Privacy Notice

Last updated: [DATE]

Note to Lindsey: Fill in every [PLACEHOLDER], including the payment processor name once Yoco/PayFast is finalised. If you (or the client) don't yet have a designated Information Officer registered with the Information Regulator, that's a POPIA requirement worth sorting out separately from this page. Also worth confirming with your accountant: financial/transaction records may carry a different statutory retention period (commonly 5 years under tax law) than the 3-year CPA competition-record minimum used below — Section 5 currently only reflects the latter.

This notice explains how [COMPANY / TRADING NAME] ("we", "us") collects and uses personal information when you enter this competition, in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA).

1. Who We Are

Responsible Party: [COMPANY NAME]
Address: [PHYSICAL ADDRESS]
Information Officer: [NAME], [EMAIL]

2. What We Collect

Data	Required?	Why we collect it
First name & surname	Required	To identify your entry, issue your ticket(s), and contact you if you win
Mobile number	Optional	To contact winners and to detect duplicate entries
Gender	Required	Campaign reporting and analytics
Approximate location / suburb	Optional	Campaign reporting and analytics; derived from device GPS coordinates via a reverse-geocoding lookup, not stored as raw address
Number of entries purchased and amount paid	Required to enter	To calculate your order, issue the correct number of tickets, and maintain financial records
Skill-testing puzzle result (time taken, attempts)	Required to enter	To keep evidence that entry required a genuine skill element, as required for this to be run lawfully as a promotional competition rather than a lottery

We do not collect or store your card number, bank account details, or other payment credentials. These are entered directly with our payment processor (see Section 4) and are never transmitted to or held by us.

3. Why We Process It

To administer entries, process payment, and run the prize draw, as required to fulfil the competition rules you agreed to;
To contact winners and arrange prize collection;
To meet our record-keeping obligations under the Consumer Protection Act and its Regulations, which require competition records to be kept for a minimum of 3 years, and any separate statutory retention period that applies to financial/transaction records; and
To produce anonymised or aggregated reporting on entries (e.g. entries per suburb), which does not identify you individually.

4. Who We Share It With

Your information is stored in Google Sheets and processed via Google Apps Script, acting as our data processor. Payment is processed by [PAYMENT PROCESSOR NAME, e.g. Yoco/PayFast], which receives your card or bank details directly and shares with us only confirmation that payment succeeded and a payment reference — never your card number or bank account details. If you share your location, the coordinates are sent to OpenStreetMap's Nominatim service solely to look up your suburb name — no name, surname, or mobile number is sent as part of that lookup. We do not sell your information or share it with any other third party.

5. How Long We Keep It

We retain competition entry records for a minimum of 3 years after the competition ends, in line with the record-keeping requirements of the Consumer Protection Act Regulations. Financial and transaction records may be retained for longer where required by tax or accounting law ([CONFIRM PERIOD WITH YOUR ACCOUNTANT]). After the applicable period, records are securely deleted.

6. Your Rights

Under POPIA, you have the right to:

Request confirmation of what personal information we hold about you;
Request correction or deletion of inaccurate or outdated information;
Object to further processing of your information, subject to our record-keeping obligations above; and
Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za if you believe your rights have been infringed.

To exercise any of these rights, contact us at [CONTACT EMAIL].

7. Security

Staff access to entry and order data (for prize redemption, winner selection, and payment reconciliation) is restricted behind PIN-protected tools. Raw entry and order data is not publicly accessible. Payment card and bank details are never handled by our own systems — these are entered and secured directly by our payment processor.