POPIA Compliance Notice

1. Designation of Information Officer (POPIA Sections 55 & 56)

In terms of Sections 55 and 56 of POPIA, Candibean has designated an Information Officer responsible for regulatory compliance and data subject rights administration:

• Responsible Entity: Candibean Entertainment (Pty) Ltd (Reg. No. 2024/715157/07)
• Designated Information Officer: Legal & Regulatory Compliance Officer
• Official POPIA Compliance Email: info@candibean.co.za
• Customer Support Email: support@candibean.co.za
• Registered Physical Address: 41 Juta Street, Braamfontein, Johannesburg, Gauteng, 2001, Republic of South Africa

2. Adherence to the 8 POPIA Conditions

• Condition 1 (Accountability — Section 8): Candibean ensures that all data processing practices, third-party operators (Paystack and Google Firebase), and technical security measures adhere strictly to POPIA provisions.
• Condition 2 (Processing Limitation — Sections 9–12): Personal information is obtained lawfully, transparently, and directly from the data subject with explicit consent. Only minimal necessary information is collected to operate your closed-loop Prepaid Value balance, Group POTs, tickets, and vouchers.
• Condition 3 (Purpose Specification — Sections 13–14): Data is collected specifically to administer closed-loop Prepaid Value allocations, Membership Passes (Starter Pass, Premium Pass, Pay-As-You-Go), collaborative Group POTs, event tickets, dynamic QR check-in verification, Uber Ride Vouchers, Vibe Coins, Weekly Prize Safe draws, and referral rewards.
• Condition 4 (Further Processing Limitation — Section 15): Personal information is never repurposed for incompatible uses or sold to third-party data brokers or advertisers.
• Condition 5 (Information Quality — Section 16): Users can review and update their contact details inside the app at any time.
• Condition 6 (Openness — Sections 17–18): Full transparency is maintained through our accessible Privacy Policy, Terms of Service, and this POPIA Notice.
• Condition 7 (Security Safeguards — Sections 19–22): Candibean enforces 256-bit AES-GCM local encryption via Android Hardware Keystore, TLS encryption in transit, server-side atomic idempotency verification, and PCI-DSS Level 1 payment processing via Paystack. Optional Biometric App Lock verification is processed strictly on-device via Android's hardware BiometricPrompt API—no biometric templates or images are ever transmitted to or stored on Candibean servers (POPIA Section 26).
• Condition 8 (Data Subject Participation — Sections 23–25): Users have clear, immediate mechanisms for data access, correction, objection, and permanent account erasure.

3. Exercising Your Statutory Rights (POPIA Form 1 & Form 2)

Under Sections 11(3), 23, and 24 of POPIA, you are entitled to:

• Form 1 (Objection to Processing): Object on reasonable grounds to the processing of your personal information.
• Form 2 (Correction or Deletion): Request correction of inaccurate information or destruction/deletion of personal data held by Candibean.

To submit a formal POPIA request, email our Information Officer at info@candibean.co.za (copying support@candibean.co.za) with the subject line "POPIA Data Subject Request".

4. Direct In-App & Web Erasure

You do not need to submit manual paperwork to erase your profile. Users may initiate account deletion at any time:

• Directly inside the Android app via Profile → Personal Information / Delete Account.
• Online via our self-service Account Deletion Request Portal.

5. Lodging a Complaint with the Information Regulator

If you believe your personal information has been handled in breach of POPIA, you retain the statutory right to lodge a complaint directly with the Information Regulator of South Africa: