DRAFT FOR JUSTIN'S REVIEW. A template, not legal advice. Replace every [PLACEHOLDER], confirm it matches how the website and app are actually built, register the Information Officer with the Information Regulator, and have a POPIA-savvy attorney review it before publishing.

1. Who we are

Wax & Wine ("we", "us", "our") is a Western Cape cellar-door membership made up of the website waxandwine.co.za, the Wax & Wine web app and the farm portal. Wax & Wine is a trading name of Premium Delivery Bike Rentals. It is operated by Premium Delivery Bike Rentals (registration number 2025/694758/07), of [PLACEHOLDER: physical address], South Africa. We are the "responsible party" for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

Information Officer: [PLACEHOLDER: name], [PLACEHOLDER: email], [PLACEHOLDER: phone]. Deputy Information Officer (if any): [PLACEHOLDER].

2. Who can use Wax & Wine

Wax & Wine promotes visits to wine farms, so it is for people aged 18 and older only.

• Website: an age confirmation asks whether you are 18 or older. If you answer "No", you cannot enter the site. We store your answer on your device (see section 9), not on our servers.
• App: you give your date of birth when you register and we refuse anyone under 18.
• We do not knowingly collect information about anyone under 18. If we learn we have, we delete it.

3. What we collect

We do not collect ID numbers or special personal information (such as health or religious beliefs). Please don't include it in notes, photos or messages.

4. Why we use it (lawful basis, POPIA section 11)

• Launch and Plus waitlists: to tell you when the app or Plus is available, by the channels you chose (consent).
• Farm enquiries: to reply, arrange a demo and onboard the farm (steps requested by the farm before a contract; legitimate interest).
• Contact messages: to answer you (legitimate interest).
• Running your account and membership (contract).
• Checking your age (legal obligation and legitimate interest; alcohol-related marketing is for adults only, in line with the Liquor Act and the DF-SA and Aware.org code).
• Recording a check-in and stopping abuse (legitimate interest): one visit per farm per day, and fraud checks. Your phone's location confirms you're within 500m of the estate. We store the estate, the time and the distance, not your location history.
• Route notes (contract, and consent for photos).
• Letting farms run deals and see results (contract and legitimate interest; see section 5).
• Billing Plus (contract).
• Improving the service (legitimate interest; basic, aggregated analytics).
• Marketing (consent only, section 69 of POPIA): see section 6.

5. What we share with wine farms

When you visit a participating farm ("partner estate"), that farm can see: your first name and tier; that you checked in, when, and that you were within 500m; any spend recorded there; deals you redeemed there; and Route notes about that farm.

Farms see information about visits to their own farm only. They cannot see your activity at other farms, your date of birth, your email or cellphone number, unless you give separate, specific consent (for example to join that farm's wine club). Farms may also see aggregated, non-identifying insights (for example visit numbers by week).

Launch-waitlist, contact and Plus-waitlist details are never shared with farms.

6. Marketing, email, WhatsApp and SMS

• We send marketing only if you tick the box for that channel. Email and WhatsApp/SMS are separate choices. Boxes are never pre-ticked.
• We record what you agreed to, the wording you saw, and the date and time.
• Every email has an unsubscribe link; every WhatsApp or SMS tells you how to opt out (for example reply STOP). You can also email hello@waxandwine.co.za.
• WhatsApp messages are sent through the WhatsApp Business Platform (Meta) and SMS through [PLACEHOLDER: SMS provider, e.g. Clickatell or BulkSMS]. Email is sent through [PLACEHOLDER: email provider].
• Service messages (sign-in codes, receipts, account notices) are not marketing.

7. Operators (service providers)

We use operators that process information for us under written agreements requiring security and confidentiality (POPIA sections 20 and 21):

• Supabase (database, sign-in, file storage), hosted in Ireland (EU, eu-west-1).
• Website and app hosting: Cloudflare (global network).
• Analytics: [PLACEHOLDER: e.g. PostHog / none], [PLACEHOLDER: region].
• Email: [PLACEHOLDER]. SMS: [PLACEHOLDER]. WhatsApp: Meta Platforms (WhatsApp Business Platform).
• Payments for Plus: [PLACEHOLDER: e.g. PayFast / Paystack / Peach Payments].
• Interim forms (if used before our database is live): [PLACEHOLDER: e.g. Google Forms/Sheets, Formspree or Tally].
• Google, if you choose Sign in with Google.

We don't sell your personal information. We may disclose it where the law requires.

8. Information sent outside South Africa (POPIA section 72)

Some operators store or process information outside South Africa, including [PLACEHOLDER: list countries/regions, e.g. the EU, UK, USA]. We only transfer it where the recipient is subject to a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA, or where you have consented, or where the transfer is needed to perform our contract with you.

9. Cookies, local storage and analytics

• Essential: we store your age-gate answer, sign-in session and basic settings on your device (local storage or cookies). Without these the site and app don't work properly.
• Analytics: [PLACEHOLDER: describe tool, or "we do not use analytics cookies"]. Where analytics uses cookies or similar identifiers that are not essential, we ask first [PLACEHOLDER: confirm whether a consent banner will be used].
• We do not use advertising or cross-site tracking cookies, and we do not show general ads.
• You can clear local storage and cookies in your browser at any time.

10. Route notes are visible to other members

Route notes is a members-only page, not a social network. Notes and photos are visible to other signed-in members and to the farm they're about. Only post photos of people who are 18 or older and agreed to be shown. You can delete your notes at any time.

11. How long we keep it

• Launch waitlist: until the app has launched and we've sent the launch messages you agreed to, then [PLACEHOLDER: e.g. 12 months] unless you create an account or opt out sooner.
• Plus waitlist: until Plus launches plus [PLACEHOLDER: e.g. 6 months].
• Farm leads that don't become partners: [PLACEHOLDER: e.g. 24 months] after last contact.
• Contact messages: [PLACEHOLDER: e.g. 12 months] after the matter is closed.
• Accounts, points ledger and visits: while your account is open, then [PLACEHOLDER: e.g. 12 months] after you close it, unless law requires longer (for example tax records for Plus payments, kept for 5 years).
• Consent records: as long as we rely on the consent, plus [PLACEHOLDER].
• Analytics: [PLACEHOLDER: e.g. 12 months].
• When you close your account we [PLACEHOLDER: delete or anonymise] your ledger rows so they no longer identify you.

12. How we keep it safe

Row-level access controls (members see only their own data; farm users only their own farm; admins only what they need), encrypted connections, and limited internal access. If a security compromise affects you, we will tell you and the Information Regulator as POPIA section 22 requires.

13. Your rights

Under POPIA you can: ask what we hold about you and get a copy; ask us to correct or delete it; object to processing based on legitimate interest; withdraw consent at any time (for example to marketing); opt out of direct marketing; and close your account. Contact the Information Officer at [PLACEHOLDER: email]. We will respond within [PLACEHOLDER: e.g. 30] days. Requests may also be made using the forms prescribed under POPIA and PAIA; our PAIA manual is at [PLACEHOLDER: link].

If you're unhappy, you can complain to the Information Regulator (South Africa): https://inforegulator.org.za, complaints.IR@inforegulator.org.za.

14. Changes to this policy

We'll post updates here with a new date and tell you in the app or by email before material changes take effect.

15. Contact

Wax & Wine is a trading name of Premium Delivery Bike Rentals. [PLACEHOLDER: address], hello@waxandwine.co.za, [PLACEHOLDER: phone].

Checklist before publishing (delete before going live)

• [ ] Fill in every [PLACEHOLDER].
• [ ] Register the Information Officer on the Information Regulator's eServices portal.
• [ ] Confirm the Supabase region, hosting, analytics, email, SMS, WhatsApp and payment providers actually used.
• [ ] Confirm the 500m self check-in and update section 3.
• [ ] Decide delete vs anonymise for the ledger.
• [ ] Sign an operator / data-sharing agreement with each pilot farm.
• [ ] Prepare a PAIA manual.
• [ ] Attorney review.