← Back to Home
POPIA & Google Play Compliance

Privacy Policy

Effective Date: 17 September 2026 | Protection of Personal Information Act (Act 4 of 2013)

Privacy Commitment: Candibean (Pty) Ltd respects your constitutional right to privacy. This Privacy Policy discloses our practices regarding data collected through the Candibean Android mobile app and web platform, in strict adherence to POPIA (Act 4 of 2013) and Google Play Data Safety policies.

1. Categories of Personal Information Collected

Depending on your usage of the Candibean mobile app, we collect the following information:

  • Account Identifiers: Name, email address, password hash, and contact mobile number.
  • Transaction Data: Record of credits loaded, ticket purchases, QR codes generated, and partner vouchers redeemed.
  • Location Data (Optional): Coarse or precise geolocation, used only when you actively grant permission to display nearby partner barbershops, car washes, and event venues. We do not track your background location.
  • Device Telemetry: Device model, OS version, and Firebase crash logs to diagnose software errors and protect against fraud.

2. Purpose and Legal Basis for Processing

We process your personal information strictly on lawful bases under POPIA Section 11:

  • Contractual Performance: To maintain your entertainment wallet, verify ticket purchases, and disburse vouchers to partner merchants.
  • Safety & Fraud Prevention: To prevent duplicate voucher redemptions, ticket counterfeiting, and unauthorized account access.
  • Statutory Obligation: To maintain verifiable accounting records as mandated by South African tax legislation.

3. Third-Party Processors & Cross-Border Transfers

Candibean engages trusted, industry-leading subprocessors to operate the service securely:

  • Google Cloud Platform & Firebase: Encrypted cloud database and authentication infrastructure. Cross-border transfers adhere to POPIA Section 72 safeguards.
  • Paystack Payments: PCI-DSS Level 1 compliant payment processor for loading wallet credits with South African banks. Candibean never stores your complete debit/credit card numbers.

4. Data Retention & Erasure

We retain active user profile data only as long as your account remains open:

  • When you delete your account, your profile, authentication credentials, and marketing records are purged immediately.
  • In compliance with Section 29 of the Tax Administration Act (Act 28 of 2011), financial invoice and transaction ledgers are retained securely for a statutory period of five (5) years before permanent expungement.

5. Your Rights as a Data Subject

Under Chapter 3 of POPIA, you have the right to:

  • Request access to the personal data we hold about you.
  • Request correction of inaccurate, outdated, or incomplete data.
  • Request destruction or deletion of your account and personal records at any time.

6. How to Delete Your Account & Data

You may exercise your right to deletion at any time via:

  • In-App Deletion: Open the Candibean app → go to Profile → tap Delete Account.
  • Web-Based Deletion Portal: If you no longer have the app installed, submit an automated request directly on our Account Deletion Page.

7. Contact Information

For any privacy-related inquiries or formal POPIA requests, contact our designated compliance team: