Privacy Policy

The "responsible party" under POPIA is Diswayne Tech System (Pty) Ltd, operating the Trots Oudtshoorn app and website. We decide why and how your personal information is processed.

For any privacy question, complaint, or request, contact us first — see the contact box below.

Account details: name, email address, and password (stored securely, never in plain text).

Business listing content: business name, description, photos (including your business photo gallery), contact details, and location, if you list a business.

Content you post: adverts, daily promotions, reviews, job postings, weather alerts, events, and community notices — including any photos you upload with them.

Comments and likes on adverts — these are posted instantly and are not pre-moderated, so avoid including personal information you wouldn't want visible publicly.

Reports: if you report a listing, comment, or review, we record what you reported, why, and any details you provide, to review it. If someone reports content you've posted, we record the same about it.

Trivia activity: if you play the daily trivia feature, we record your streak count and daily attempts, tied to your account.

Usage data: which businesses, adverts, and pages you view, used to show relevant content, rank listings, and measure interest. This includes aggregated analytics (via Google Analytics/Firebase) on how the app is used.

Optional location data: only if you enable "Use My Location" in Settings, to show nearby businesses (Near Me search).

Payment-related information: for paid upgrades, we record the amount, bank reference, and confirmation status of your EFT payment. We do not collect or store your card or bank login details — payments are made directly through your own bank.

Performance of a contract — to create your account and provide the directory, listing, and community features you've signed up for.

Consent — for optional features like push notifications, location-based search, and marketing communications, which you can withdraw at any time in Settings.

Legitimate interest — to moderate content, prevent abuse and fraud, and keep the platform safe and useful for the Oudtshoorn community.

Legal obligation — where we're required to retain or disclose information by South African law.

To operate your account and show you relevant local content.

To let businesses respond to enquiries and manage their own listings.

To send notifications you've opted into (specials, events, jobs, weather alerts).

To review and approve submitted content before it goes live, and to investigate reports of abuse, fraud, or policy violations.

To calculate and apply refund-policy credits for verified service outages (see our Refund Policy).

We do not sell your personal information to third parties, and we do not use it for third-party advertising or profiling.

Account information is kept for as long as your account is active.

Adverts that have run their course are automatically deleted 30 days after expiry if not renewed, along with their likes and comments.

If you delete your account (Profile → Delete Account), it's deactivated immediately. If you don't log back in within 90 days, your account and personal data are permanently deleted, except where we're legally required to retain records (for example, payment records for tax/accounting purposes) — these are retained only as long as the law requires. If you choose to pause your account instead, it stays deactivated indefinitely with no automatic deletion, until you log back in.

Content that has already been publicly displayed (e.g. an advert someone else may have screenshotted or shared) may continue to exist outside our systems — we cannot recall information once it has left the platform.

Our database and file storage (Supabase) are hosted in the European Union (Ireland). This means your personal information is transferred outside South Africa in the ordinary course of operating the app.

POPIA Section 72 permits this because the recipient is subject to a law, binding agreement, or set of rules that provides an adequate level of protection — the EU's GDPR framework, which Supabase's infrastructure operates under, is one of the strongest data protection regimes globally.

Supabase (our database, file storage, and authentication provider) processes your data on our behalf, as an operator under POPIA.

Firebase Cloud Messaging (when enabled) delivers push notifications to your device. Firebase/Google Analytics collects aggregated usage data (which screens are visited, how often) to help us understand how the app is used — this does not include your name, email, or the content of anything you post.

Cloudflare hosts and serves the app itself, and generates link previews when you share content — this only ever uses information already public within the app (e.g. an advert's title and photo), not your personal account data.

We do not share your information with advertisers or data brokers.

You can request a copy of the personal information we hold about you.

You can ask us to correct inaccurate or outdated information.

You can object to processing carried out on the basis of legitimate interest, or withdraw consent for anything consent-based (like push notifications).

You can delete or pause your account at any time from Profile → Delete Account — see "How long we keep your information" above for exactly what each option does.

You have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your information properly — see justice.gov.za/inforeg for their current contact details.

To exercise any of these rights with us directly, email us — see the contact details below. We aim to respond within 20 business days, as required by POPIA.

Passwords are hashed and never stored in readable form.

Access to business and listing data is restricted using row-level security, meaning only account owners (and platform administrators, for moderation) can access or modify their own content.

If we become aware of a security compromise that has likely resulted in unauthorised access to your personal information, we will notify the Information Regulator and affected users as required by POPIA Section 22, as soon as reasonably possible.

Trots Oudtshoorn is not directed at children under 18, and we do not knowingly collect personal information from children. If we become aware that a child's information has been submitted without appropriate consent, we will delete it.