Gatcha Kingdom logoGatcha Kingdom
Sign in
← Back to Gatcha Kingdom

Legal

Gatcha Kingdom · Privacy Policy

Effective Date: 21 August 2026 · Version 1.0.0

1. Introduction

Gatcha Kingdom (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African laws.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Platform.

2. Information We Collect

2.1 Information you provide directly

  • (a) Identity information: name, surname, date of birth;
  • (b) Contact information: email address, phone number, physical address;
  • (c) Account information: username, password (encrypted), profile details;
  • (d) Payment information: we do NOT store your banking credentials or card details. Payment data is handled by PayFast, our payment processor. We only store transaction references and top-up history;
  • (e) Shipping information: delivery addresses;
  • (f) Communications: emails, support tickets, or messages you send us.

2.2 Information collected automatically

  • (a) Device information: IP address, browser type, operating system, device type;
  • (b) Usage data: pages visited, time spent, clicks, capsule history, collection data;
  • (c) Location data: approximate geographic location derived from your IP address (for fraud prevention and regional pricing);
  • (d) Cookies and similar technologies (see our Cookie Policy).

2.3 Information from third parties

  • (a) PayFast: transaction confirmation, payment status, fraud indicators;
  • (b) Clerk (our authentication provider): authentication tokens and identity verification data;
  • (c) Convex (our database provider): hosting and processing of your data.

3. How We Use Your Information

We process your personal information for the following lawful purposes:

  1. To provide and maintain the Platform (contractual necessity);
  2. To process your payments and top-ups via PayFast (contractual necessity);
  3. To fulfil orders and ship Products to you (contractual necessity);
  4. To manage your account, Credit balance, and collection (contractual necessity);
  5. To communicate with you about orders, shipping, and account updates (legitimate interest);
  6. To detect, prevent, and investigate fraud, abuse, or security incidents (legitimate interest / legal obligation);
  7. To comply with legal and regulatory obligations, including tax, financial reporting, and law enforcement requests (legal obligation);
  8. To improve the Platform and develop new features (legitimate interest);
  9. To send you marketing communications about new Cabinets, Products, or promotions, where you have consented (consent).

4. Legal Basis for Processing (POPIA)

Under POPIA, we rely on the following legal bases:

  1. Consent: For marketing communications and non-essential cookies.
  2. Contractual necessity: For account creation, payment processing, order fulfilment, and Platform functionality.
  3. Legal obligation: For tax records, fraud prevention, and regulatory compliance.
  4. Legitimate interest: For security, analytics, and service improvement, balanced against your privacy rights.

5. How We Share Your Information

  1. We do NOT sell your personal information to third parties.
  2. We share your information with:
  • (a) PayFast: for payment processing. PayFast acts as an operator under POPIA. Their privacy policy is available at https://www.payfast.co.za/privacy-policy;
  • (b) Clerk Inc: for authentication services;
  • (c) Convex (Convex.dev): for database hosting and processing;
  • (d) Vercel Inc: for website hosting;
  • (e) Shipping and logistics providers: to deliver your Products;
  • (f) Legal and regulatory authorities: when required by law;
  • (g) Professional advisors: auditors, lawyers, and insurers.
  1. All third-party service providers are bound by confidentiality and data protection obligations.

6. Data Security

  1. We implement appropriate technical and organisational measures to protect your personal information, including:
  • (a) Encryption of data in transit (TLS/SSL) and at rest;
  • (b) Secure authentication via Clerk;
  • (c) Role-based access controls for staff;
  • (d) Regular security assessments.
  1. While we take reasonable precautions, no internet transmission is completely secure. You use the Platform at your own risk.

7. Data Retention

  1. We retain your personal information for as long as necessary to:
  • (a) Fulfil the purposes for which it was collected;
  • (b) Comply with legal obligations (e.g., tax records for 5 years);
  • (c) Resolve disputes and enforce our agreements.
  1. Transaction records are retained for a minimum of 5 (five) years in accordance with South African financial regulations and PayFast’s merchant requirements.
  2. When no longer needed, your personal information is securely deleted or anonymised.

8. Your Rights Under POPIA

You have the following rights regarding your personal information:

  1. Right of access: Request a copy of the personal information we hold about you.
  2. Right to correction: Request that we correct inaccurate or incomplete information.
  3. Right to deletion: Request deletion of your personal information, subject to legal retention requirements.
  4. Right to object: Object to processing based on legitimate interests or for direct marketing.
  5. Right to restrict processing: Request limitation on how we use your data in certain circumstances.
  6. Right to data portability: Request your data in a structured, machine-readable format.
  7. Right to withdraw consent: Withdraw consent for marketing or non-essential cookies at any time.

To exercise these rights, contact us at gachakingdomsupport@gmail.com. We will respond within 30 days.

9. Cross-Border Transfers

  1. Your data is primarily stored and processed in South Africa via Convex and Vercel infrastructure.
  2. Some of our service providers (Clerk, Vercel, Convex) may process data in jurisdictions outside South Africa. We ensure that such transfers are protected by appropriate safeguards, including standard contractual clauses and data processing agreements.

10. Cookies and Tracking

See our Cookie Policy for detailed information.

11. Children’s Privacy

  1. The Platform is not intended for children under 13. We do not knowingly collect personal information from children under 13.
  2. If you are a parent or guardian and believe your child has provided us with personal information without your consent, contact us immediately and we will delete such information.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Platform. The effective date at the top indicates when the current version became active.

13. Contact Us

For privacy-related inquiries, contact our Information Officer:
Email: gachakingdomsupport@gmail.com
Address: 7 9th Street, Melville, Johannesburg

You also have the right to lodge a complaint with the South African Information Regulator: https://inforegulator.org.za/.

For information about how we handle refunds, returns, and wallet balance refunds, please see our Refund & Returns Policy.

This is a legal template and must be reviewed by a qualified South African attorney before going live.