporting;
• troubleshoot errors, maintain the service and improve platform reliability;
• detect, prevent and respond to unauthorised access, misuse, fraud or security incidents; and
• comply with legal, regulatory, contractual and Meta Platform obligations.

We do not sell personal information.

5. Lawful basis for processing under POPIA

We process personal information only where a lawful basis exists under POPIA. Depending on the context, this may include:

• Consent: where a user, page administrator, business owner or authorised representative grants permissions through Meta or the Brandy and Co Media Social App.
• Contract: where processing is necessary to provide services requested by a client, user or business.
• Legitimate interests: where processing is necessary for platform security, service improvement, reporting, operational management and fraud prevention, provided those interests do not unjustifiably infringe privacy rights.
• Legal obligation: where processing is necessary to comply with applicable laws, regulatory requirements, tax, accounting, audit or platform obligations.

Users may withdraw consent or disconnect Meta integrations as described in this policy.

6. Meta Platform permissions

The app may request Meta permissions required for its functionality. These may include permissions related to:

• accessing or managing Facebook Pages;
• publishing or scheduling Page content;
• reading Page or Instagram account insights;
• accessing Instagram Business or Creator account information;
• managing Instagram content publishing where authorised; and
• reading engagement, media or comment-related information where required for approved workflows.

We only request permissions that are necessary for the intended functionality of the Brandy and Co Media Social App.

7. Sharing of information

We may share personal information only where necessary and lawful, including with:

• authorised users within the same client, agency, business or campaign workspace;
• Meta Platforms, Inc. and its affiliates, as required to use Facebook, Instagram and Meta APIs;
• hosting, database, infrastructure, security, analytics and support service providers;
• professional advisers, auditors or legal representatives where required;
• regulators, courts, law enforcement or public authorities where legally required; and
• successors or parties involved in a business transfer, merger, restructuring or sale, subject to appropriate confidentiality and privacy safeguards.

We do not share Meta user data with unauthorised third parties.

8. Storage and security

We use reasonable technical and organisational safeguards to protect personal information against loss, misuse, unauthorised access, disclosure, alteration and destruction. These safeguards may include access controls, role-based permissions, secure transmission, secure storage of access tokens, logging, monitoring, and regular review of platform access.

No system can be guaranteed to be completely secure. If we become aware of a security compromise, we will take appropriate steps under POPIA, including notifying affected parties and the Information Regulator where required.

9. Retention of information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by law. Access tokens and integration credentials are retained only while needed to provide the connected service or until the user or business disconnects the integration.

10. User rights under POPIA

Under POPIA, data subjects may have the right to:

• request confirmation that we hold personal information about them;
• request access to their personal information;
• request correction or deletion of inaccurate, outdated, incomplete or unlawfully processed information;
• object to processing in certain circumstances;
• withdraw consent where processing is based on consent;
• request restriction of processing where applicable; and
• lodge a complaint with the Information Regulator of South Africa.

To exercise these rights, contact us using the details below.

11. Disconnecting Meta integrations

Users can disconnect the Brandy and Co Media Social App from Meta platforms by:

1. removing the connected integration in the app, where available;
2. removing the app directly from Facebook or Meta Business settings; or
3. sending a request to the privacy contact email below.

12. Data deletion requests

Users may request deletion of personal information associated with the Brandy and Co Media Social App. See our data deletion instructions page for full details. You may also email the privacy contact below directly.

13. Children's privacy

The Brandy and Co Media Social App is intended for business and professional use. It is not intended for children and does not knowingly collect personal information from children.

14. International transfers

Personal information may be stored, processed or accessed in countries outside South Africa, including where our service providers, infrastructure providers or Meta-related services operate internationally. Where information is transferred outside South Africa, we will take reasonable steps to ensure appropriate safeguards are in place as required by POPIA.

15. Direct marketing

The Brandy and Co Media Social App is primarily a business platform. We may send service-related communications. Where we send direct marketing communications, we will do so in accordance with POPIA. Users may opt out where applicable.

16. Cookies and website tracking

If our website or platform uses cookies or similar technologies, these may be used for authentication, security, preferences, analytics and service improvement. Users can manage cookie preferences through their browser settings.

17. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be published on our website with a revised effective date.

18. Contact us

19. Information Regulator of South Africa

Data subjects may also contact the Information Regulator of South Africa if they believe their rights under POPIA have been infringed.

Information Regulator South Africa
Website: inforegulator.org.za