1. Who Is Responsible for Your Information

PCI Property Find 1 (Pty) Ltd, trading as RibShack@The Lucky Local, registration number 2008/029176/07, of 225 Dykor Street, Silverton, Pretoria, is the responsible party for the personal information processed through this App, as contemplated in the Protection of Personal Information Act 4 of 2013 ("POPIA").

Our Information Officer is [TO CONFIRM: name], contactable at the email address and telephone number in section 11 below.

This Policy forms part of our Terms and Conditions.

2. What We Collect

When you register and use the App, we collect:

• Identity and contact details — your name and cell phone number, and your email address where provided.
• Delivery address — where you ask us to deliver, together with the distance from our premises, which is what your delivery charge is calculated from.
• Order history — what you ordered, when, the amount paid, and how you paid.
• Rewards information — your invitation link, who introduced you, who you introduced, and your store credit balance and its history.
• Account status — including whether an account has been blocked, and any notes we make about failed deliveries or disputes.

We do not store your full card details. Card payments are handled entirely by our appointed payment service provider [TO CONFIRM: name], who processes them under their own security standards. We receive only confirmation that a payment succeeded or failed.

3. Why We Use It

• To create and manage your account.
• To take, prepare, and deliver your orders, and to contact you about them.
• To calculate delivery charges from your address.
• To operate the rewards programme, including calculating and reversing rewards.
• To keep proper accounting and tax records, as we are required to do by law.
• To detect and prevent fraud and abuse of the rewards programme, including identifying duplicate accounts.

We process your information because it is necessary to perform our contract with you, because we have a legal obligation to keep records, and because we have a legitimate interest in preventing fraud. Where we rely on your consent — for example to send you marketing messages — you may withdraw it at any time.

4. Who We Share It With

We share your information only as far as is necessary, with:

• Our delivery agents — your name, delivery address, and cell phone number, so that they can find you and contact you if needed.
• Our payment service provider — to process your payment and any refund.
• Our software and hosting providers — who host the App and its database on our behalf.
• Our accountants and auditors, and SARS or other authorities where the law requires it.

We do not sell your personal information, and we do not share it with anyone for their own marketing purposes.

Rewards and what other customers see. If you were introduced by another customer, that person can see your name in their reward history, so that they can see which introductions earned rewards. Nothing else about you is shown to them — not your contact details, address, or what you ordered. Where a reward arises from a second-level introduction, you are not identified at all.

5. Where Your Information Is Held

The App and its database are hosted by our software provider [TO CONFIRM: hosting provider and country]. Where personal information is transferred outside South Africa, we take reasonable steps to satisfy ourselves that it is protected by laws or contractual terms that provide a comparable level of protection, as POPIA requires.

6. How Long We Keep It

We keep transaction and accounting records for the period required by South African tax and company law, which is currently five years from the end of the relevant tax year.

Account and contact details are kept while your account is active, and for [TO CONFIRM: retention period] after it is closed, after which they are deleted or anonymised, except where we must keep them longer for the accounting records above or to defend a legal claim.

7. How We Protect It

Access to customer information is limited to staff who need it to do their work, and our staff consoles are protected by individual credentials with different levels of access. We take reasonable technical and organisational measures to protect your information against loss, unauthorised access, and misuse. No system can be guaranteed completely secure, but if a breach occurs that puts your information at risk, we will notify you and the Information Regulator as POPIA requires.

8. Your Rights

Under POPIA you have the right to:

• ask what personal information we hold about you, and get a copy of it;
• ask us to correct information that is wrong or incomplete;
• ask us to delete information we no longer have a lawful reason to keep;
• object to us processing your information in certain circumstances;
• withdraw consent to marketing at any time;
• complain to the Information Regulator.

To exercise any of these, contact us using the details below. We may ask you to verify your identity first.

Please note: if you ask us to delete your account, any remaining store credit is forfeited immediately and permanently, as set out in clause 6.4 of our Terms and Conditions. We will also still need to retain the underlying transaction records for the legal periods described in section 6 above.

9. Marketing

We may send you messages about your orders at any time, as these are necessary to fulfil your order. We will only send you marketing messages where you have agreed to receive them, or where the law otherwise permits it, and every such message will offer you a way to opt out.

10. Children

The App is not intended for use by children under 18 without the consent of a parent or guardian, and we do not knowingly collect the personal information of a child without that consent.

11. Contact Us

Information Officer: [TO CONFIRM: name]
Email: ribshacksilvertom@gmail.com
Phone: 079 659 6524
Address: 225 Dykor Street, Silverton, Pretoria

You may also complain directly to the Information Regulator (South Africa) at enquiries@inforegulator.org.za.

12. Changes to This Policy

We may update this Policy from time to time. The date at the top shows when it was last changed, and continued use of the App after a change constitutes acceptance of the updated Policy.