Privacy Policy

1. Categories of Personal Information Collected

Depending on your usage of the Candibean mobile app, we collect the following information:

• Account Identifiers & Peer Transfer Verification: Name, email address, password hash, and contact mobile number. When a user initiates a peer-to-peer or merchant credit transfer using your registered email address or scans your in-app QR code, our backend system resolves and displays your masked name (e.g., P*** N*****) or verified business name for safety confirmation to prevent mistaken fund transfers prior to submission.
• Transaction & Transfer Data: Record of credits loaded, peer-to-peer credit transfers, merchant payments, group savings pot contributions, ticket requests, QR codes generated, and partner vouchers redeemed.
• Location Data (Optional): Coarse or precise geolocation, used only when you actively grant permission to display nearby partner barbershops, car washes, and event venues. We do not track your background location.
• Device Telemetry, Advertising ID & App Diagnostics: Device model, operating system version, Google Advertising ID (com.google.android.gms.permission.AD_ID), application build version, and Firebase crash logs used strictly to diagnose software stability, conduct legitimate analytics, deliver automated Google Play Store update alerts, and prevent fraudulent duplicate claims. Candibean does not sell personal identifiers or use your Advertising ID for third-party ad profiling.

2. Purpose and Legal Basis for Processing

We process your personal information strictly on lawful bases under POPIA Section 11:

• Contractual Performance: To maintain your entertainment wallet, verify ticket purchases, facilitate peer-to-peer and merchant credit transfers, administer group savings pots, and disburse vouchers to partner merchants.
• Peer Verification & Safety: To provide recipient name verification before money transfers, preventing transfers to incorrect accounts.
• Safety, Fraud Prevention & Updates: To prevent duplicate voucher redemptions, ticket counterfeiting, unauthorized account access, and notify users of critical Google Play Store app updates.
• Statutory Obligation: To maintain verifiable accounting records as mandated by South African tax legislation.

3. Third-Party Processors & Cross-Border Transfers

Candibean engages trusted, industry-leading subprocessors to operate the service securely:

• Google Cloud Platform & Firebase: Encrypted cloud database and authentication infrastructure. Cross-border transfers adhere to POPIA Section 72 safeguards.
• Paystack Payments: PCI-DSS Level 1 compliant payment processor for loading wallet credits with South African banks. Candibean never stores your complete debit/credit card numbers.

4. Data Retention & Erasure

We retain active user profile data only as long as your account remains open:

• When you delete your account, your profile, authentication credentials, and marketing records are purged immediately.
• In compliance with Section 29 of the Tax Administration Act (Act 28 of 2011), financial invoice and transaction ledgers are retained securely for a statutory period of five (5) years before permanent expungement.

5. Your Rights as a Data Subject

Under Chapter 3 of POPIA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate, outdated, or incomplete data.
• Request destruction or deletion of your account and personal records at any time.

6. How to Delete Your Account & Data

You may exercise your right to deletion at any time via:

• In-App Deletion: Open the Candibean app → go to Profile → tap Delete Account.
• Web-Based Deletion Portal: If you no longer have the app installed, submit an automated request directly on our Account Deletion Page.

7. Contact Information

For any privacy-related inquiries or formal POPIA requests, contact our designated compliance team:

• Information Officer & Compliance: info@candibean.co.za
• Customer Support: support@candibean.co.za
• Physical Jurisdiction: Johannesburg, Gauteng, Republic of South Africa