1. Purpose & Compliance
We collect and process personal data in accordance with POPIA and relevant South African legislation.

2. Data Collected

• By you: name, email, phone, billing info, vCard content.

• Automatically: IP, browser, device info, cookies, analytics data.

3. Purpose of Processing

• Service delivery: hosting, subscription billing via Paystack.

• Communication: service, update, marketing emails (with opt-out).

• Improvement & security: system analytics, fraud prevention.

4. Legal Basis
Data processing is based on:

• User consent

• Contractual necessity

• Legitimate interests (e.g., security, analytics)

5. Payment Data

• Payment processing via Paystack. We never collect or store card numbers.

• Paystack complies with PCI DSS, ISO 27001, ISO 27701.

6. Data Sharing

• Service providers (hosting, payment processing) under NDA.

• Legal authorities as required by South African law.

7. Data Security

• Hosting is encrypted (TLS/SSL).

• Platform data stored securely, with access controls.

8. Data Retention

• Retained for service duration or legal compliance, whichever is longer.

9. Your Rights
Under POPIA, you have the right to:

• Access, correct, delete personal data

• Withdraw consent or object to processing

• Lodge complaints with the Information Regulator

10. Cookies
We use cookies for function, analytics, and marketing. Consent is managed via our cookie banner.

11. International Transfers
We do not transfer Personal Information outside South Africa.

12. Updates
Policy updates will be informed via email and displayed on the site, with the latest revision date.

13. Contact
For privacy matters, contact privacy@cardlyst.co.za or +27 74 673 1749.