Privacy Policy

This Privacy Policy explains how NETPIX (Pty) Ltd ("NETPIX", "we", "us") collects, uses, stores, and protects your personal information when you use the NetPix platform (netpix.co.za and related services). We are committed to protecting your privacy and complying with the Protection of Personal Information Act, 4 of 2013 (POPIA).

1. Responsible Party

NETPIX (Pty) Ltd is the responsible party as defined in POPIA.

NETPIX (Pty) Ltd
Registration Number: ________________
Registered Address: ______________________________
Contact / Information Officer: ______________________________
Email: ______________________________

2. Information We Collect

• 2.1. Account information — name, username, email address, password (hashed), and optional profile avatar.
• 2.2. Payment information — top-up amounts and transaction references. We do not store card numbers or CVV details. Card tokenisation is handled by Paystack; we store only the authorisation token they return.
• 2.3. Usage data — photos you upload, votes you cast, search queries, and approximate timestamps of those actions.
• 2.4. Technical data — IP address, browser type, device type, and session identifiers collected automatically when you visit or use the platform.
• 2.5. Communications — support messages or reports you submit to us.

3. How We Use Your Information

• 3.1. To create and maintain your account.
• 3.2. To process wallet top-ups and vote credits.
• 3.3. To operate the photo competition, including verifying entries and votes.
• 3.4. To communicate with you about your account, transactions, or competition results.
• 3.5. To detect and prevent fraud, abuse, or violations of our Terms of Service.
• 3.6. To improve platform performance and user experience (aggregated, anonymised analytics).
• 3.7. With your explicit consent, to send you marketing communications. You may withdraw this consent at any time via your account settings.

4. Legal Basis for Processing

We process your personal information on the following grounds:

• 4.1. Contract — processing necessary to provide the service you signed up for.
• 4.2. Legal obligation — where required by South African law.
• 4.3. Legitimate interest — fraud prevention and platform security.
• 4.4. Consent — marketing communications and optional analytics features.

5. Sharing of Information

• 5.1. We do not sell or rent your personal information.
• 5.2. We share information only with:
  • Paystack — for payment processing (subject to Paystack's own privacy policy).
  • Google — for Google Sign-In authentication (subject to Google's privacy policy).
  • Our hosting and infrastructure providers, bound by confidentiality obligations.
  • Law enforcement or regulators, where required by law.
• 5.3. International transfers (POPIA s72) — Both Google and Paystack operate infrastructure outside South Africa. When you authenticate via Google Sign-In or process a payment, your data may be transferred to and processed in the United States. These transfers are made on the basis of your consent given at account creation and on the contractual data-processing safeguards contained in those providers’ terms. Relevant policies: Google Privacy Policy and Paystack Privacy Policy.

6. Data Retention

• 6.1. Active account data is retained for as long as your account remains open.
• 6.2. When you delete your account, your personal identifiers (name, email, avatar) are anonymised immediately. Non-personal competition records (votes, uploads) are retained for audit and integrity purposes in anonymised form.
• 6.3. Payment transaction records are retained for seven years as required by South African tax and financial regulations.
• 6.4. Server logs (IP addresses, access records) are retained for up to 90 days.

7. Your Rights Under POPIA

You have the right to:

• 7.1. Request access to the personal information we hold about you.
• 7.2. Request correction of inaccurate or incomplete information.
• 7.3. Request deletion ("right to be forgotten") of your personal information, subject to legal retention obligations.
• 7.4. Object to processing for direct marketing purposes.
• 7.5. Lodge a complaint with the Information Regulator of South Africa:
  Website: www.inforegulator.org.za
  Email: complaints.IR@justice.gov.za

To exercise any of the above rights, contact our Information Officer at the address in section 1.

8. Security

• 8.1. We apply industry-standard technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.
• 8.2. Passwords are stored as bcrypt hashes — we cannot retrieve your plaintext password.
• 8.3. Payment card details are never stored on our servers; see section 5.2.
• 8.4. Despite our best efforts, no internet transmission is completely secure. Please keep your password confidential and notify us immediately if you suspect unauthorised account access.
• 8.5. Breach notification (POPIA s22) — In the event that we become aware of a security compromise that may have exposed your personal information, we will:
  • Notify the Information Regulator of South Africa as soon as reasonably possible after establishing the nature and extent of the compromise.
  • Notify affected users by email to the address on their account (or by a prominent platform notice where email delivery is not possible), describing: the nature of the compromise, the categories of information affected, and recommended steps to protect yourself.
  • Maintain a written record of the incident and our response.

9. Cookies and Similar Technologies

• 9.1. We use session cookies to keep you logged in between page visits.
• 9.2. We use a "remember me" cookie (30-day) if you opt in at login.
• 9.3. We do not currently use third-party advertising or tracking cookies.
• 9.4. You can disable cookies in your browser settings; however, core platform functionality requires session cookies to operate.

10. Age Requirements and Children

NetPix is intended for users aged 18 and older. All registering users are required to confirm they are at least 18 at sign-up. We do not knowingly collect personal information from persons under the age of 18 without verified parental or guardian consent.

Club administrators who submit photographs of under-18 athletes warrant that they have obtained the necessary consent from each athlete’s parent or legal guardian for the collection, use, and publication of those images on the platform.

If we become aware that a person under 18 has registered without the required consent, or that a photograph has been submitted without the required parental consent, we will take prompt action including deletion of the relevant personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes, we will notify registered users via email or a prominent notice on the platform.

12. Contact Us

For privacy-related queries or to exercise your POPIA rights:

Email: ______________________________
Postal: ______________________________