Privacy Policy

Application to TapVent

TapVent is an event-services platform of ToGGeL (Pty) Ltd and is not a separate legal entity. This document applies to ToGGeL when delivering TapVent services. References to ToGGeL identify the legal entity; references to TapVent identify the event platform. TapAPI is a separate legal entity providing integrated wallet functionality where enabled.

TapVent-specific application: Personal information may include attendee names and contact details, bookings, ticket identifiers, check-in history, event preferences and event support correspondence. Event organisers may determine purposes for some processing; ToGGeL’s role must be assessed per service. Where an event uses TapAPI wallet bands, TAPAPI (Pty) Ltd is a separate responsible party for the wallet, under its own Privacy Policy; what passes between ToGGeL and TapAPI is set out under Wallet events below.

Event-data processing and disclosures

Depending on the selected event services, ToGGeL through TapVent may process attendee identity and contact details, booking references, ticket/QR identifiers, wristband associations, access-validation events, attendance logs, event support requests and operational reports. An organiser may be the responsible party for some event data, with ToGGeL acting as its operator; ToGGeL may be a responsible party for its own contracting, security and administration. Roles must be determined by the actual purposes and processing instructions for each event.

Data retention depends on purpose, law, contractual requirements and legitimate recordkeeping needs; no universal attendee-retention period is asserted. Data subjects may use the ToGGeL Information Officer contact details listed in this policy.

Wallet events (TapAPI wallet bands)

• TAPAPI (Pty) Ltd (registration 2026/529514/07) is a separate company and a separate responsible party for the wallet. You give TapAPI your cell number, name and PIN yourself when you open the wallet, and TapAPI’s Privacy Policy (tapapi.co.za/legal/privacy.php) covers that information, your wallet transactions and any identity check.
• ToGGeL gives TapAPI only what the band needs to work: the band’s code, recorded when the band is encoded, and the event’s reference, which event tills record with each sale.
• TapAPI gives ToGGeL only totals that identify nobody, such as sales per event and per till, for the event’s reports. ToGGeL does not receive your wallet details, transactions or PIN, your identity documents or selfie, or your bank details.
• ToGGeL does not sell wallet information and does not use it for marketing.
• Requests about wallet information go to TapAPI’s Information Officer at io@tapapi.co.za. Requests about tickets, registration and event records go to ToGGeL’s Information Officer (section 1).

Existing corporate provisions (apply insofar as relevant to TapVent services)

PRIVACY NOTICE

This is the privacy notice of ToGGeL (Pty) Ltd ("ToGGeL", "we", "our" or "us"), registration number 2022/773786/07, registered in South Africa. Our contact address is 4 Augrabies Street, Mooikloof Ridge, Pretoria.

INTRODUCTION

This privacy notice explains how ToGGeL collects, uses, stores, shares, protects and otherwise processes personal information in the course of our business, websites, applications, platforms, products and services.

It also explains the rights of data subjects and how to contact us.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Promotion of Access to Information Act 2 of 2000 (PAIA), and other applicable South African law.

ToGGeL may act as a responsible party for some processing activities and as an operator acting on the instructions of a customer or business partner for others. Where we act as an operator, the relevant responsible party determines the purpose and means of processing and may be the appropriate first point of contact for a data subject request.

1. INFORMATION OFFICER

The Information Officer is responsible for overseeing ToGGeL's privacy and information-access obligations.

Information Officer: Charles Matthews
Director
Email: info@toggel.co.za
Telephone: 082 568 6002

2. INFORMATION WE MAY PROCESS

The personal information we process depends on the product, service, relationship and purpose involved. It may include:

• Identity information - names, title, date of birth, identity or registration details, photographs and other identifiers where required.
• Contact information - physical, postal and billing addresses, email addresses, telephone numbers and communication details.
• Account and profile information - usernames, account identifiers, preferences, service settings and authentication-related information. Passwords should be stored only in protected form and are not intended to be readable by ToGGeL personnel.
• Financial and transaction information - bank or payment details where required, wallet or transaction information, purchase/payment history, refunds, settlements and related records.
• Technical and usage information - IP address, device/browser information, logs, access events, approximate location derived from technical data where applicable, and information about use of our systems.
• Service-specific information - information necessary to provide the relevant ToGGeL-enabled service, which may include access, attendance, check-in, event, merchant, customer-support or other operational records.
• Employment and supplier information - information required for recruitment, employment, payroll, contracting, due diligence and supplier administration.

We may create aggregated or de-identified information for reporting, analytics, security and service improvement. If information can reasonably be linked back to an identifiable person, we continue to treat it as personal information.

3. SPECIAL PERSONAL INFORMATION AND CHILDREN'S INFORMATION

Certain ToGGeL-enabled services may involve special personal information or personal information relating to children, for example where a customer uses the platform for authorised safeguarding, medical/emergency, identity-verification or school-related purposes. We process such information only where a lawful basis and any required authorisation or consent exists, and with additional safeguards appropriate to the sensitivity of the information.

4. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information directly from you, from a customer or organisation that has authorised use of a ToGGeL service, from your interactions with our systems, from service providers and business partners, or from lawful public or regulatory sources.

Where POPIA requires notification, we provide or support the provision of appropriate information about the collection, purpose, source, recipients, whether supply is mandatory or voluntary, and the data subject's rights.

5. WHY WE PROCESS PERSONAL INFORMATION

Depending on the circumstances, we may process personal information to:

• create and administer accounts, profiles, wallets or service access;
• provide, support, secure and improve ToGGeL products and services;
• verify identity or authority where required for security, contractual or regulatory purposes;
• process or support payments, transactions, refunds, settlements and related records;
• provide access control, attendance, check-in, event, support or other contracted functionality;
• communicate with customers, users, suppliers and business contacts;
• manage employment, recruitment, payroll and contractor relationships;
• prevent fraud, misuse, security incidents and unauthorised access;
• maintain records, perform audits and meet contractual, legal and regulatory obligations;
• establish, exercise or defend legal rights; and
• send permitted service or marketing communications, subject to applicable consent and opt-out requirements.

6. LAWFUL BASIS FOR PROCESSING

We process personal information only where permitted by POPIA and applicable law. Depending on the circumstances, processing may be necessary for a contract, required by law, based on consent, necessary to protect a legitimate interest of the data subject, or necessary to pursue a legitimate interest of ToGGeL or a third party where the law permits.

Where processing is based on consent, consent may be withdrawn, but withdrawal does not affect processing that was lawful before withdrawal or processing that is justified on another lawful basis.

7. IF YOU DO NOT PROVIDE INFORMATION WE NEED

Where information is required by law, for security, or to perform a contract or requested service, failure to provide it may mean that we cannot create an account, verify an instruction, complete a transaction or provide the relevant service. We will explain this where reasonably practicable.

8. CONTRACTUAL AND PRE-CONTRACTUAL PROCESSING

When you create an account, acquire a product or service, use a contracted ToGGeL service, or ask us to take steps before entering into an agreement, we may process information necessary to perform or prepare for that agreement. This may include identity verification, service delivery, account administration, customer support, transaction processing and security.

9. LEGAL AND REGULATORY PROCESSING

We may process and disclose personal information where required or permitted by law, legal process, a regulator, a court or a law-enforcement authority with appropriate authority. We may also retain records where necessary to comply with statutory, tax, accounting, employment or other legal obligations.

10. LEGITIMATE INTERESTS

Where permitted by POPIA, we may process information for legitimate operational or business interests, after considering the purpose, necessity and potential effect on the data subject. Examples include service administration, security monitoring, fraud prevention, responding to enquiries, maintaining business records and protecting legal rights.

11. DIRECT MARKETING

Electronic direct marketing will be conducted in accordance with POPIA and applicable law. Where consent is required, we will seek it before sending unsolicited electronic direct marketing. Existing customers may receive communications about our own similar products or services where the law permits and where an opt-out opportunity is provided.

You may opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting info@toggel.co.za.

12. SHARING PERSONAL INFORMATION

We do not sell personal information. We may share personal information only where lawful and reasonably necessary, including with:

• customers or organisations responsible for a ToGGeL-enabled service, where we act on their instructions;
• banks, payment providers and authorised financial-service or transaction partners;
• hosting, cloud, communications, identity, security and technology service providers;
• professional advisers, auditors, insurers and contracted service providers;
• business partners where necessary to provide an authorised service;
• TAPAPI (Pty) Ltd, for events that use TapAPI wallet bands, only as described under Wallet events;
• regulators, courts, law-enforcement bodies or public authorities where required or permitted by law; and
• a purchaser, investor or successor in connection with a legitimate corporate transaction, subject to appropriate confidentiality and legal safeguards.

Operators and service providers that process personal information on our behalf are expected to protect it and process it only in accordance with applicable contractual and legal requirements.

13. PAYMENT INFORMATION

Payment processing arrangements differ between ToGGeL services. Payment information may be processed by authorised banks, payment service providers or other regulated or contracted payment partners. ToGGeL will only process or retain payment-related information that is reasonably necessary for the relevant service, reconciliation, support, fraud prevention, legal compliance and record-keeping.

We do not represent that payment information is never handled by ToGGeL, because the nature of our services may require transaction and payment-related records. Full payment-card credentials should not be stored by ToGGeL unless specifically required and protected in accordance with applicable standards and contractual requirements.

At a TapVent wallet event, wallet top-ups and payments are processed by TapAPI and its payment providers; ToGGeL does not receive card or bank details for them.

14. COMMUNICATING WITH US AND COMPLAINTS

When you contact us, we may retain your contact details, the content of the communication and our response so that we can assist you, maintain an appropriate record and improve service. Where a complaint requires involvement of another party, relevant information may be shared only to the extent reasonably necessary and lawful.

15. WEBSITE, COOKIES AND TECHNICAL INFORMATION

Our websites and online services may use cookies and similar technologies for essential functionality, security, preferences, analytics and, where applicable, marketing. The cookies and third-party tools actually used may change as our websites and services evolve.

Where consent is legally required for a non-essential cookie or similar technology, we will seek the appropriate consent. Browser and device controls may also allow you to restrict or delete cookies, although doing so may affect functionality.

When you use our online services, technical information such as IP address, browser/device information, timestamps, logs and security events may be collected automatically for operation, security, diagnostics and analytics.

16. THIRD-PARTY WEBSITES AND SERVICES

Our websites or applications may link to or integrate with third-party services. Those third parties may process personal information under their own privacy notices. ToGGeL is not responsible for a third party's independent processing where that party determines its own purposes and means.

17. CROSS-BORDER PROCESSING

ToGGeL may use service providers, infrastructure or business partners that process or store personal information outside South Africa. Cross-border transfers will be managed in accordance with section 72 of POPIA and applicable contractual, legal and security safeguards.

Depending on the circumstances, a transfer may rely on an adequate level of protection under applicable law or binding arrangements, consent, contractual necessity, or another basis permitted by POPIA.

18. INFORMATION SECURITY

We maintain appropriate and reasonable technical and organisational safeguards designed to protect personal information against loss, damage, unauthorised destruction, unlawful access or unlawful processing. Measures are risk-based and may include encryption, access controls, multi-factor authentication, secure hosting, logging and monitoring, endpoint security, vulnerability management, backups, recovery controls, staff awareness and third-party security requirements.

19. SECURITY COMPROMISES

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, ToGGeL will respond in accordance with POPIA and its incident-response procedures. Where ToGGeL is the responsible party, this may include notification to the Information Regulator and affected data subjects as soon as reasonably possible, subject to the circumstances and any lawful delay.

Where ToGGeL acts as an operator, we will notify the relevant responsible party in accordance with applicable law and contractual requirements so that the responsible party can meet its obligations.

20. RETENTION OF PERSONAL INFORMATION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or subsequently lawfully processed, or for a period required or permitted by law, contract, dispute, audit or legitimate record-keeping requirement.

When information is no longer required, it will be deleted, destroyed or de-identified in accordance with ToGGeL's retention and destruction requirements, subject to technical and legal limitations.

21. JOB APPLICATIONS AND EMPLOYMENT

Applicant and employee information is processed for recruitment, employment administration, payroll, performance, training, security, legal compliance and related legitimate purposes. Retention periods are determined in accordance with applicable employment, tax, corporate and other legal requirements and ToGGeL's Record Retention and Destruction Policy, rather than a single fixed period for all employment information.

22. ACCURACY OF INFORMATION

We take reasonable steps to keep personal information complete, accurate, not misleading and updated where necessary for the purpose for which it is processed. Please tell us if relevant information changes.

23. YOUR RIGHTS

Subject to POPIA, PAIA and applicable limitations, a data subject may have the right to:

• ask whether ToGGeL holds personal information about them and request access to it;
• request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object to certain processing on reasonable grounds where the law permits;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• request deletion or destruction where ToGGeL is no longer authorised to retain the information; and
• lodge a complaint with the Information Regulator.

We may need to verify identity and authority before acting on a request. Some requests may be subject to PAIA procedures, lawful refusal grounds, third-party rights, retention obligations or other legal limitations.

24. HOW TO EXERCISE YOUR RIGHTS

Requests may be submitted to the Information Officer at info@toggel.co.za. Where ToGGeL is processing information solely as an operator for another responsible party, we may refer or transmit the request to that responsible party as appropriate.

25. HOW TO COMPLAIN

We encourage you to contact us first so that we can investigate and respond to a privacy concern. You also have the right to lodge a complaint with the Information Regulator.

Information Regulator (South Africa)
Website: inforegulator.org.za
Email: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Toll-free: 0800 017 160

26. AUTOMATED PROCESSING AND PROFILING

ToGGeL may use automated system functions for operational, security, fraud-prevention or service-delivery purposes. We will not make a decision based solely on automated processing that produces legal consequences or substantially affects a person where POPIA prohibits such processing, unless an applicable legal exception and required safeguards apply.

27. CHANGES TO THIS PRIVACY POLICY

We may update this privacy notice when our services, processing activities, technology, legal obligations or contact details change. The current version will be made available through the appropriate ToGGeL channel or website. Where a change is material and notification is reasonably required, we will take appropriate steps to inform affected data subjects.

28. RELATED POLICIES

This notice should be read together with relevant ToGGeL policies and notices, including the PAIA Manual, Data Security Policy, Record Retention and Destruction Policy, Disaster Recovery Policy, BYOD Policy and other information-security or service-specific notices where applicable.

29. CONTACT DETAILS

ToGGeL (Pty) Ltd | Registration: 2022/773786/07
4 Augrabies Street, Mooikloof Ridge, Pretoria
Email: info@toggel.co.za
Website: www.toggel.co.za

30. INTERPRETATION

In this notice, "personal information", "special personal information", "data subject", "responsible party", "operator" and "processing" have the meanings given to them in POPIA, where applicable.

31. REVIEW OF THIS PRIVACY POLICY

This Privacy Policy is reviewed periodically and when material changes occur. The Information Officer is responsible for coordinating the review and ensuring that the published notice remains reasonably accurate.

REVISION HISTORY

DOCUMENT STATUS

This document is ToGGeL's general privacy notice. Product-, customer- or service-specific privacy notices may provide additional information where a particular processing activity requires more detail.