Data Processing
Notice.

What this notice is.

When you register as a member of a club, you are asked to consent to the processing of your personal information, and this notice is the document that consent refers to. If you sign in for a day pass, that consent is not taken: your details are collected so that your club can record your visit, and you sign only to acknowledge our Terms & Conditions. Either way, this notice tells you — before your information is collected — exactly what will be done with it, by whom, for how long, and what you can ask us to do about it, as section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”) requires.

It supplements our Privacy & POPIA Policy, which is the full account of how personal information is handled across the platform. If anything here seems to conflict with the Privacy Policy, the Privacy Policy governs.

Who processes your information.

Your club is the responsible party under POPIA — it decides what it needs from you and why. Kultiflo is the operator: we process your information on the club's behalf, under a written agreement, and only as described here. The operators we rely on (Google Cloud, Algolia, Google Maps, Peach Payments, SendGrid (Twilio) and Discord) are listed in § 7 of the Privacy Policy.

What is processed.

The categories, in brief — the full inventory is in § 3 of the Privacy Policy:

• Identity — name, surname, SA identity number or passport number, and the date of birth read from your identity number to verify you are 18 or older.
• Identity documents — a photograph of your identity document and a profile photograph at registration, and your digital signature at day-pass sign-in.
• Contact details — email address and phone number.
• Membership records — club, membership number, role, status, and validity dates.
• Sharing transactions — what was shared with you, when, the amounts, and the payment method.

The processing itself.

These are the operations this notice covers — and, when you register as a member, what your consent covers:

• Collection and capture — photographing your identity document and your profile at registration, and capturing your signature at day-pass sign-in.
• Verification — reading the date of birth from your SA identity number to confirm you are 18 or older, and matching the document to the person registering.
• Storage of your record in the club's membership register, and of your document photographs and signature in encrypted file storage.
• Transaction recording — each sharing transaction at the Point of Share is written against your membership, with an audit trail.
• Operational use — check-ins, renewals, approvals, expiry handling, and the service notices these require.
• Backup and recovery — your record is included in the platform's automatic backups on Google Cloud.

Nothing else. Your information is not used for profiling, not sold, not used for third-party advertising, and not used to train AI models. Marketing messages are governed by a separate, optional consent — see the Marketing Consent Notice.

Who has access.

• Your club's staff — front desk staff (registration and check-in), point-of-share operators (transactions), and club administrators (the membership register and reports).
• You — your own record, through your club.
• Kultiflo staff — approved staff only: super administrators running club approvals, accounts and billing, and engineers fixing faults, whether reported by a club or flagged by the apps' automated error reports.

Where it lives, and for how long.

Your membership record, and the document photographs and signature stored with it, are held on Google Cloud in South Africa (Johannesburg). Some of your information is also stored or processed outside South Africa — in the platform's search index, operated by Algolia, a provider based outside South Africa; on Google Cloud in the United States; and by other operators based outside South Africa — as described in § 8 of the Privacy Policy.

Your membership record is kept while your membership is active, and afterwards only as long as the club's legal obligations require. Transaction and financial records are retained for the periods South African law prescribes for accounting and tax records. When no longer required, records are deleted or de-identified.

How it is secured.

Encrypted in transit with TLS 1.2+, encrypted at rest with AES-256, access in the apps gated by role, and POS voids, stock removals and settlement payments written to an audit trail. The full account is on our Security page. If personal information is ever accessed by an unauthorised person, the Information Regulator and affected data subjects are notified as POPIA section 22 requires.

Correction, deletion & access requests.

You may, at any time:

• See your record — ask your club's front desk, or email us, for a copy of the personal information held about you. A first request for your own information is always free.
• Correct it — have any inaccurate or outdated detail fixed; corrections are made in the membership register directly.
• Delete it — request deletion of your record. We honour deletion requests except where a law requires a record to be retained (for example, financial records of past transactions) — in that case we tell you which law and for how long, and delete the rest.
• Withdraw this consent, if you gave it when you registered as a member — note that the membership register cannot lawfully be maintained without it, so withdrawal may mean your club can no longer keep you registered. If you signed in for a day pass, no consent was taken from you; you can object to the processing or ask for your record to be deleted, as § 11 of the Privacy Policy sets out.

Route requests through your club's front desk, or directly to the Information Officer below. Your full set of POPIA rights — including objection and complaint to the Information Regulator — is set out in § 11 of the Privacy Policy.

Information Officer & contact.