Privacy Policy

1. Introduction

Cross Code Demo ('we', 'us', 'our') values your privacy and is committed to protecting your personal information in accordance with the Protection of Personal Information Act (POPIA).

This policy explains what data we collect, how we use it, and your rights.

2. Information We Collect

We collect the following information when you interact with our platform:

• Account information: name, email address, phone number, notification preference and password (stored only as an encrypted hash). If you use two-factor authentication, we keep which method you use; codes are short-lived and never stored in readable form.

• Security records: sign-ins, password changes and similar account events, with the time, IP address and device type, so we can alert you and investigate misuse.

• Event information: events you register for, ticket selections, discount codes used, attendee form answers, waitlist requests, ticket check-ins (when your ticket was scanned), and room or group allocations.

• Details about other people you register (see section 3), and parental consent details for youth events (see section 8).

• Payment information: processed by Yoco; we receive only payment status, amount and reference numbers. If you sponsor a spot, we record the amount and, unless you give anonymously, the name and message you choose to add.

• Feedback: answers you give to post-event feedback forms. If an event's feedback is anonymous, your answers are not linked to your name.

• Communication data: emails or messages exchanged with our team.

• Visit statistics: only if you allow them on the cookie notice (see section 11).

We do not collect or store credit card numbers or bank details.

Accounts may be created by an administrator, or when someone registers you or transfers a ticket to you, with a mobile number or email address only. You can activate such an account at any time.

3. People You Register or Transfer Tickets To

You can register other people (for example family members) and give each one their own ticket, or pass your ticket on to someone else.

• You type their name and, optionally, their email address or phone number. There is no search or list of existing users to choose from, and we never tell you whether the details you enter belong to an account.

• We use those details only to send that person their ticket, their attendee form, a parental consent request (youth events), or — for a transfer — a link to accept the ticket. A transfer only happens once they accept it; they can also decline.

• If the email or phone number matches an existing account, the ticket also appears in that person's own account. Otherwise an account may be created for them, which they can activate if they wish.

• Some events ask for each person's date of birth or gender (for example, to allocate rooms at a camp).

By entering someone else's details, you confirm that you are allowed to share them with us for this purpose (for a child, that you are their parent or guardian or have their permission).

4. How We Use Your Information

We use your information to:

• Process event registrations, payments, discounts and refunds.

• Communicate event updates, confirmations, or changes via email and/or WhatsApp (based on your preference).

• Send security notifications for new logins, password changes, and account actions on your account.

• Deliver your event tickets via email attachment and/or WhatsApp PDF (based on your preference).

• Check tickets in at the door, including with scanners that keep working without an internet connection.

• Offer places from a waitlist, arrange rooms and groups, and ask for parental consent on youth events.

• Send you an optional feedback form after an event, with one reminder.

• Manage user accounts and event attendance records, and give support when you ask for help.

• Improve our events and website (using anonymous statistics, and only with your permission).

• Comply with legal obligations.

5. WhatsApp Communications

If you choose 'WhatsApp' or 'Both' as your notification preference, we will use your South African mobile number to send you messages via WhatsApp. These messages may include:

• Event registration confirmations and updates.

• Payment receipts.

• Your event tickets (as a PDF document).

• Security alerts such as new login notifications, password changes, and account closure confirmations.

WhatsApp communications are delivered through WAWP (wawp.net), a third-party WhatsApp Business API provider. Your mobile number is transmitted to WAWP solely for the purpose of delivering your messages. WAWP does not retain your data beyond what is necessary for message delivery.

Security-critical messages (login alerts, password resets, account closures) are always sent via email regardless of your preference, and additionally sent via WhatsApp if your preference includes it.

You may change your notification preference at any time from the Profile & Security page in your account. Selecting 'Email only' will stop WhatsApp messages from being sent to you.

For accounts registered without a valid email address (e.g. walk-in or at-the-door registrations), WhatsApp will be used as the primary delivery channel for payment confirmations and ticket delivery, regardless of notification preference, since email is unavailable.

If your account requires activation and no email address is on file, the activation link will be sent to your WhatsApp number instead.

WhatsApp is a product of Meta Platforms, Inc. By receiving WhatsApp messages from us, you are subject to WhatsApp's own Terms of Service and Privacy Policy.

6. Where We Store Your Data

All data is securely stored on cloud servers hosted in South Africa.

We use appropriate technical and organisational measures to protect your information from unauthorised access, alteration, or disclosure.

7. Data Retention

We retain your personal data for up to 5 years after your last event registration, or until you request deletion of your account — whichever comes first.

Medical and emergency-contact details from parental consent forms are deleted a set number of days after the event ends (30 days unless the organisation sets a different period). The record of who gave consent, when, and to which wording is kept.

Detailed visit statistics are combined into anonymous daily totals after 90 days.

Ticket lists downloaded to a staff member's scanner for offline check-in are deleted from that device when offline mode is ended.

Records of support access to accounts (see section 9) and other audit records are kept for accountability.

You can delete your account at any time from the Profile & Security page in your account. Deletion anonymises your personal information (name, email address, and phone number are replaced with placeholder values) while retaining event and payment records in anonymised form for financial record-keeping purposes.

An administrator may also anonymise your account data on your request. To request this, contact our Information Officer (see section 14).

8. Children, Parental Consent and Health Information

Users under 18 may only create an account or register for events with the consent and supervision of a parent or guardian.

We do not knowingly collect or process personal information of minors without such consent.

For youth events, each attendee's date of birth is required. For anyone under 18, the parent or guardian named at registration is sent a consent request by email and WhatsApp, where they review the event details and give or decline consent. Their typed name, the time, the wording agreed to, and the IP address and device type used are recorded as proof of consent. A young person can't be checked in until consent is given.

The consent form may ask for medical information (such as allergies, medication and conditions) and an emergency contact. This is special personal information under POPIA. We collect it only with the parent's or guardian's consent, for the young person's safety at the event. It is stored encrypted and shown only to supervisors who need it, and each time the medical list is viewed this is recorded. It is deleted after the event as described in section 7.

A parent or guardian may also say whether photos of the young person may be used.

9. Who Can See Your Information

We do not sell or rent your personal information. Outside our organisation, it is shared only with:

• Yoco (a South African payment processor), to process payments securely.

• WAWP (wawp.net), a WhatsApp Business API provider, to deliver WhatsApp messages — only your mobile number and the message content, solely for delivery.

• Our email delivery provider, to deliver emails.

• Anyone we are required to share it with under South African law.

Within our organisation, people see only what they need:

• Door staff see a ticket's holder name, ticket type and check-in status when scanning.

• Group, room or bus leaders see the names, ages and contact numbers of the people in their group. Medical details are shown to supervisors only.

• Supervisors and administrators manage registrations, payments and communication for events.

• Support access: to help with a problem (for example, a ticket not showing), an administrator may view the site as you see it for up to 30 minutes. This is strictly read-only — nothing can be changed, paid, registered or sent on your behalf. A reason must be given, and the session and every page viewed are recorded. The organisation may choose to email you whenever this happens.

• Sponsors never see who was helped by a sponsorship; the public only sees how many spots were sponsored.

• Nobody else can see whether you have an account.

10. Your Rights (under POPIA)

Under POPIA, you have the right to:

• Access your personal information.

• Request correction or deletion of your data.

• Withdraw consent for processing.

• Lodge a complaint with the Information Regulator of South Africa.

To contact the Information Regulator:

• Website: www.inforeg.org.za

• Email: enquiries@inforeg.org.za

To exercise your rights directly with us, contact our Information Officer using the details in section 14 below.

11. Cookie Policy (Cookies and Browser Storage)

Our own site does not set tracking cookies. It keeps a few small items in your browser's storage (localStorage, and on staff scanners IndexedDB and an offline page cache). These work much like cookies, so this policy covers them. We do not use third-party analytics, advertising or tracking pixels.

Strictly necessary — always used, because the site can't work without them:

• hope_events_token — keeps you signed in.

• hope_events_user_cache — your last loaded profile, so pages keep working if your connection drops.

• hope_events_device — only if you tick "Trust this device" when entering a two-factor code, so you aren't asked for a code every time.

• hope_events_cookie_consent — remembers your choice on the cookie notice.

• banner_dismissed_… — remembers notices you have closed.

Staff and administrators only:

• hope_events_scan_device, hope_events_offline_lock and the "hope-events-offline-scan" database — on a staff member's scanner in offline mode: the device's id, the ticket list for the section being scanned, and scans waiting to upload. They are deleted when offline mode is ended. A copy of the scanner page is also cached so it opens without a connection.

• hope_events_admin_token, hope_events_admin_user_cache and hope_events_impersonation — only while an administrator is using read-only support access (section 9), and removed when it ends.

Optional — only if you click "Allow" on the cookie notice:

• hope_events_analytics_sid — a random, anonymous visit id. With it we count, in our own statistics, how many visitors view an event, start registering, and complete a registration. We record only that step, where the visit came from (for example a short link or campaign link) and the type of device — never your name, IP address or browsing history. Detailed records become anonymous daily totals after 90 days. If you choose "No thanks", nothing is counted and no visit id is created.

Third parties:

• Event pages with a location show an embedded Google Maps map. Google may set its own cookies when the map loads (see Google's privacy policy).

• Payments open Yoco's secure checkout page, which uses its own cookies on Yoco's site.

You can change your cookie choice at any time with "Cookie settings" at the bottom of every page, or with the button above. You can also clear your browser's storage in your browser settings; this signs you out.

12. Security

Your personal data is encrypted during transmission and stored using industry-standard security protocols. Medical and emergency details are additionally encrypted in our database.

Passwords are encrypted and cannot be viewed by anyone, including administrators.

Two-factor authentication is available to everyone and is required for supervisors and administrators.

Links we send for consent, feedback and ticket transfers are personal and time-limited. Only a secure fingerprint of each link is stored, not the link itself.

In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator of South Africa as required under POPIA section 22, without unreasonable delay.

13. Changes to This Policy

We may update this Privacy Policy periodically.

Any changes will be posted on this page with an updated effective date.

14. Information Officer

The Information Officer responsible for overseeing compliance with POPIA on behalf of Cross Code Demo is:

• Name: Joshua Oosthuizen

• Email: admin@crosscode.co.za

You may contact the Information Officer for any POPIA-related requests, including access to your personal data, requests for correction or deletion, and formal complaints.

15. Contact

For general privacy-related questions or requests, you can also contact us at:

📧 admin@crosscode.co.za