# Gumba Privacy Policy

**Effective Date:** 1 March 2025  
**Last Updated:** 28 February 2026

## 1. Introduction

Gumba ("we", "us", or "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

This policy is designed to comply with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

## 2. Information We Collect

### 2.1 Personal Information
We collect the following personal information:

**For Customers:**
- Full name
- Email address
- Phone number
- Physical address
- Payment information (processed securely via PayFast)
- Event details and booking history

**For Vendors:**
- Business name and registration details
- Owner/representative name
- Email address and phone number
- Business address
- Banking details for payouts
- Equipment inventory information
- Profile images and business logos

### 2.2 Automatically Collected Information
- IP address
- Browser type and version
- Device information
- Pages visited and time spent
- Referring website
- Location data (with consent)

### 2.3 Cookies and Tracking
We use cookies and similar technologies to:
- Maintain your session
- Remember your preferences
- Analyze platform usage
- Improve user experience

## 3. How We Use Your Information

We use your personal information to:

- **Provide Services:** Process bookings, facilitate payments, and connect customers with vendors
- **Communication:** Send booking confirmations, updates, and notifications
- **Account Management:** Create and manage your account
- **Customer Support:** Respond to inquiries and resolve disputes
- **Platform Improvement:** Analyze usage patterns and improve our services
- **Legal Compliance:** Comply with applicable laws and regulations
- **Marketing:** Send promotional communications (with your consent)

## 4. Legal Basis for Processing

Under POPIA, we process your information based on:
- **Consent:** You have given consent for specific purposes
- **Contract:** Processing is necessary for our service agreement
- **Legal Obligation:** We must comply with South African law
- **Legitimate Interest:** For fraud prevention and platform security

## 5. Information Sharing

We may share your information with:

### 5.1 Service Providers
- Payment processors (PayFast)
- Email service providers
- Cloud hosting providers
- Analytics services

### 5.2 Other Users
- Customers can view vendor business profiles
- Vendors receive customer contact details for confirmed bookings

### 5.3 Legal Requirements
We may disclose information when required by:
- Court orders or legal processes
- Government authorities
- Law enforcement agencies

### 5.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity.

## 6. Data Security

We implement appropriate security measures including:
- SSL/TLS encryption for data transmission
- Secure password hashing
- Access controls and authentication
- Regular security assessments
- Secure payment processing via PCI-compliant providers

## 7. Data Retention

We retain your information for:
- **Active Accounts:** Duration of account activity plus 5 years
- **Transaction Records:** 7 years (as required by South African tax law)
- **Marketing Data:** Until consent is withdrawn
- **Deleted Accounts:** Anonymized data may be retained for analytics

## 8. Your Rights Under POPIA

You have the right to:
- **Access:** Request a copy of your personal information
- **Correction:** Request correction of inaccurate information
- **Deletion:** Request deletion of your information (subject to legal requirements)
- **Object:** Object to processing for direct marketing
- **Restriction:** Request restriction of processing
- **Portability:** Receive your data in a portable format
- **Withdraw Consent:** Withdraw consent at any time

To exercise these rights, contact our Information Officer at privacy@gumba.app

## 9. Children's Privacy

Our Platform is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If we discover such information has been collected, we will delete it promptly.

## 10. International Transfers

Your information is primarily stored and processed in South Africa. If data is transferred internationally, we ensure appropriate safeguards are in place as required by POPIA.

## 11. Third-Party Links

Our Platform may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. Please review their privacy policies before providing any information.

## 12. Updates to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or Platform notification. The "Last Updated" date indicates the most recent revision.

## 13. Contact Us

For privacy-related inquiries or to exercise your rights:

**Information Officer**  
Gumba (Pty) Ltd  
Email: privacy@gumba.app  
Phone: +27 65 910 4992  
Address: South Africa

**Information Regulator (South Africa)**  
Website: www.justice.gov.za/inforeg  
Email: inforeg@justice.gov.za

---

*By using Gumba, you acknowledge that you have read and understood this Privacy Policy.*