INSTORE24 Privacy Policy

In-Store Marketing Platform (Pty) Ltd (registration number 2023/727068/07), trading as “INSTORE24” (“INSTORE24”, “we”, “us” or “our”), respects your privacy. This Privacy Policy explains how we collect, use, share and protect your personal information, and your rights, in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

It applies when you visit our website, use the INSTORE24 consumer application, or otherwise interact with the INSTORE24 platform (together, the “Platform”), whether as a consumer, as a representative of a shopping centre, retailer or cinema, or as a website visitor. Please read it together with our Terms of Use, our Cookie Policy and any terms and conditions that apply to your use of the Platform.

1. WHO WE ARE AND HOW TO CONTACT US

1.1 INSTORE24 is the responsible party (as defined in POPIA) for the personal information described in this Policy.

1.2 Our details are: In-Store Marketing Platform (Pty) Ltd; registration number 2023/727068/07; The Harrington, 2nd Floor, 50 Harrington Street, District Six, Cape Town; email: info@instore24.com.

1.3 Our Information Officer may be contacted at info@instore.com.

2. THE INFORMATION WE COLLECT

2.1 We may collect and process the following categories of personal information:

2.1.1 Identity information - your name, surname and, where required, date of birth or identity or passport number;

2.1.2 Contact information - your email address, mobile number and physical or postal address;

2.1.3 Account information - your username, password and profile details;

2.1.4 Location information - your device location, where you enable location services;

2.1.5 Usage information - your searches, wish lists, QR-code scans and redemptions, visits, MallMiles activity and other interactions with the Platform;

2.1.6 Device and technical information - your device type, operating system, identifiers, IP address and cookie data (see our Cookie Policy);

2.1.7 Transaction information - records of orders and Click & Collect reservations, noting that payments are processed by the relevant retailer’s payment gateway and that we do not collect or store your card details;

2.1.8 Marketing preferences - your communication and marketing choices; and

2.1.9 Business-participant information - for representatives of shopping centres, retailers and cinemas, the business and contact details provided on registration.

3. HOW WE COLLECT YOUR INFORMATION

3.1 We collect personal information directly from you (when you register, complete forms, use the Platform or contact us); automatically (through cookies and similar technologies, and through the app and location services, when you use the Platform) and from third parties (including retailers, shopping centres, payment gateways, and analytics and advertising partners, and from publicly available sources).

4. LOCATION INFORMATION

4.1 Certain features - including location-based notifications, nearby offers, in-app navigation and earning MallMiles for visits - rely on your device location.

4.2 We collect and process your location information only where you enable location services on your device. You may disable location services at any time in your device settings, in which case location-based features may not be available or may not work properly.

5. HOW AND WHY WE USE YOUR INFORMATION

5.1 We process your personal information, on the lawful bases permitted by POPIA (including your consent, the performance of a contract with you, compliance with a legal obligation, and our legitimate interests), in order to:

5.1.1 provide, operate and improve the Platform and your account;

5.1.2 deliver personalised and location-based offers, content and notifications;

5.1.3 administer the MallMiles loyalty programme;

5.1.4 facilitate Click & Collect and your interactions with retailers;

5.1.5 communicate with you, including sending service and (where permitted) marketing messages;

5.1.6 generate analytics and insights, which we share only in aggregated, anonymised and de-identified form;

5.1.7 detect, prevent and investigate fraud and misuse, and keep the Platform secure; and

5.1.8 comply with our legal and regulatory obligations.

6. DIRECT MARKETING

6.1 We may send you marketing about specials, offers, promotions and events by push notification, email or SMS, in accordance with POPIA and the Electronic Communications and Transactions Act 25 of 2002.

6.2 You may opt out of marketing at any time through the app settings or the unsubscribe mechanism in the communication. We may still send you service, transactional and security messages.

7. HOW WE SHARE YOUR INFORMATION

7.1 We may share your personal information with:

7.1.1 retailers - to the extent necessary to fulfil a Click & Collect order you place with that retailer;

7.1.2 shopping centres, retailers and cinemas - only in aggregated, anonymised and de-identified form, for analytics and reporting;

7.1.3 operators and service providers - such as hosting, IT, analytics, communications and payment-facilitation providers, who process personal information on our behalf under written agreements and appropriate safeguards (as required by sections 20 and 21 of POPIA);

7.1.4 payment gateways - to the extent necessary to enable a retailer to process your payment;

7.1.5 authorities and advisers - where required by law, regulation or legal process, or to establish, exercise or defend our rights; and

7.1.6 an acquirer - in connection with a sale, merger or reorganisation of our business.

7.2 We do not sell your personal information.

8. CROSS-BORDER TRANSFERS

8.1 Where we transfer your personal information outside the Republic (for example, to cloud-hosting or service providers), we do so only in accordance with section 72 of POPIA and on the basis of appropriate safeguards that ensure an adequate level of protection.

9. SECURITY

9.1 We implement appropriate, reasonable technical and organisational measures to protect personal information against loss, and unauthorised access, destruction or misuse, as required by section 19 of POPIA. No system is completely secure, and we cannot guarantee absolute security.

10. HOW LONG WE KEEP YOUR INFORMATION

10.1 We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required or permitted by law, after which we securely delete or de-identify it.

11. YOUR RIGHTS

11.1 Subject to POPIA, you have the right to:

11.1.1 request access to the personal information we hold about you (in accordance with the Promotion of Access to Information Act 2 of 2000);

11.1.2 request that we correct or delete your personal information;

11.1.3 object, on reasonable grounds, to the processing of your personal information;

11.1.4 withdraw your consent, where processing is based on consent (which may limit your use of certain features); and

11.1.5 lodge a complaint with the Information Regulator.

11.2 To exercise any of these rights, please contact our Information Officer using the details in clause 1.

12. CHILDREN

12.1 The Platform is intended for users who are 18 years or older. We do not knowingly collect the personal information of children without the consent of a competent person, as required by POPIA. If you believe we have collected a child’s personal information, please contact us so that we can delete it.

13. COOKIES

13.1 We use cookies and similar technologies as described in our Cookie Policy.

14. CHANGES TO THIS POLICY

14.1 We may update this Privacy Policy from time to time. The current version is identified by the version date above, and we will give notice of any material change.

15. THE INFORMATION REGULATOR

15.1 You have the right to lodge a complaint with the Information Regulator (South Africa):

15.1.1 Website: inforegulator.org.za; and

15.1.2 Email: POPIAComplaints@inforegulator.org.za or enquiries@inforegulator.org.za.