Gatcha Kingdom · Privacy Policy

1. Introduction

Gatcha Kingdom (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African laws.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Platform.

2. Information We Collect

2.1 Information you provide directly

• (a) Identity information: name, surname, date of birth;
• (b) Contact information: email address, phone number, physical address;
• (c) Account information: username, password (encrypted), profile details;
• (d) Payment information: we do NOT store your banking credentials or card details. Payment data is handled by PayFast, our payment processor. We only store transaction references and top-up history;
• (e) Shipping information: delivery addresses;
• (f) Communications: emails, support tickets, or messages you send us.

2.2 Information collected automatically

• (a) Device information: IP address, browser type, operating system, device type;
• (b) Usage data: pages visited, time spent, clicks, capsule history, collection data;
• (c) Location data: approximate geographic location derived from your IP address (for fraud prevention and regional pricing);
• (d) Cookies and similar technologies (see our Cookie Policy).

2.3 Information from third parties

• (a) PayFast: transaction confirmation, payment status, fraud indicators;
• (b) Clerk (our authentication provider): authentication tokens and identity verification data;
• (c) Convex (our database provider): hosting and processing of your data.

2.4 What you must give us, and what happens if you do not

Some information is mandatory because we cannot run the Platform without it, and some is voluntary and only helps us serve you better.

• (a) Mandatory: your name, email address, and date of birth if you create an account. Without them we cannot create your account, verify that you are 18 or older, or let you sign in. If you do not provide them, you cannot buy store credit or open a capsule.
• (b) Mandatory: a delivery address and phone number when you ask us to ship figures. Without them we cannot deliver your parcel or contact the courier.
• (c) Voluntary: your phone number on your profile, your profile photo, and any message you choose to send us in a support ticket. If you leave these out, your account still works and nothing else is affected.
• (d) Optional: analytics cookies. If you do not accept them, the site works the same way and we simply cannot see how people use it.

We do not collect special categories of personal information. That means we do not ask for, and do not hold, information about your health, biometrics, religion, politics, sex life, trade union membership, or criminal record.

3. How We Use Your Information

We process your personal information for the following lawful purposes:

1. To provide and maintain the Platform (contractual necessity);
2. To process your payments and top-ups via PayFast (contractual necessity);
3. To fulfil orders and ship Products to you (contractual necessity);
4. To manage your account, Credit balance, and collection (contractual necessity);
5. To communicate with you about orders, shipping, and account updates (legitimate interest);
6. To detect, prevent, and investigate fraud, abuse, or security incidents (legitimate interest / legal obligation);
7. To comply with legal and regulatory obligations, including tax, financial reporting, and law enforcement requests (legal obligation);
8. To improve the Platform and develop new features (legitimate interest);
9. To send you marketing communications about new Cabinets, Products, or promotions, where you have consented (consent).

4. Legal Basis for Processing (POPIA)

Under POPIA, we rely on the following legal bases:

1. Consent: For marketing communications and non-essential cookies.
2. Contractual necessity: For account creation, payment processing, order fulfilment, and Platform functionality.
3. Legal obligation: For tax records, fraud prevention, and regulatory compliance.
4. Legitimate interest: For security, analytics, and service improvement, balanced against your privacy rights.

5. How We Share Your Information

1. We do NOT sell your personal information to third parties.
2. We share your information with:

• (a) PayFast: for payment processing. PayFast acts as an operator under POPIA. Their privacy policy is available at https://www.payfast.co.za/privacy-policy;
• (b) Clerk Inc: for authentication services;
• (c) Convex (Convex.dev): for database hosting and processing;
• (d) Vercel Inc: for website hosting;
• (e) AgentMail Inc: for transactional email delivery. We use it to send you your wallet receipt, your shipping and tracking notices, your support replies, and notices about your orders. It receives your email address and the contents of those messages, and nothing else;
• (f) PostHog Inc: for privacy-friendly product analytics. It receives your IP address, the pages you visit, and the actions you take on the site, so we can see where people get stuck. Analytics cookies only run if you accept them, and the data is stored in the European Union. Their privacy policy is available at https://posthog.com/privacy;
• (g) Shipping and logistics providers: to deliver your Products;
• (h) Legal and regulatory authorities: when required by law;
• (i) Professional advisors: auditors, lawyers, and insurers.

3. All third-party service providers are bound by confidentiality and data protection obligations.

6. Data Security

1. We implement appropriate technical and organisational measures to protect your personal information, including:

• (a) Encryption of data in transit (TLS/SSL) and at rest;
• (b) Secure authentication via Clerk;
• (c) Role-based access controls for staff;
• (d) Regular security assessments.

2. While we take reasonable precautions, no internet transmission is completely secure. You use the Platform at your own risk.
3. If your information is compromised, we tell you. If we become aware that your personal information has been accessed or acquired by someone who is not allowed to have it, we will notify the Information Regulator and, where we are able to identify you, we will notify you in writing as soon as reasonably possible after we discover it. That notice will tell you what happened, what we are doing about it, and what we recommend you do.
4. Reporting a security problem. If you think you have found a security weakness on our site, please email gachakingdomsupport@gmail.com with the word “security” in the subject line, and describe what you found. Please do not try to access other people’s accounts or data while you are testing.

7. Data Retention

1. We retain your personal information for as long as necessary to:

• (a) Fulfil the purposes for which it was collected;
• (b) Comply with legal obligations (e.g., tax records for 5 years);
• (c) Resolve disputes and enforce our agreements.

2. Transaction records are retained for a minimum of 5 (five) years in accordance with South African financial regulations and PayFast’s merchant requirements.
3. When no longer needed, your personal information is securely deleted or anonymised.

8. Your Rights Under POPIA

You have the following rights regarding your personal information:

1. Right of access: Request a copy of the personal information we hold about you.
2. Right to correction: Request that we correct inaccurate or incomplete information.
3. Right to deletion: Request deletion of your personal information, subject to legal retention requirements.
4. Right to object: Object to processing based on legitimate interests or for direct marketing. If you object, we stop the processing you objected to, unless the law says we must continue.
5. Right to restrict processing: Request limitation on how we use your data in certain circumstances.
6. Right to withdraw consent: Withdraw consent for marketing or non-essential cookies at any time.
7. Right to complain: Lodge a complaint with the Information Regulator. Their contact details are in section 14.

To exercise these rights, contact our Information Officer using the details in section 14, or use the forms on our POPIA rights request page. We will respond to you in writing within 30 days of receiving your request.

9. Cross-Border Transfers

1. Some of our service providers store or process your information outside South Africa. Our production database runs on Convex infrastructure in the European Union (Ireland), and our website is hosted by Vercel. Clerk, AgentMail, and PostHog may also process your information outside South Africa.
2. We ensure that such transfers are protected by appropriate safeguards, including standard contractual clauses and data processing agreements with each provider.
3. PostHog analytics data is stored in the European Union. Payment processing by PayFast is handled in South Africa.

10. Cookies and Tracking

See our Cookie Policy for detailed information.

11. Children’s Privacy

1. The Platform is for adults only. You must be 18 years or older to create an account, buy store credit, or open a capsule. We do not knowingly collect personal information from anyone under 18, and we close an account that turns out to belong to a minor and refund their unused purchased store credit.
2. If you are a parent or guardian and believe your child has provided us with personal information without your consent, contact us immediately and we will delete such information.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Platform. The effective date at the top indicates when the current version became active.

13. Alternative Formats and Accessibility

This policy is published as plain web text and is compatible with screen readers. If you need this policy in another format, such as a plain text file, a large-print copy, or an accessible PDF, contact us using the details in section 14 and we will provide it. See also our Accessibility Statement.

14. Contact Us

For privacy-related inquiries, contact our Information Officer:

You also have the right to lodge a complaint with the South African Information Regulator: https://inforegulator.org.za/.

For information about how we handle refunds, returns, and wallet balance refunds, please see our Refund & Returns Policy.

This document was prepared with reference to POPIA and is a good-faith summary of how we handle your information. It is not legal advice and it does not replace advice from a qualified South African attorney.