Privacy Policy

Last updated: 21 August 2026

This Privacy Policy explains how Datanetics (Pty) Ltd, trading as Stackd Rewards ("Stackd", "we", "us") collects, uses, and protects personal information when you use the Stackd loyalty rewards platform — whether as a business running a loyalty programme ("Tenant"), a staff member of a Tenant ("Operator"), or a customer earning stamps or points at a participating business ("Customer").

Stackd is a South African platform and processes personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).

Registered name: Datanetics (Pty) Ltd t/a Stackd Rewards
Registration number: 2019/264073/07
Registered address: 12 Carlswald Gardens, 8 Looper Street, Carlswald, Gauteng, 1686
Information Officer: CJ van Niekerk — cj@datanetics.co.za
General contact: admin@stackdrewards.co.za

1. What personal information we collect

From Customers (loyalty programme members)

When you register at a participating business's check-in page, we collect:

Contact detail — your phone number or email address (whichever you provide)
Name — first and last name
WhatsApp number, only if you opt in to WhatsApp messages
Transaction history — stamps earned, points balance, rewards redeemed, at each business you interact with
Consent records — whether you agreed to loyalty summary lookup and/or WhatsApp messaging, and when

We do not collect payment card details, government ID numbers, or biometric data from Customers at any point.

From Tenants and Operators (business accounts)

Business name, contact email, phone number, physical trading address
Staff (Operator) names, email addresses, and role
Billing information — subscription plan, invoices, and where paid via PayFast, transaction references (Stackd does not store your card number; PayFast processes and stores payment instrument details under its own PCI-DSS compliance)

Automatically collected

Standard web server logs (IP address, browser user agent, request timestamps) for security and abuse prevention
API request logs for tenants using the Stackd API, retained for 90 days, with authentication credentials and PIN codes redacted before storage

2. How we use personal information

We use the personal information described above to:

Operate the check-in, PIN redemption, and reward flows described in our FAQ and Getting Started guide
Track stamp/points progress per Customer, per Tenant
Send WhatsApp messages (stamp-card updates, "we miss you" win-back nudges, reward-ready notices) only to Customers who have explicitly opted in, per business
Process subscription billing for Tenants
Detect and prevent fraud or abuse of the platform
Comply with legal obligations (e.g. tax record-keeping for invoices)

We do not sell personal information to third parties, and we do not use Customer data for advertising outside the Stackd platform.

3. WhatsApp messaging and consent

Stackd sends WhatsApp messages through Meta's WhatsApp Business Platform, using a single platform-wide WhatsApp Business number shared across all Tenants — individual businesses do not need, and do not have, their own WhatsApp Business API account.

A Customer is only ever messaged if they've explicitly opted in, at registration or later from the check-in confirmation screen. The exact consent wording shown is: "Send me my loyalty stamp card and updates over WhatsApp. You can opt out any time."
Opt-in and opt-out are both one click, always available, and never required to use the loyalty programme itself.
Message types sent: stamp-card progress updates after a purchase, win-back nudges after a period of inactivity (only if the Tenant has this feature enabled), and reward-ready notices.
WhatsApp message content and delivery status are logged per Tenant, visible to that Tenant in their own Admin dashboard, for operational and support purposes only.
We share your WhatsApp number with Meta/WhatsApp solely to deliver these messages, subject to Meta's own Privacy Policy.

4. Sharing personal information

We share personal information only where necessary to operate the platform:

| Recipient | What's shared | Why | |---|---|---| | Meta / WhatsApp Business Platform | WhatsApp number, message content | Delivering opted-in WhatsApp messages | | PayFast | Billing contact details, transaction amount | Processing subscription and WhatsApp credit payments | | The Tenant a Customer interacts with | Name, masked contact detail, transaction/loyalty history at that business only | Operating that business's loyalty programme — a Tenant never sees a Customer's activity at a different Tenant |

Operator-facing views mask Customer contact details (e.g. j***@example.com, 082***5678) — full contact details are never shown to Operators on-screen.

We do not share personal information with any other third party for their own marketing purposes.

5. Data retention

Loyalty/transaction records (transactions, point_ledger, PIN records) are audit records and are retained indefinitely, in line with standard South African business record-keeping practice — these records are never deleted, only ever appended to.
Customer and Tenant accounts can be soft-deleted (deactivated) on request, but see the note below on erasure.
API request logs are retained for 90 days, then automatically purged.

Data subject erasure: A mechanism to fully anonymize/erase a Customer's personal information on request — while preserving the integrity of the audit-record tables above — is in active development and not yet available at the time of writing. If you would like your personal information erased, contact admin@stackdrewards.co.za and we will process this request manually in the interim.

6. Your rights under POPIA

As a data subject, you have the right to:

Request access to the personal information we hold about you
Request correction of inaccurate personal information
Object to the processing of your personal information
Withdraw consent (e.g. opt out of WhatsApp messaging) at any time, without affecting the lawfulness of processing before withdrawal
Request deletion/erasure of your personal information, subject to our legal obligation to retain certain audit records (see Section 5)
Lodge a complaint with the Information Regulator of South Africa if you believe your rights under POPIA have been infringed

To exercise any of these rights, contact us at admin@stackdrewards.co.za.

Information Regulator (South Africa) Website: inforegulator.org.za Email: complaints.IR@justice.gov.za

7. Security

We apply reasonable technical and organisational measures to protect personal information, including:

Encryption of sensitive credentials at rest (e.g. API tokens, WhatsApp Business API credentials)
PIN codes are never stored in plain text
Constant-time comparison for PIN validation to prevent timing-based attacks
Role-based access control — Operators, Tenant owners/managers, and Stackd platform administrators each see only the data appropriate to their role
Rate limiting on public-facing endpoints (check-in page, API)

No system is 100% secure, and we cannot guarantee absolute security of information transmitted over the internet.

8. Children's privacy

Stackd's loyalty programme is intended for use by adults. We do not knowingly collect personal information from children without appropriate consent as required by POPIA. If you believe a child has provided us with personal information without appropriate consent, contact us and we will take steps to remove it.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of Stackd after a change constitutes acceptance of the updated policy.

10. Contact us

Questions about this Privacy Policy or how we handle your personal information:

Email: admin@stackdrewards.co.za
Information Officer: CJ van Niekerk — cj@datanetics.co.za