← Back to Aurum

Privacy Policy

Last updated: 28 March 2026

This Privacy Policy explains how [COMPANY_NAME] (Registration No. [REGISTRATION_NUMBER]), trading as Aurum, collects, uses, and protects your personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Responsible Party

[COMPANY_NAME] (Pty) Ltd
Registration: [REGISTRATION_NUMBER]
Address: [PHYSICAL_ADDRESS]
Email: [EMAIL]
Phone: [PHONE]

2. Information Officer

Name: [INFORMATION_OFFICER]
Email: [INFORMATION_OFFICER_EMAIL]

The Information Officer is responsible for encouraging compliance with POPIA and dealing with requests related to this policy.

3. Personal Information We Collect

Staff users (our clients' employees):

• Full name and email address (provided by employer)
• Phone number for WhatsApp OTP authentication
• Role and workplace assignment
• Authentication credentials (passkey public keys, OIDC subject identifiers)
• Login timestamps and session data

Guests (end consumers):

• Aurum does not collect personal information from guests. Guests order anonymously via QR code — no account, no name, no payment details are stored.

4. Purpose and Legal Basis for Processing

• Contract performance: Processing staff credentials to provide the ordering platform service to our clients.
• Legitimate interest: Analytics, service improvement, and security monitoring.
• Consent: Optional marketing communications (you may withdraw consent at any time).

5. Data Retention

• Active accounts: retained for the duration of the service contract.
• Deactivated accounts: deleted within 90 days of deactivation, unless legally required to retain.
• Order data: anonymised after 24 months.
• Server logs: retained for 12 months for security purposes.

6. Your Rights as a Data Subject

Under POPIA, you have the right to:

• Access your personal information we hold.
• Correct inaccurate or incomplete information.
• Delete your information (subject to legal retention requirements).
• Object to processing of your information.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent for direct marketing at any time.

To exercise any of these rights, contact our Information Officer at [INFORMATION_OFFICER_EMAIL]. We will respond within 30 days.

7. International Data Transfers

Our servers are hosted on Render in the Frankfurt (EU) region. Data may be processed outside South Africa, but only in jurisdictions with adequate data protection as recognised by POPIA Section 72, or under appropriate contractual safeguards.

8. Cookies

Aurum uses only essential cookies required for authentication and session management. We do not use analytics or marketing cookies. See our Cookie Policy for details.

9. Direct Marketing

We will only send direct marketing communications with your explicit, prior consent (POPIA Section 69). You may opt out at any time by contacting us or clicking "unsubscribe" in any marketing email.

10. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify the Information Regulator as soon as reasonably possible.
• Notify affected data subjects in writing, describing the breach, potential consequences, and remedial measures taken.

11. Complaints

If you are not satisfied with our handling of your personal information, you may lodge a complaint with:

The Information Regulator (South Africa)
Website: https://inforegulator.org.za/
Email: complaints.IR@justice.gov.za

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. Continued use after changes constitutes acceptance.

Note: This document is a template. Please have it reviewed by a qualified South African attorney before publishing.