What we know about you

Who we are

[Registered company name] (Pty) Ltd, trading as Blazeverse, is the responsible party for the personal information described here. We run a marketplace connecting people who want their hair done with independent stylists and barbers, and independent sellers of hair products.

Our Information Officer is [Full name], Information Officer, reachable at privacy@blazeverse.co.za.

What we collect, and why

We ask for as little as the job needs. Different things are collected for different reasons, and we do not reuse them across purposes without telling you.

• Your phone number — to create your account and sign you in. It is how we identify you, because a phone is the one thing everyone in this market has.
• Your name — so a Blazer knows who they are meeting, and you know who is coming.
• The address of an appointment — so we can send someone to it, and work out travel. We keep the suburb; we do not share your street address with anyone but the Blazer who accepted your booking.
• Bank account details, for Blazers and Sparkmakers only — so you can be paid. Encrypted before storage.
• ID or passport number, for Blazers and Sparkmakers only — to verify you are who you say you are, and so there is a real identity behind someone entering a stranger’s home. Encrypted, and every time a staff member reads one it is logged.
• Vetting documents — ID photographs, certificates, police clearances where you provide them.
• Safety contacts you choose to add — their name and number, so we can tell them when an appointment starts and finishes.
• Booking, payment and message records — to run the service, settle money, and resolve disputes.

People you add who are not our users

If you add a safety contact, we hold that person’s name and number even though they never signed up. We do this because you asked us to, and because someone knowing where you are is a real safety benefit — but they did not agree to it, so we limit it carefully.

The first message they receive explains who added them and why. They are told the suburb and the time, never your street address — unless you raise an emergency alert, when they are given everything and told to call 10111. They can reply STOP at any time and we will never message them again, from any account.

When someone is turned away

If you enter an address we do not cover, we record the coordinate, what the map called that place, and the time. Nothing that identifies you: no name, no number, no account, no device or IP. That record is how we decide where to open next.

If you separately choose to leave your number so we can tell you when we arrive, that number is used for that and nothing else.

Who else sees it

We do not sell personal information, and we do not share it for anyone else’s marketing.

• The Blazer or Sparkmaker you are dealing with — the minimum they need to do the job.
• Our payment provider, to take payment and pay Blazers.
• Our messaging provider, to deliver SMS and WhatsApp messages.
• Verification providers, where we use one to confirm an identity document.
• Our hosting provider, which stores the database.
• The police or a court, where the law requires it or where someone’s safety is at stake.

Where it is kept

Some of our service providers process personal information outside South Africa. Section 72 of POPIA permits this where the recipient is bound by a law or agreement giving comparable protection, and we put agreements in place on that basis.

TO CONFIRM before launch: name your hosting country and list your processors here. A privacy notice that is vague about where data physically sits is the one people complain about.

How long we keep it

Only as long as the reason for having it lasts, unless a law says longer.

• Account and booking records — while your account is open, and then as long as we may need them for a dispute or a tax obligation.
• Vetting documents — for the period stated when you upload them, then deleted, unless a live investigation requires us to hold them.
• Safety contacts — until you remove them or close your account.
• Anonymous coverage records — indefinitely, because they identify nobody.

Your rights

Under POPIA you may ask us what we hold about you, ask us to correct it, ask us to delete it where we have no lasting reason to keep it, and object to a particular use.

Write to privacy@blazeverse.co.za. We answer within 30 days. To make a formal request for records, use the PAIA process on our PAIA page.

If we handle it badly, you can complain to the Information Regulator (South Africa) at enquiries@inforegulator.org.za. You do not need our permission and you do not need to go through us first.

Security

ID numbers and bank account numbers are encrypted before they are stored. Access to identity documents is restricted to the vetting team and every read is written to an audit log. Traffic to the site is encrypted in transit.

No system is perfect. If personal information is compromised in a way that could cause you harm, we will tell you and the Information Regulator, as POPIA requires.