Privacy Policy

Grooove (Pty) Ltd ("Grooove", "we", "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share your information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and applicable South African law.

By using the Grooove platform, you consent to the practices described in this policy.

1. Information We Collect

We collect personal information you provide directly to us, and information generated through your use of the Platform:

• Account information: Name, email address, phone number, and password when you register
• Venue information: Business name, address, operating hours, menu, photos, and banking details for Venue Operators
• Booking data: Reservation details, dates, table preferences, group sizes, and special requests
• Transaction data: Subscription billing history and payment method details (processed securely via third-party payment providers)
• Usage data: Pages visited, features used, device type, browser, and IP address
• Communications: Messages sent through the Platform's inbox or to our support team

We do not collect sensitive personal information (as defined under POPIA) unless strictly necessary and with explicit consent.

2. How We Use Your Information

We use your personal information to:

• Create and manage your account on the Platform
• Process and confirm bookings between Guests and Venue Operators
• Send booking confirmations and reminders via WhatsApp or email
• Process subscription payments for Venue Operators
• Provide analytics and insights to Venue Operators about their bookings and guests
• Improve the Platform's features, performance, and user experience
• Comply with legal obligations under South African law
• Detect, prevent, and respond to fraud or security incidents

We will not use your personal information for purposes incompatible with those listed above without your consent.

3. Data Sharing

We share personal information only in the following circumstances:

• With Venue Operators: Guest booking details (name, phone, party size) are shared with the venue where the reservation is made
• With Promoters: Limited booking data is shared with Promoters for commission tracking, as agreed by the Guest
• With service providers: Trusted third-party services including Railway (USA) for application hosting, Supabase (EU) for database storage, Vonage (Netherlands) for WhatsApp message delivery, and SendGrid (USA) for email delivery — all subject to data processing agreements. Some personal information may be transferred outside South Africa to these providers. We ensure appropriate safeguards are in place for all cross-border transfers.
• Legal requirements: We may disclose information where required by law, court order, or South African regulatory authority

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services:

• Account data: Retained for the lifetime of the account, plus 12 months after a deletion request
• Booking records: Retained for 5 years for legal and accounting compliance
• Payment records: Retained for 7 years as required by South African financial regulations
• Usage logs: Retained for 90 days

After the applicable retention period, personal information is securely deleted or anonymised.

5. Your Rights under POPIA

As a data subject under POPIA, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Objection: Object to the processing of your personal information in certain circumstances
• Withdraw consent: Withdraw consent where consent is the lawful basis for processing
• Complaint: Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact our Information Officer at groooveza@gmail.com. We will respond within 30 days.

You may also contact the Information Regulator at www.inforegulator.org.za.

6. Cookies

The Platform uses cookies and similar technologies to:

• Keep you logged in to your account (authentication cookies)
• Remember your preferences and settings
• Analyse Platform usage to improve performance

You can control cookie settings through your browser. Disabling certain cookies may affect Platform functionality. We do not use cookies for cross-site advertising or behavioural tracking by third parties.

7. Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS)
• Hashed and salted password storage (bcrypt)
• JWT-based authentication with token expiry
• Access controls limiting staff access to personal data on a need-to-know basis
• Regular security reviews

While we take every reasonable precaution, no system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA.

8. Contact the Information Officer

For any privacy-related queries, requests, or complaints, contact our Information Officer: