Data Processing
Notice.

What this notice is.

When you register as a member of a club, or sign in for a day pass, you are asked to consent to the processing of your personal information. This notice is the document that consent refers to: it tells you, before you agree, exactly what will be done with your information, by whom, for how long, and how to change your mind — as section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”) requires.

It supplements our Privacy & POPIA Policy, which is the full account of how personal information is handled across the platform. If anything here seems to conflict with the Privacy Policy, the Privacy Policy governs.

Who processes your information.

Your club is the responsible party under POPIA — it decides what it needs from you and why. Kultiflo is the operator: we process your information on the club's behalf, under a written agreement, and only as described here. The infrastructure operators we rely on (Google Cloud, Algolia, Google Maps, Peach Payments) are listed in § 7 of the Privacy Policy.

What is processed.

The categories, in brief — the full inventory is in § 3 of the Privacy Policy:

• Identity — name, surname, SA identity number or passport number, and the date of birth read from your identity number to verify you are 18 or older.
• Identity documents — a photograph of your identity document, a profile photograph, and your digital signature.
• Contact details — email address and phone number.
• Membership records — club, membership number, role, status, and validity dates.
• Sharing transactions — what was shared with you, when, the amounts, and the payment method.

The processing itself.

By consenting, you agree to these operations on that information:

• Collection and capture at registration or day-pass sign-in, including photographing your identity document and capturing your signature.
• Verification — reading the date of birth from your SA identity number to confirm you are 18 or older, and matching the document to the person registering.
• Storage of your record in the club's membership register, and of your document photographs and signature in encrypted file storage.
• Transaction recording — each sharing transaction at the Point of Share is written against your membership, with a tamper-evident audit trail.
• Operational use — check-ins, renewals, approvals, expiry handling, and the service notices these require.
• Backup and recovery — your record is included in the platform's automatic backups on Google Cloud.

Nothing else. Your information is not used for profiling, not sold, not used for third-party advertising, and not used to train AI models. Marketing messages are governed by a separate, optional consent — see the Marketing Consent Notice.

Who has access.

• Your club's staff — front desk staff (registration and check-in), point-of-share operators (transactions), and club administrators (the membership register and reports). Each role sees only what its work requires.
• You — your own record, through your club.
• Kultiflo staff — only approved engineers, only to resolve a problem that has been reported, never to browse. Every sensitive action is logged.
• No other club, ever. Each club's data is isolated from every other club's at three independent layers, described on our Security page.
• Farmers and other members have no access to your record.

Where it lives, and for how long.

Your information is stored on Google Cloud infrastructure, which may include data centres outside South Africa; cross-border transfers are protected by the safeguards described in § 8 of the Privacy Policy.

Your membership record is kept while your membership is active, and afterwards only as long as the club's legal obligations require. Transaction and financial records are retained for the periods South African law prescribes for accounting and tax records. When no longer required, records are deleted or de-identified.

How it is secured.

Encrypted in transit with TLS 1.2+, encrypted at rest with AES-256, every request verified by Firebase App Check, access gated by role, and sensitive actions written to an audit trail. The full account is on our Security page. If personal information is ever accessed by an unauthorised person, the Information Regulator and affected data subjects are notified as POPIA section 22 requires.

Correction, deletion & access requests.

You may, at any time:

• See your record — ask your club's front desk, or email us, for a copy of the personal information held about you. A first request for your own information is always free.
• Correct it — have any inaccurate or outdated detail fixed; corrections are made in the membership register directly.
• Delete it — request deletion of your record. We honour deletion requests except where a law requires a record to be retained (for example, financial records of past transactions) — in that case we tell you which law and for how long, and delete the rest.
• Withdraw this consent — note that the membership register cannot lawfully be maintained without it, so withdrawal may mean your club can no longer keep you registered.

Route requests through your club's front desk, or directly to the Information Officer below. Your full set of POPIA rights — including objection and complaint to the Information Regulator — is set out in § 11 of the Privacy Policy.

Information Officer & contact.