Privacy Policy and POPIA notification

Last updated: 10 August 2026

1. Who we are

This website, bigskyfinancials.trade, is operated by Big Sky Investments, a marketing agency that plans, builds and manages advertising campaigns on behalf of client advertisers.

• Business name: Big Sky Investments
• Physical and postal address: 121 Beyers Naudé Drive, Roosevelt Park, Johannesburg, 2195, South Africa
• Email: info@bigskyfinancials.trade
• Website: https://bigskyfinancials.trade
• Business hours: Monday to Friday, 08:00–17:00 SAST

Our company registration particulars are not currently published on this website. If you require them for a transaction or for service of process, request them at info@bigskyfinancials.trade.

Big Sky Investments is the responsible party, as that term is used in the Protection of Personal Information Act, 2013 (POPIA), for the personal information collected through bigskyfinancials.trade. Where we handle personal information inside a client's advertising accounts, we act as an operator and not as the responsible party; section 3 of this policy sets out that split.

Big Sky Investments provides marketing and advertising services only. We do not provide financial, investment or trading advice, and we are not an authorised financial services provider in terms of the Financial Advisory and Intermediary Services Act, 2002.

2. Information Officer

We publish the Information Officer as a role rather than as a named individual, so that the contact point remains correct regardless of who occupies it.

• Office: The Information Officer, Big Sky Investments
• Email: info@bigskyfinancials.trade
• Postal address: The Information Officer, Big Sky Investments, 121 Beyers Naudé Drive, Roosevelt Park, Johannesburg, 2195, South Africa

The Information Officer is responsible for our compliance with POPIA, for the conditions for lawful processing set out in Chapter 3 of that Act, for handling requests from data subjects about their personal information, and for dealing with requests for access to records under the Promotion of Access to Information Act, 2000 (PAIA). Requests, objections and complaints may be addressed to the Information Officer at the email or postal address above; we respond within one business day during business hours, and complete the request within the periods prescribed by the relevant Act.

The procedure for a formal access request, including the prescribed forms and fees, is set out in our PAIA manual.

3. Scope of this policy

This policy covers two distinct kinds of processing. They carry different roles, different obligations and different points of contact, and it matters which one applies to you.

(a) Personal information we collect as responsible party

When you visit bigskyfinancials.trade, send us an enquiry, or correspond with us about becoming a client, we decide why and how that information is processed. For this information Big Sky Investments is the responsible party, and everything in this policy applies to us directly. This covers site visitors, enquiry-form leads, and the contact and billing details of our own clients and suppliers.

(b) Client Google Ads account data we process as operator

When we manage an advertising account for a client, we process the data in that account on the client's documented instructions, under a written services agreement. In that relationship the client is the responsible party and Big Sky Investments is the operator. We process that data only for the client whose account it is, only for the purposes the client has instructed, and we do not determine the purpose of the processing ourselves.

4. What personal information we collect and its source

We collect the following categories of personal information. Except where stated, the source of the information is you, supplied directly.

Enquiry form and email correspondence

• Name — the name you type into the enquiry form or sign an email with.
• Business name — the organisation you are enquiring on behalf of.
• Email address — the address we reply to.
• Message content — whatever you choose to write, including any details about your business, budget or current advertising that you decide to include.
• Marketing consent — whether you ticked the optional box consenting to marketing email, recorded so we can show the basis on which we contact you and honour a withdrawal.

We do not ask for a telephone number and no telephone field exists on this site. Please do not send us identity numbers, banking details, health information, or any other special personal information as defined in section 26 of POPIA; we do not need it and we do not want it in an enquiry.

Server logs

Our website hosting provider records standard web-server logs on our behalf. The source of this information is your browser and network connection rather than a form you fill in.

• IP address of the connecting device.
• User agent string — the browser and operating system your request reports.
• Pages viewed, with the date and time of each request and the response status.
• Referrer — the address of the page that linked you here, where your browser sends one.

Consent choice stored in your browser

A record of the choice you made on the cookie notice, kept in your own browser's local storage and not sent to us. Section 21 sets out exactly what is stored and how to refuse it.

Client contact and billing details

For clients who engage us, we additionally hold the names, job titles, email addresses and business contact details of the people we deal with, together with billing details such as the billing entity, billing address and the tax information we are required to record on an invoice. Some of this reaches us from the client organisation rather than from the individual.

Client advertising account data

Under an engagement we access the client's Google Ads account and other advertising and analytics accounts. The Google Ads API data specifically is described in section 6. The source of that data is the platform, accessed with the account owner's authorisation.

5. Purpose of collection, and whether supply is voluntary or mandatory

This section is the notification required by section 18 of POPIA. No law compels us to collect any of the information below. Supply is voluntary in every case. What differs is the consequence of withholding it.

Name, business name and email address

Purpose: to identify who is writing, to reply to your enquiry, and to keep a record of the correspondence.
Voluntary or mandatory: voluntary, but the enquiry form cannot be submitted without a name, an email address and a message. The business name field is optional.
Consequence of not supplying it: we have no way to answer you. You may instead write from any address you choose, or post a letter to the address in section 1.

Message content

Purpose: to understand what you are asking for and to prepare a useful reply or proposal.
Voluntary or mandatory: no law compels it, but the enquiry form cannot be submitted with the message field empty. How much detail you put in it is entirely up to you.
Consequence of not supplying it: our reply will be more general, and we may need to ask follow-up questions before we can scope anything.

Marketing consent

Purpose: to record whether you ticked the optional box consenting to marketing email, so that we can show the basis on which we contact you and honour a withdrawal.
Voluntary or mandatory: entirely voluntary. The box is unticked by default and the form submits either way.
Consequence of not supplying it: none. We answer your enquiry as normal and send you no marketing.

Server log information

Purpose: to serve the pages you request, to keep the site available, to detect and investigate abuse such as automated scraping or attempted intrusion, and to diagnose faults.
Voluntary or mandatory: unavoidable as a technical matter — an IP address is how a response reaches your device.
Consequence of not supplying it: the site cannot be served to you at all. You may reduce what is recorded by using a privacy-preserving network or browser, and we do not attempt to defeat such measures.

Consent choice stored in your browser

Purpose: to record whether you accepted or refused non-essential cookies, so that you are not asked repeatedly. The site sets no cookies; see section 21.
Voluntary or mandatory: entirely voluntary. Nothing is stored until you answer the notice, and nothing is sent to us either way.
Consequence of not supplying it: none of substance. The site works normally if you refuse; you may simply see the notice again on a later visit.

Client contact and billing details

Purpose: to perform the services agreement, to send invoices, to keep the accounting records required of us, and to reach the people authorised to approve changes to an advertising account.
Voluntary or mandatory: voluntary, but required by the contract. Tax legislation obliges us to record certain particulars on an invoice once a transaction has taken place.
Consequence of not supplying it: we cannot invoice or contract with you, and cannot take instructions we are able to verify.

6. Google user data we access through the Google Ads API

Where a client asks us to manage their Google Ads account, our software connects to the Google Ads API. The following is a complete description of that access.

• The only OAuth scope we request is https://www.googleapis.com/auth/adwords, described by Google as “See, edit, create, and delete your Google Ads accounts and data”.
• No other Google scope is requested. We do not request access to Gmail, Google Drive, Google Contacts, Google Calendar, YouTube account data, or any other Google service, and our application will never present you with a consent screen asking for them.
• Access is granted by the account owner, either through the OAuth 2.0 consent flow, in which the owner signs in to their own Google Account and authorises our application, or through a Google Ads manager-account link that the owner accepts inside Google Ads, or both.
• The data retrieved is limited to Google Ads account structure and settings; campaign, ad group, ad, keyword and negative keyword records; budget and bidding configuration; conversion actions and conversion data; and performance data such as impressions, clicks, cost, conversions and the associated metrics and segments.

We do not receive Google Account passwords at any point. The authorisation is held as an OAuth credential issued by Google, which the account owner can withdraw at any time as described in section 15. Further technical detail is set out on our Google Ads API page.

7. How we use Google user data

Google user data obtained through the Google Ads API is used only to provide and improve the advertising management service the client has engaged us for, in that client's own account. The complete list of uses, including the write actions, is:

• Producing client performance reports — reading campaign, ad group, ad, keyword, budget and conversion metrics to compile the reporting and dashboards a client receives about their own account.
• Creating, editing, pausing and removing campaigns, ad groups, ads, keywords, negative keywords, negative keyword lists, audiences, ad extensions and budgets; plus bid strategy settings and conversion tracking configuration. Editing includes changes to targeting, bids, budgets, schedules, ad copy and landing page URLs. Removal in Google Ads is not reversible, so these actions are recorded in a change log against the person who made them.
• Keyword and recommendation research — retrieving keyword ideas, forecasts and Google's own recommendations for that client's account, in order to plan work in that account.
• Configuring and verifying conversion tracking so that the results reported to the client reflect what actually happened.

Every one of these uses is confined to the account of the client who authorised the access, and to the scope of the written engagement with that client. Section 11 lists the uses we specifically exclude.

8. How we store and secure Google user data

• Access to the systems holding Google user data requires individual named accounts with multi-factor authentication.
• OAuth refresh tokens and client secrets are encrypted at rest and stored separately from application data.
• Data in transit is protected by TLS meeting the Google Ads API requirement of at least 128-bit encryption.
• Access is granted on a least-privilege basis to the team assigned to that client, and removed when the assignment ends.
• Access to client accounts, and changes made through the API, are logged.

These are the reasonable technical and organisational measures required by section 19 of POPIA to secure the integrity and confidentiality of personal information in our possession. No system is beyond compromise; section 20 of this policy sets out what we do if one occurs.

9. Human access to client account data

Client Google Ads account data is not open to everyone at Big Sky Investments. It is accessible only to named, authorised personnel who have been assigned to that specific client engagement.

• Access is granted per client, not in general, and only to the people doing that client's work.
• Access rests on the client's written engagement and authorisation, and ends when the engagement or the person's assignment ends.
• Every person with access is bound by written confidentiality obligations in their contract with us.
• Access is logged, and the log identifies the individual, not just the organisation.
• Automated processing — scheduled reporting and data retrieval — runs under service credentials scoped to that client's account alone.

A client may ask us at any time, at info@bigskyfinancials.trade, for the list of individuals who currently hold access to their account.

10. Who we share data with

We share personal information and Google user data with the following recipients, each for a defined purpose:

1. Google LLC and/or Google Ireland Limited — operating the Google Ads platform and the Google Ads API.
2. Our website hosting provider — hosting this site and its server logs.
3. Our email provider — carrying our mail, including enquiries sent through this site.
4. Other advertising, measurement and analytics platforms on which a client's campaigns run, where the client has instructed us to operate them.
5. Our accountants and professional advisers — where necessary for bookkeeping, audit or legal advice, under professional confidentiality obligations.
6. Any authority to which disclosure is required by law, or where disclosure is necessary to establish, exercise or defend a legal claim.

Where a recipient processes personal information on our behalf it does so as our operator, on our instructions, under an agreement requiring it to keep the information confidential and to apply appropriate security safeguards, as section 21 of POPIA requires. Where we are obliged to disclose information by a court order, a subpoena or a law of the Republic, we will tell the affected party unless we are legally prohibited from doing so.

11. What we never do with Google user data

The following are absolute exclusions. They apply to all Google user data obtained through the Google Ads API, and they are not subject to a commercial exception:

• We do not sell it. Google user data is not sold, licensed, rented or otherwise made available for consideration to anyone.
• We do not transfer it to advertising platforms, data brokers or information resellers.
• We do not use it to serve advertising of our own, and we do not use it for retargeting or for personalised advertising directed at any individual.
• We do not use it to determine credit-worthiness or for any lending, credit scoring, insurance or underwriting purpose.
• We do not use one client's data for another client. Account data is not pooled, benchmarked across clients, or used to inform work on any account other than the one it came from.
• We do not build audience databases or contact lists from it.
• We do not use it to train generalised artificial intelligence or machine-learning models, and we do not transfer it to any third party for that purpose.

Human beings read Google user data only for the limited purposes permitted by the Google API Services User Data Policy: to do the client's own work as described in section 7, where the client has given explicit consent for specific data, where it is necessary for security purposes such as investigating abuse, where the law compels it, or where the data has been aggregated and anonymised for internal operations such as capacity planning.

12. Limited Use

Big Sky Investments' use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

13. Retention

Section 14 of POPIA requires that records of personal information are not kept for longer than necessary to achieve the purpose they were collected for, unless a law requires otherwise. Our periods are:

• Enquiry-form submissions and prospect correspondence: 24 months from our last contact with you.
• Client contact details, engagement records and account documentation: the duration of the engagement plus 90 days.
• Google Ads account data retrieved through the API, and the reports built from it: the duration of the engagement plus 90 days.
• OAuth refresh tokens and associated credentials after access is revoked or the engagement ends: 7 days.
• Web server logs, including IP addresses and user agent strings: 90 days.
• Invoices, accounting records and the personal information they contain: 5 years, as required by South African tax law.

When a retention period expires the record is deleted or de-identified, in a way that prevents it from being linked back to you. Where a record must be kept because a law requires it, or because it is relevant to a legal claim that has already arisen, we retain only that record and only for as long as the obligation lasts.

14. Deletion and how to request it

You may ask us to delete the personal information we hold about you by writing to info@bigskyfinancials.trade with the subject line “Deletion request”. We acknowledge within one business day and complete the deletion within 30 days of verifying the request, or explain in writing why we cannot.

What we delete on request:

• Enquiry-form submissions and the correspondence arising from them.
• Marketing contact details and any record of consent to receive marketing, other than the record needed to keep you suppressed from future messages.
• Google Ads account data and reports retrieved under an engagement, once the engagement has ended.
• OAuth refresh tokens and stored credentials, which we destroy within 7 days of the request.

What we must retain, and why:

• Invoices and accounting records — 5 years, as required by South African tax law. We cannot delete these on request.
• Records relevant to a legal claim that has been made or is reasonably anticipated, for as long as it remains live.
• A minimal suppression record — typically an email address — kept solely so that we do not contact you again after you have asked us not to.
• Security logs, for the period in section 13, where they are needed to investigate an incident already under investigation.

Data held inside a client's own Google Ads account belongs to that client. If you are an individual asking about data in an advertiser's account, we will pass the request to the responsible party; we cannot delete their records on our own initiative.

15. Revoking our access to your Google Ads account

A client may withdraw our access at any time, without notice to us and without giving a reason. There are two independent routes, and either is sufficient:

• Remove our application from your Google Account. Go to https://myaccount.google.com/permissions, find our application in the list of third-party apps with account access, and remove its access. Google invalidates the OAuth credential immediately when you do this.
• Remove our manager account in Google Ads. In your Google Ads account, go to Admin > Access and security, find our manager account under the manager account links, and remove it.

Credentials and account data are on two different clocks, and it is worth being precise about which is which. On revocation we destroy the associated OAuth refresh tokens and stored credentials within 7 days. The Google Ads account data and the reports built from it are not on that clock: they are deleted or anonymised on the retention timetable in section 13 for client Google Ads data — the duration of the engagement plus 90 days — or sooner if you ask us in writing. Reports already delivered to the client remain with the client. You may also tell us in writing at info@bigskyfinancials.trade that you have revoked access, and we will confirm the destruction once it is complete.

16. Cross-border transfers of personal information

Personal information we process is transferred outside the Republic of South Africa. Section 72 of POPIA permits this only on defined grounds, and we rely on the following:

• Google LLC (United States) and Google Ireland Limited (Ireland) — data is transferred to Google in order to operate the client's advertising account through the Google Ads platform and the Google Ads API.
• Our website hosting provider — this website and its server logs are hosted outside South Africa.
• Our email provider — correspondence with us is transmitted and stored outside South Africa.

We transfer personal information outside South Africa only where the recipient is bound by an agreement that affords an adequate level of protection, upholds principles for the lawful processing of personal information substantially similar to the conditions in POPIA, and includes provisions substantially similar to section 72 relating to the onward transfer of personal information to third parties in a foreign country — the ground in section 72(1)(a) — or where another ground in section 72(1) applies. The transfers described above are also necessary for the performance of a contract between the data subject and Big Sky Investments, or for the implementation of pre-contractual measures taken in response to the data subject's request, which is the ground in section 72(1)(c).

Where a client is itself subject to the law of another jurisdiction — for example a client advertising into the European Union, whose obligations arise under the General Data Protection Regulation — we record the additional transfer terms that client requires in the services agreement between us. Nothing in this policy limits those terms.

17. Your rights as a data subject

Section 5 of POPIA gives every data subject the following rights in relation to the personal information we hold. You exercise any of them by writing to info@bigskyfinancials.trade. Exercising a right costs you nothing, except for the prescribed fee that may apply to a formal request for access to a record.

• To be notified that personal information about you is being collected, in the terms of section 18 — which is the purpose of sections 4 and 5 of this policy — and to be notified where your personal information has been accessed or acquired by an unauthorised person, in the terms of section 22.
• To establish whether we hold personal information about you, and to request access to it, under section 23. We will tell you, free of charge, whether we hold it, and provide the record itself on payment of the prescribed fee where one applies. The procedure is in our PAIA manual.
• To request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and to request destruction of a record we are no longer authorised to retain, under section 24.
• To object to the processing, on reasonable grounds relating to your particular situation, under section 11(3), except where legislation provides for the processing. Where you object we must stop, unless a listed exception applies.
• To object to processing for purposes of direct marketing by unsolicited electronic communications, under section 69. Section 18 of this policy explains how.
• Not to be subject to a decision based solely on the automated processing of your personal information intended to profile you, where that decision results in legal consequences for you or affects you to a substantial degree, under section 71. In the advertising context this matters because the platforms we operate on use automated and algorithmic bidding — Google's Smart Bidding and similar systems — which decide in real time whether an advertisement is entered into an auction and at what bid. Those decisions are made by the platform, they determine only whether an advertisement is shown, and they produce no legal consequence for any individual. Big Sky Investments does not make decisions about individuals by solely automated means that have legal consequences or a substantially similar effect, and does not use profiling to decide anyone's access to a service, credit, employment or any other entitlement. If you believe an automated decision has affected you, write to us and a person will review it.
• To submit a complaint to the Information Regulator regarding an alleged interference with the protection of your personal information, under section 74. The details are in section 19 below.
• To institute civil proceedings regarding an alleged interference with the protection of your personal information, under section 99.

Where consent is the basis on which we process, you may withdraw that consent at any time under section 11(2)(b). Withdrawal does not affect the lawfulness of processing carried out before you withdrew it. We may ask you for proof of identity before acting on a request, so that we do not disclose or delete one person's information at another person's instruction.

18. Direct marketing

Section 69 of POPIA prohibits direct marketing by unsolicited electronic communication — including email, SMS and automatic calling machines — unless one of two grounds applies.

• Consent. If you are not an existing customer, we may approach you once, and only once, to ask for your consent to receive direct marketing. That request is made using a form substantially similar to Form 4 of the POPIA Regulations. If you do not respond, or you decline, we do not ask again and we do not send marketing.
• The existing-customer exception in section 69(3). Where we obtained your contact details in the context of a sale of a service to you, we may market our own similar services to you, provided you were given a reasonable opportunity to object both when the details were collected and in every message we send.

Every marketing message we send identifies Big Sky Investments as the sender, gives an address to which you can send an objection, and carries an unsubscribe mechanism that works without charge to you. You may also opt out at any time by writing to info@bigskyfinancials.trade; we action opt-outs within one business day. Replying to an enquiry you sent us is not direct marketing, and we will always answer you.

19. Complaints — Information Regulator (South Africa)

If you are not satisfied with how we have handled your personal information or your request, please raise it with the Information Officer first at info@bigskyfinancials.trade, so that we have the opportunity to put it right. You are, however, entitled to complain directly to the Regulator at any time.

A complaint about an alleged interference with the protection of personal information is lodged on Form 5 of the POPIA Regulations, sent to the POPIA complaints address above. Note that the general enquiries address ends in .org.za while the POPIA complaints address ends in .co.za; both are correct as published by the Regulator, and the difference is deliberate.

The Regulator will not accept a complaint lodged more than three years after the incident that gave rise to it, so do not delay in bringing a matter forward.

20. Security compromises

Section 22 of POPIA requires that, where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we notify both the Information Regulator and the affected data subjects.

• When. As soon as reasonably possible after discovering the compromise. We may delay notifying data subjects only if the South African Police Service, the Hawks or the Regulator tells us that notification would impede a criminal investigation, and only for as long as that applies.
• How. In writing, by one of the methods permitted in section 22(4): by post to your last known address, by email, by publication on this website, by publication in the news media, or as directed by the Regulator.
• What the notice contains. Sufficient information to allow you to take protective measures — a description of the possible consequences, the measures we intend to take or have taken, our recommendation on what you should do, and, if we know it, the identity of the unauthorised person.
• Client accounts. Where a compromise affects data we process as an operator, we notify the client as responsible party immediately, so that the client can meet its own section 22 obligations, and we assist with that notification.

21. Cookies and analytics

This site sets no cookies at all. It stores a single consent choice in your browser's local storage, under the key bsi_cookie_consent, and it loads no analytics, no tag manager and no advertising tags.

• Consent choice. When you choose “Accept all” or “Reject non-essential” on the notice at the foot of the page, that one value is written to your own browser's local storage under the key bsi_cookie_consent. It records only the choice itself, it is not sent to us, and it is not an identifier. It stays until you clear your browser storage.
• Server logs. Not cookies and not browser storage, but recorded regardless, by our website hosting provider on our behalf, for the purposes and period in sections 4, 5 and 13.

We currently set no analytics or advertising cookies. If that changes, they will be set only after you accept them, and this section will be updated first.

How to refuse or change your mind. Choose “Reject non-essential” on the notice. To change a previous choice, clear the site data for bigskyfinancials.trade in your browser settings — which removes the stored value — and the notice will appear again. You can also block or delete storage for this site entirely in your browser, and use your browser's private browsing mode; we do not attempt to circumvent those settings, and we do not use device fingerprinting to re-identify visitors who have refused.

Advertising accounts we manage for clients use conversion tracking on the client's own website. That tracking is governed by the client's privacy notice, on the client's own domain, and is not set by this site.

22. Client data — our role and your contract

For all personal information inside a client's advertising, analytics and CRM accounts, Big Sky Investments acts as an operator in terms of sections 20 and 21 of POPIA. That means:

• We process that information only with the knowledge and authorisation of the client, on the client's documented instructions, and never for our own purposes.
• We treat it as confidential and do not disclose it, unless a law requires the disclosure or the performance of the client's own duties makes it necessary.
• We apply the security measures described in section 8, and we notify the client immediately where there are reasonable grounds to believe the information has been accessed by an unauthorised person.
• We return or delete the information at the end of the engagement, on the timetable in section 13, unless the client instructs otherwise in writing.

These obligations are recorded in a written services agreement with each client containing data-protection terms, as section 20 of POPIA requires. The agreement identifies the purposes for which we may process, the categories of information involved, the client's instructions, and what happens at termination. Our standard terms are on the Terms of Service page; the data-protection terms specific to an engagement are agreed in that engagement's contract. Where a client's own obligations extend beyond South African law, those additional terms are recorded in the same agreement.

23. Changes to this policy

This policy was last updated on 10 August 2026. We review it when our processing changes, when the platforms we work with change their requirements, and at least annually. The current version always appears at https://bigskyfinancials.trade/privacy-policy, and the date above tells you which version you are reading. Material changes are notified to clients directly under the services agreement.

24. Contact for privacy requests

Requests for access, correction or deletion, objections to processing, questions about this policy, and PAIA requests all go to the same place:

• Email: info@bigskyfinancials.trade
• Attention: The Information Officer
• Postal and physical address: 121 Beyers Naudé Drive, Roosevelt Park, Johannesburg, 2195, South Africa
• Business hours: Monday to Friday, 08:00–17:00 SAST
• Response time: we acknowledge within one business day and complete requests within the period prescribed by the applicable Act.

Related pages: PAIA manual for formal access requests, Google Ads API for how our software uses API access, Third-party advertising policy for how we operate client accounts, Company & legal information for our published identifiers, and Contact for general enquiries.