Privacy notice

1Who we are, and the two roles we play

Promavue (promavue.com) is operated by I-Sixty Group, a Private company registered in South Africa under number 2005/033769/07, of 26 Pretorius Avenue, Lyttelton Manor, Centurion, 0157, South Africa. Our Information Officer under the Protection of Personal Information Act 4 of 2013 (“POPIA”) is Leon Nel, reachable at support@isixty.co.za.

For organisers, we are the responsible party. When a business, agency or charity creates a Promavue account, we decide how the account details of its people are handled, and this notice describes that.

For participants, we act for the organiser. When you enter a promotion, buy a raffle ticket or spin a wheel, the organiser running that promotion is the responsible party for your details. We are their operator: we store and process your details on their instructions. The organiser’s own terms and privacy notice are shown on the entry page, and you accept them when you enter. Questions about how an organiser uses your details go to the organiser first. This notice explains what the platform itself does with them.

2What we collect about organisers

• When you sign up: your name, email address and your organisation's name. The emailed setup link is stored only as a hash and expires after 24 hours.
• Your account: name, email address, and your password, stored only as a hash. If you use an authenticator app, its secret and your recovery codes.
• Sign-in sessions: when each session started, and the network (IP) address and browser details it came from.
• Your team: the names, email addresses and roles of the people you invite.
• An audit history of actions taken in the workspace: who did what, and when.
• Plans and payments: the plans you request, start dates, and the payment reference and amount our team records when it confirms an invoice or EFT payment. There is no online card payment, so we never receive card details.
• Campaign content you add: wording, colours, uploaded logos, locations, prizes, and the email addresses you choose to receive reports.

i60 sales partners. If you came to us through an i60 sales partner, we record the partner's code against your account and share your company name, contact email and payments with i60's partner programme to pay their commission.

3What we process for organisers about participants

Organisers decide which experiences a promotion uses and which questions their entry form asks. Depending on those choices, the platform stores:

• Entries. Your mobile number (every entry form requires one) and your answers to the organiser’s other questions, such as your name or email address. The mobile number is stored in full, because the organiser needs it to contact winners. A keyed hash of it is stored too, so entry limits and duplicate checks can work without comparing numbers directly.
• Where and when you entered: the location's link you used and the time.
• Your consent record: that you accepted the organiser's terms and privacy notice, a copy of the wording you were shown, and whether you agreed to marketing messages.
• Prize wheel results: the outcome of your spin, the prize, and a winner reference.
• Raffle orders. Your name, mobile number, optional email address, the number of tickets, whether you agreed to marketing messages, and, for paid tickets, that staff confirmed payment by cash or card terminal. We do not process raffle payments ourselves. When a prize is drawn, the winner is shown on the draw screen by first name and surname initial, and prize handover is recorded.
• Activity wheels. These are anonymous. We save which option the wheel landed on and when, with no name or contact details.

SMS. Promavue does not currently send SMS messages. SMS verification of mobile numbers stays switched off until an SMS provider is set up. Before that happens, we will update this notice to name the provider.

To limit repeated or automated entries, the entry service may use a keyed hash of your network address for a short time. The address itself is not stored with your entry.

4Why we are allowed to process it

• To perform our contract with organisers. Running their account, campaigns and reports, and recording their payments.
• Legitimate interest. Keeping the service secure: sign-in records, the audit history, and limits on automated entries.
• Legal obligation. Payment and accounting records.
• On the organiser’s instructions. For participant details, the organiser’s own lawful basis applies. Their notice is shown when you enter, and they are responsible for it.

We do not use participant details for our own marketing, and we do not sell personal information. There are no advertising networks, analytics services or tracking pixels on promavue.com.

5Who sees it

• People in the organiser's team, limited by the role the organiser gives each of them. For example, a read-only viewer cannot change a campaign, and access granted for one organisation does not reach another.
• The report recipients an organiser approves. Scheduled reports are Excel files that include the entries for that period.
• I-Sixty Group platform administrators, who can access every organisation to provide support, activate plans and run the service.
• Organisations that must receive it by law, and only to the extent the law requires.

Promavue runs on I-Sixty Group’s own infrastructure in South Africa: the application server, the PostgreSQL database, and the private file storage for uploaded logos and generated reports. Apart from that, these services receive personal information:

6Information that leaves South Africa

Email is sent through SendGrid, which is operated by Twilio in the United States. That means email addresses, message content and emailed report attachments, which can include participant entries, leave South Africa. Section 72 of POPIA restricts such transfers. We rely on SendGrid’s contractual data-protection commitments (section 72(1)(a)). For messages that organisers ask us to send, we also rely on the transfer being necessary to perform their contract (section 72(1)(b)). Organisers who do not want participant entries sent by email can download reports from the workspace instead of scheduling email delivery.

7Cookies and browser storage

We use only cookies the service needs to work. None are used for advertising or analytics, so we do not ask for cookie consent.

Entry, raffle and activity-wheel pages also keep a random request key in your browser’s session storage, so a retried submission is not counted twice. It is cleared when the tab is closed.

8How long we keep it

Promavue does not currently delete records automatically. Here is what that means in practice:

• Organiser accounts, campaigns, participant entries, raffle records, payment records and the audit history are kept for as long as the organiser's account exists, unless they are deleted on request.
• Organisers record their own retention instructions in each campaign's settings. The platform does not yet apply those instructions automatically. Until it does, deletion under them is a manual task that the organiser asks our team to carry out.
• When a paid plan ends, nothing is deleted. The organiser keeps read and export access for 90 days.
• Signup and invitation links stop working when they expire. Sign-in sessions expire after 7 days.
• Backups of the database and stored files are replaced on a rolling cycle of about 30 days. Something deleted from the live service can remain in a backup until that backup is replaced.
• We cannot recall reports that were already emailed or downloaded, or copies kept on someone else's device.

9Your rights

Under POPIA you may ask what personal information is held about you, ask for it to be corrected or deleted, object to its processing, and withdraw consent you gave, including consent to marketing.

• Organisers and their team members: write to support@isixty.co.za.
• Participants: contact the organiser of the promotion, who is responsible for your details. You can also write to support@isixty.co.za. We will pass your request to the organiser and help them answer it.

We will check that a request really comes from you before acting on it. Having someone’s mobile number is not proof of identity. A request for records may also be made under the Promotion of Access to Information Act; our PAIA manual is available at [to be supplied: PAIA manual location].

If you are unhappy with how a request was handled, you may complain to the Information Regulator of South Africa at inforegulator.org.za (opens in a new tab).

10Security

• Passwords, setup and invitation links, participant entry credentials and one-time codes are stored only as hashes.
• Everyone with an organiser role that can change anything, and every platform administrator, must use an authenticator app to sign in. Read-only viewers sign in with a password.
• Access is limited by role and by organisation. Removing someone's access takes effect on their next request.
• Uploaded logos and generated reports are stored privately on the application server, not in a public web folder. The application serves them only after checking access. A logo used on a live campaign is visible to anyone who opens that campaign's page.
• Traffic to the site uses HTTPS, and the application's connection to its database is encrypted.

If a breach affects personal information, we will notify the Information Regulator and the people affected as section 22 of POPIA requires. For participant data, we will also notify the organiser responsible for it. Report a security problem to support@isixty.co.za.

11Children

Organiser accounts are for adults acting for a business, agency or charity. Organisers decide who may enter their promotions. They must not collect a child’s personal information without the consent of a competent person, as POPIA requires.

12Changes to this notice

The date at the top of this page shows the current version. We will email organisation owners before a material change takes effect. Organisers who process participant data under our operator agreement should also read our terms of service.