Bokfontein Privacy Policy

Bokfontein operates the Bokfontein mobile and web app, fan community, tours and match-day experiences.

• South Africa (Responsible Party under POPIA): Bokfontein (Pty) Ltd, Cape Town, South Africa.
• Australia (APP entity): Bokfontein Australia, Sydney, NSW.
• Information Officer / Privacy Contact: privacy@bokfontein.com

We only collect information that is necessary, lawful and proportionate to the service we provide.

• Account details: name, display name, email, mobile number, password.
• Profile data: avatar, supporter tier, favourite team, preferred stadium, dietary requirements.
• Booking & travel: passport name and number, date of birth, nationality, emergency contact (tours only).
• Payment data: handled by our PCI-DSS compliant payment partners — we do not store full card numbers.
• Content you post: fan-wall posts, photos, comments, reviews.

• Device & technical: device model, OS, app version, IP address, crash logs.
• Usage analytics: screens viewed, taps, session duration (only if you allow Usage Analytics).
• Location at stadiums: only when you enable “Share Location at Stadiums”.

• Single sign-on providers (Google) — name, email and profile picture.
• Ticketing & tour partners — booking confirmations and seat allocations.

• To provide the service — accounts, bookings, tickets, fan wall, concierge.
• Contract performance — fulfilling tours, match-day packages and partner bookings.
• Legitimate interests — fraud prevention, security, improving the app.
• Consent — marketing emails, push notifications, location sharing, optional analytics.
• Legal obligation — tax, anti-money-laundering, lawful requests from authorities.

Under POPIA s.11 we rely primarily on consent, contract and legitimate interest. Under the APPs (APP 3 & 6) we only collect and use personal information for the primary purpose disclosed, or a directly related secondary purpose you would reasonably expect.

We never sell your personal information. We share it only with:

• Tour operators, airlines, hotels and ticketing partners required to fulfil your booking.
• Payment processors (e.g. Stripe, Paddle, Peach Payments).
• Cloud infrastructure and analytics processors bound by data-processing agreements.
• Government and rugby governing bodies where required for stadium entry or match credentials.
• Law enforcement when compelled by a valid legal order.

Every consent-based choice in this policy maps to a toggle in Profile → Privacy & Safety. You can change any of them at any time and the change takes effect immediately:

• Public Profile — when on, other fans can find you by name in search and member lists. When off, your profile is visible only to you and tour staff handling your bookings.
• Show on Leaderboard — controls whether your display name, rank and supporter tier appear on public leaderboards and fan-wall rankings. When off, your XP is still tracked privately but you are hidden from all leaderboards.
• Share Location at Stadiums — when on, the app uses your device location at participating stadiums for auto check-in and Concierge tips. Location is processed on-device where possible and never used for advertising.
• Face ID / Fingerprint — uses your device's biometric system to unlock the app. Biometric data never leaves your device and is not transmitted to Bokfontein.
• Wallet QR on Lock Screen — surfaces your match-day ticket QR on the device lock screen for fast stadium entry. The QR is generated on-device from your booking; turning this off keeps tickets inside the app only.
• Marketing Emails — tour drops and partner offers. Off by default; you can opt out at any time from this toggle or any email footer.
• Usage Analytics — anonymous, aggregated event data used to improve the app. No analytics are collected when this is off.

Push notifications and email categories beyond marketing (booking confirmations, security alerts, match-day reminders) are operational messages tied to your account and are not covered by these toggles. You can manage push permission in your device settings.

Because we operate in both South Africa and Australia, your personal information may be transferred between these jurisdictions and to other countries where our processors operate (including the EU and United States).

• POPIA s.72: transfers occur only where the recipient is subject to comparable protection, you have consented, or transfer is necessary for performance of a contract with you.
• APP 8: we take reasonable steps to ensure overseas recipients handle your data consistently with the APPs and we remain accountable for their handling.

• Account data: while your account is active, plus 12 months after closure.
• Booking & financial records: 5 years (SA) / 7 years (AU) to meet tax and consumer-law requirements.
• Marketing preferences: until you withdraw consent.
• Crash & analytics logs: 90 days, then aggregated.

We use TLS in transit, encryption at rest, role-based access control, multi-factor authentication for staff, optional biometric unlock for the app, and regular penetration testing. No system is perfectly secure — if a breach affects your information we will notify you and the Information Regulator (SA) or the OAIC (AU) as required by law.

• Access the personal information we hold about you (s.23).
• Request correction or deletion of inaccurate, irrelevant or excessive data (s.24).
• Object to processing, including direct marketing (s.11(3), s.69).
• Complain to the Information Regulator: inforeg@justice.gov.za.

• Access and correction (APP 12 & 13).
• Opt out of direct marketing at any time (APP 7).
• Complain to the Office of the Australian Information Commissioner: oaic.gov.au.

To exercise any right, email privacy@bokfontein.com. We respond within 30 days.

The app is intended for users 16 and older. Under-18 fans joining a tour must have a parent or guardian provide consent and complete the booking.

Our web surfaces use strictly necessary cookies for authentication and a small number of analytics cookies — only if you enable Usage Analytics in the Privacy & Safety settings.

We may update this policy from time to time. Material changes will be notified in-app at least 14 days before they take effect. Continued use of Bokfontein after that date means you accept the updated policy.

• Email: privacy@bokfontein.com
• Information Regulator (SA): justice.gov.za/inforeg
• OAIC (AU): oaic.gov.au