Privacy Policy

Effective Date: 31 July 2026

1. Who we are and what this Policy covers

The Payments Club ("the Club", "we", "us") is a professional membership organisation for individuals and companies in the South African payments industry. The Club platform and events are operated with the support of MoData (Pty) Ltd as our technology service provider.

This Policy explains, in plain language, what personal information we collect from members, guests, event attendees, company representatives and website visitors; why we collect it; how we protect it; and the rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).

2. What we collect

• Identity and contact details — name, business email, mobile number, company, job title.
• Account details — email used as your login, password (stored only as a secure hash, never plain text), verification and consent records.
• Event details — invitations, your Attending / Not Attending response, event tickets and QR codes, check-in status and attendance history, and any dietary or accessibility needs you volunteer.
• Technical details — IP address, browser and device information, audit and security logs, and cookies.
• Optional details — LinkedIn profile link and profile photo, if you choose to provide them.

Your event ticket and QR code contain only a random reference (for example a ticket ID) — never your password, identity number or other sensitive information.

3. Why we use it and our lawful bases

• Membership & account — Registration, Verify Me onboarding, login, support, password reset. (Contract / legitimate interests)
• Events — Invitations, RSVP, tickets & QR check-in, capacity and safety planning. (Contract / legitimate interests)
• Communications — Operational notices about your account, events and this Policy. (Contract / legitimate interests)
• Marketing & newsletters — Event updates and industry news you have opted in to. (Consent, with opt-out at any time)
• Security & compliance — Protecting the platform, audit logs, legal obligations. (Legal obligation / legitimate interests)

We never bundle required processing with optional marketing. Optional consents are separate, unticked choices, and you can change or withdraw them at any time in your Member Profile.

4. Who we share it with

• MoData (Pty) Ltd and approved service providers — hosting on Microsoft Azure, email delivery, WhatsApp Business Solution Provider, event check-in — under written contracts that restrict them to our instructions.
• Event sponsors or partners — only if you have given separate, specific consent, and only the details disclosed to you.
• Regulators, courts or law enforcement — where the law requires or permits.

We do not sell your personal information, and we do not share member lists for third-party marketing without your consent.

5. Where it is stored and how we protect it

Your information is hosted on the MoData Azure environment, with data residency in South Africa or a jurisdiction that meets POPIA's cross-border transfer conditions. We apply encryption in transit and at rest, secure password hashing, role-based access with multi-factor authentication for administrators, audit logging, backups and an incident-response process. If a compromise of your personal information ever poses a risk to you, we will notify you and the Information Regulator as required by POPIA.

6. How long we keep it

• Member profile and account records — For your membership plus 5 years, unless the law requires otherwise.
• Consent and preference records — For your membership plus 5 years (minimum), as proof of consent.
• Event RSVP, ticket and attendance records — For your membership plus 5 years.
• Guest (Bring a Friend) records — 90 days after the event, unless the guest becomes a member.
• Marketing opt-out records — Kept as a suppression record so we never market to you again.
• Audit and security logs — Minimum 3 years.

7. Your rights

1. Ask what personal information we hold about you, and request a copy.
2. Ask us to correct information that is inaccurate, incomplete or out of date.
3. Ask us to delete information, subject to legal retention requirements.
4. Object to processing, including objecting to direct marketing at any time.
5. Withdraw any optional consent at any time in your Member Profile or by contacting us.
6. Complain to us, and to the Information Regulator of South Africa.

We may ask for proof of identity before acting on a request, and we will respond in a reasonable time. Withdrawing the consent required for core membership processing will result in deactivation of your membership.

8. Cookies

Our website and portal use necessary cookies for login, session management and security — the portal cannot work without them. Analytics or marketing cookies, if used, are subject to your consent and to a cookie notice with practical controls.

9. Children

The Club is intended for adult business professionals. We do not knowingly collect children's personal information.

10. Contact us and further documents

• Information Officer: To be appointed
• Privacy email: privacy@paymentsclub.co.za
• General enquiries: info@paymentsclub.co.za
• Information Regulator (South Africa): enquiries@inforegulator.org.za · 010 023 5200

Copies of our supporting policies — the PIA Protocol, Data Retention Policy, Data Governance Policy, Data Storage Policy and Fair Use Policy — are available to members and customers on request from the Information Officer, and a compliance directory is published on our website.

11. Changes to this Policy

We may update this Policy from time to time. The latest version, with its effective date, is always published on our website. Material changes will be notified by email or portal notice. Continued use of the Club after the effective date means the updated Policy applies, subject to your rights under POPIA.