# Gumba POPIA Compliance Policy

## Protection of Personal Information Act (POPIA) Compliance Statement

**Effective Date:** 1 March 2025  
**Last Updated:** 28 February 2026

## 1. Introduction

Gumba (Pty) Ltd ("Gumba", "we", "us") is committed to complying with the Protection of Personal Information Act 4 of 2013 ("POPIA") and all related regulations. This policy outlines our commitment to protecting the personal information of all data subjects who interact with our platform.

## 2. Responsible Party Details

**Responsible Party:** Gumba (Pty) Ltd  
**Information Officer:** Gumba Legal Department  
**Email:** popia@gumba.app  
**Phone:** +27 65 910 4992  
**Address:** South Africa

## 3. Purpose of Processing Personal Information

Gumba processes personal information for the following purposes:

| Purpose | Categories of Data | Legal Basis |
|---------|-------------------|-------------|
| User registration and authentication | Name, email, phone, password | Contract performance |
| Booking facilitation | Contact details, event information | Contract performance |
| Payment processing | Banking details, transaction history | Contract performance |
| Vendor verification | Business registration, ID documents | Legal obligation |
| Customer support | Communication records | Legitimate interest |
| Marketing communications | Email, preferences | Consent |
| Platform improvement | Usage analytics | Legitimate interest |
| Legal compliance | As required by law | Legal obligation |

## 4. Conditions for Lawful Processing

Gumba adheres to the eight conditions for lawful processing under POPIA:

### 4.1 Accountability
We take responsibility for complying with all POPIA requirements and have appointed an Information Officer to oversee compliance.

### 4.2 Processing Limitation
We only collect personal information that is necessary for our stated purposes and through lawful means with the knowledge or consent of the data subject.

### 4.3 Purpose Specification
Personal information is collected for specific, explicitly defined, and lawful purposes related to our platform services.

### 4.4 Further Processing Limitation
We do not process personal information for purposes incompatible with the original collection purpose without additional consent.

### 4.5 Information Quality
We take reasonable steps to ensure personal information is complete, accurate, and up to date.

### 4.6 Openness
This policy and our Privacy Policy are publicly available. We notify data subjects when collecting their information.

### 4.7 Security Safeguards
We implement appropriate technical and organizational measures to protect personal information against unauthorized access, loss, or damage.

### 4.8 Data Subject Participation
Data subjects can access, correct, or request deletion of their personal information as outlined in Section 6.

## 5. Categories of Data Subjects

We process personal information of the following categories of data subjects:

- **Customers:** Individuals booking equipment through our platform
- **Vendors:** Businesses and individuals offering rental services
- **Website Visitors:** Users browsing our platform
- **Enquirers:** Individuals contacting us for information
- **Employees and Contractors:** Our staff members (governed by separate HR policies)

## 6. Data Subject Rights

Under POPIA, you have the following rights:

### 6.1 Right to Access (Section 23)
You may request confirmation of whether we hold your personal information and access to such information.

### 6.2 Right to Correction (Section 24)
You may request correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal information.

### 6.3 Right to Object (Section 11(3))
You may object to the processing of your personal information for direct marketing purposes.

### 6.4 Right to Deletion (Section 24)
You may request deletion of your personal information in certain circumstances.

### 6.5 Right to Complain (Section 74)
You may lodge a complaint with the Information Regulator if you believe your rights have been infringed.

### How to Exercise Your Rights
Submit requests to: popia@gumba.app

We will respond within a reasonable time, not exceeding 30 days, and may require proof of identity.

## 7. Security Measures

We implement the following security measures to protect personal information:

### Technical Measures
- SSL/TLS encryption for all data transmission
- Secure password hashing (SHA-256)
- Firewalls and intrusion detection systems
- Regular security vulnerability assessments
- Access controls and authentication protocols
- Encrypted database storage

### Organizational Measures
- Staff training on data protection
- Access limited to authorized personnel
- Confidentiality agreements with employees
- Vendor due diligence and data processing agreements
- Incident response procedures
- Regular policy reviews and updates

## 8. Data Breach Notification

In the event of a data breach that poses a risk to data subjects:

1. We will notify the Information Regulator as soon as reasonably possible
2. We will notify affected data subjects if the breach is likely to result in a risk to their rights
3. Notification will include:
   - Description of the breach
   - Categories of data affected
   - Measures taken to address the breach
   - Recommendations for data subjects
   - Contact details for further information

## 9. Cross-Border Transfers

Personal information may only be transferred outside South Africa if:
- The recipient country has adequate data protection laws
- The data subject has consented
- Transfer is necessary for contract performance
- Transfer is for the benefit of the data subject
- Appropriate safeguards are in place

## 10. Retention of Personal Information

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, unless longer retention is required by law.

| Data Category | Retention Period |
|--------------|------------------|
| Account information | Duration of account + 5 years |
| Transaction records | 7 years (SARS requirement) |
| Communication records | 3 years |
| Marketing consents | Until withdrawn |
| Cookies | As per cookie policy |

## 11. Third-Party Processors

We engage the following categories of operators (third-party processors):

- Payment service providers (PayFast)
- Cloud hosting providers
- Email service providers
- Analytics providers

All operators are bound by written agreements ensuring POPIA compliance.

## 12. Direct Marketing

We only send direct marketing communications with prior consent. You may opt out at any time by:
- Clicking "unsubscribe" in any marketing email
- Updating preferences in your account settings
- Contacting us at privacy@gumba.app

## 13. Automated Decision-Making

We do not currently use automated decision-making that produces legal effects or significantly affects data subjects.

## 14. Complaints

If you believe your personal information has been processed unlawfully:

1. **Contact us first:** popia@gumba.app
2. **Information Regulator:**
   - Website: www.justice.gov.za/inforeg
   - Email: inforeg@justice.gov.za
   - Tel: 012 406 4818
   - Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg

## 15. Policy Updates

This policy is reviewed annually and updated as necessary. Material changes will be communicated to data subjects via email or platform notification.

## 16. Acceptance

By using Gumba's services, you acknowledge that you have read, understood, and agree to the processing of your personal information in accordance with this POPIA Compliance Policy.

---

**Document Version:** 2.0  
**Approved By:** Gumba Management  
**Next Review Date:** 1 March 2027

*For any POPIA-related queries, contact our Information Officer at popia@gumba.app*