Privacy and POPIA

1. Who we are

Are We There Yet is operated by Are We There Yet SA, registration number 2026/733763/07. For the purposes of the Protection of Personal Information Act 4 of 2013, which we refer to as POPIA, we are the responsible party for the personal information described in this policy.

2. What this policy covers

This policy explains what personal information we collect when you use arewethereyet.co.za or the Are We There Yet app, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it. We have written it in plain language on purpose. If anything is unclear, ask us and we will explain it.

3. Information we collect

If you are a parent

• Your name and email address when you create an account
• Your password, which we store in encrypted form and cannot read
• Your subscription status and billing history, but not your card number
• Places you save, and reviews and ratings you write
• Your approximate location, only if you allow it, so the map can show what is near you. We use it to answer that request and we do not build a location history from it.

If you run a venue

• Your name, business name, email address and phone number
• Your venue's address, opening hours, description, facilities and photos
• Your plan, subscription status and billing history
• Proof of NPO registration, if you apply for a free non-profit listing

Collected automatically

• Device and browser type, operating system and screen size
• IP address, which also gives an approximate city
• Pages and venues viewed, and actions such as tapping for directions
• Dates and times of access, and referring website

We do not collect special personal information as defined in POPIA, such as health, religious or political information, and we ask you not to send it to us.

4. Children's information

Are We There Yet is a service for parents and carers, not for children. Accounts are for adults aged 18 or over, and we do not knowingly collect personal information about a child.

POPIA treats a child's personal information as a special category that generally may not be processed without the consent of a competent person. We have designed the service so that we do not need it. Please do not include a child's name, age, school, photograph or any other identifying detail in a review, a venue description, or a message to us. If you do, we will remove it. If you believe we hold information about a child, email our Information Officer and we will delete it.

5. Why we process it

POPIA requires a lawful basis for processing. Ours are as follows.

• To perform our contract with you: creating and running your account, showing your listing, taking payment, and providing support.
• Because you consented: joining our waiting list, location access, our newsletter, and any optional analytics or marketing cookies. You may withdraw consent at any time.
• For our legitimate interests: keeping the service secure, preventing fraud and abuse, understanding which features are used, and improving what we offer. We balance these against your rights and use the least information that will do the job.
• To comply with the law: keeping tax and accounting records, and responding to lawful requests.

6. Marketing and your choices

We send marketing by email only where you have asked for it, such as our monthly roundup, or where POPIA and the Consumer Protection Act otherwise permit it because you are an existing customer and we are telling you about a similar service.

We do not sell your personal information, and we do not share it with third parties for their own marketing. Every marketing email carries an unsubscribe link that works immediately, and you can also email us to opt out of everything except essential service messages such as billing and security notices.

7. Who we share it with

We share personal information only with organisations that help us run the service. Under POPIA these are our operators, and each is bound by a written agreement to process the information only on our instructions and to keep it secure.

• PayFast, as our payment provider, to take subscription payments
• Afrihost, as our hosting provider, to run the website and the app
• Our email provider, to send account emails and the newsletter
• Cloudflare, for privacy-friendly website analytics that count visits without cookies and without identifying you
• Microsoft Clarity, to see how our web pages are used through anonymous heatmaps and session activity, loaded only with your consent
• Our maps provider, when you ask for directions

We may also disclose information where the law requires it, to establish or defend a legal claim, or to protect the safety of a person. If our business is ever sold or reorganised, information may transfer to the new owner, who would remain bound by this policy.

Reviews you write are public. Your display name and the content of your review are visible to other users and to the venue.

8. Payment information

We never see or store your full card number. Card details are entered directly with our payment provider, which is PCI DSS compliant and stores them in tokenised form. We keep only what we need for accounting and support, such as the last four digits, the card type, the amount and the date.

9. Where it is stored

Personal information is stored on servers in South Africa. Afrihost hosts our website and app infrastructure locally. Some third-party providers such as our email or analytics services may process data outside South Africa. Where that is the case, POPIA permits it where there is a binding agreement or comparable protection in place, and we rely on those safeguards.

10. How long we keep it

• Waiting list details: until we launch in your area and you either sign up properly or ask us to delete them, or for 24 months if we have not launched by then, whichever comes first.
• Account information: while your account is open, and for 12 months after you close it, in case you come back.
• Venue listings: while the listing is live, and for 12 months afterwards.
• Billing and tax records: five years, as required by South African tax law.
• Reviews: for as long as they are useful to parents. On request we will remove your name from a review or delete it.
• Analytics: in aggregated form, which no longer identifies you.

11. How we protect it

POPIA requires appropriate technical and organisational safeguards. Ours include encryption of traffic in transit, encrypted storage of passwords, access limited to the people who need it, multi factor authentication on administrative accounts, regular backups, and written agreements with every operator.

No system is perfectly secure. If a security compromise occurs that affects your personal information, POPIA requires us to notify both you and the Information Regulator as soon as reasonably possible, and we will.

12. Your rights under POPIA

You have the right to:

• Ask whether we hold personal information about you, and get a copy of it
• Have information corrected if it is wrong, or completed if it is incomplete
• Have information deleted where we no longer have grounds to keep it
• Object to processing based on our legitimate interests
• Withdraw consent at any time, including for marketing and location
• Complain to the Information Regulator

To exercise any of these rights, email us at hello@arewethereyet.co.za. We will respond within 30 days. We may need to confirm your identity before acting on a request.

13. Cookies and analytics

We use a small number of cookies and similar technologies.

• Essential: keeping you signed in and keeping the service secure. These cannot be switched off.
• Preference: remembering settings such as your filters, so the app behaves the way you left it.
• Analytics: understanding which pages and venues are used, so we can improve them. Our basic website analytics (Cloudflare) use no cookies and do not identify you. Our heatmap and session-activity analytics (Microsoft Clarity) load only if you agree on the banner, and never capture anything you type. You can change your mind at any time by clearing this site's data in your browser.

You can clear or block cookies in your browser settings, though the service may not work properly without the essential ones.

14. Venues and their own data

Venues listed with us collect personal information from their own customers, in their own right. When a venue does that through its own systems, the venue is the responsible party for that information, not us. Where a venue uses our tools to handle information about parents, we act as its operator and process it only on its instructions, under a written agreement.

15. Changes to this policy

We will update this policy as the service develops. The date at the top shows when it last changed. Where a change materially affects how we handle your information, we will tell you by email or in the app rather than quietly changing the page.

16. Complaints

If you are unhappy with how we have handled your personal information, please tell us first at hello@arewethereyet.co.za. We would like the chance to put it right.

You may also complain directly to the Information Regulator of South Africa:

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Telephone 010 023 5200, or toll free 0800 017 160
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• inforegulator.org.za