Privacy Policy

1. Data Controller and Contact Information

Sunday Cookout ("We", "Us", or "Our") is the data controller responsible for the processing of your personal information under the Protection of Personal Information Act, 4 of 2013 (POPIA).

2. Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa if you believe that we have breached your rights under POPIA.

3. Personal Information We Collect

We collect the following categories of personal information:

• Identification Data: Full name, email address, phone number (in E.164 format), and date of birth
• Account Information: Username, password (hashed), account status, and authentication credentials
• Xperience Data: Tickets purchased, ticket tier, payment status, and stall claim records
• Usage Data: Interaction logs, event participation history, timestamps of key actions, and device information
• Marketing Data: Preferences for event notifications, promotional emails, and marketing communications

4. Purpose of Processing

We process your personal information for the following purposes:

• Event Management: To organize and manage Sunday Cookout events and to communicate event details with you
• Xperience Administration: To administer your Xperience tickets, confirm payments, and track stall claims
• QR Code Verification: To validate your ticket and process claims at vendor stalls
• Account Management: To create and manage your user account, authenticate your identity, and secure your account
• Marketing and Communications: To send you promotional emails, event updates, and special offers (only with your consent)
• Analytics and Improvement: To analyze user behavior, improve our services, and enhance user experience
• Legal and Compliance: To comply with applicable laws, regulations, and contractual obligations
• Fraud Prevention: To prevent fraudulent activities, including duplicate stall claims and ticket fraud

5. Legal Basis for Processing

We process your personal information on the following legal bases:

• Consent: For marketing communications and optional data collection (you can withdraw consent at any time)
• Contract Performance: To fulfill our obligations to you as a Sunday Cookout Xperience ticket holder
• Legitimate Interest: To improve our services, prevent fraud, ensure security, and comply with legal obligations
• Legal Obligation: Where required by South African law or court order

6. Data Retention

We retain your personal information for as long as your account remains active or as needed to provide you with the services. After account deletion or inactivity, we retain your data for 12 months to comply with legal obligations, prevent fraud, and support dispute resolution. After this period, your data will be securely deleted unless retention is required by law.

7. Third-Party Data Processors

Your personal information may be processed by the following third-party service providers:

• Google Firebase: We use Google Firebase for data storage, authentication, and application hosting. Firebase stores data in servers located in the United States and European Union. Google has adopted Standard Contractual Clauses to ensure adequate data protection in compliance with POPIA.
• SendGrid: We use SendGrid to send transactional and marketing emails (e.g., ticket activation notifications, event updates). SendGrid processes email addresses and communication content. SendGrid is a US-based service that has implemented appropriate data protection measures.
• Analytics Providers: We may use Google Analytics to understand how users interact with our platform. Google processes non-identifying usage data in accordance with POPIA.

All third-party processors are contractually obligated to protect your personal information and process it only for specified purposes on our behalf.

8. Your Rights Under POPIA

You have the following rights regarding your personal information:

• Right of Access: You have the right to request access to your personal information that we hold. We will provide this information within 30 days of your request.
• Right to Correct: You can request correction or updating of inaccurate, incomplete, or outdated personal information.
• Right to Deletion: You can request deletion of your personal information, subject to legal and legitimate business obligations.
• Right to Object: You have the right to object to the processing of your personal information for marketing or certain other purposes.
• Right to Data Portability: You can request your personal information in a structured, commonly used, machine-readable format to transfer to another service provider.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Regulator if you believe we have violated your rights.

To exercise any of these rights, please contact us at sundaycookouts@gmail.com with details of your request.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication and security. These cookies are necessary for the app to function.
• Analytics Cookies: Used to understand user behavior and improve our services. These cookies require your opt-in consent.
• Marketing Cookies: Used to track your preferences and deliver personalized content. These require your explicit consent.

You can manage your cookie preferences in your browser settings. Note that disabling essential cookies may affect functionality.

10. Security of Personal Information

We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS)
• Hashing and encryption of sensitive data at rest
• Regular security audits and penetration testing
• Access controls and role-based permissions
• Employee confidentiality agreements and data protection training

While we take reasonable precautions, no system is completely secure. We cannot guarantee absolute security of your information.

11. International Data Transfers

Your personal information may be transferred to, stored in, and processed in countries other than South Africa, including the United States and European Union. These countries may have data protection laws that differ from South Africa's POPIA. By using our services, you consent to such transfers, and we ensure that appropriate safeguards (such as Standard Contractual Clauses) are in place to protect your information.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your personal information, please contact us:

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by updating the "Effective Date" at the top of this page. Your continued use of our services following any changes constitutes your acceptance of the updated policy.