Komweer Privacy Policy
Effective date: 13 Oct 2026 Version: p-2026-10.1
This policy explains how Komweer collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act, 2013 (POPIA). It applies to:
- visitors to our website at komweer.co.za;
- merchants: businesses that use Komweer, and their owners and staff, at app.komweer.co.za and in the Komweer merchant apps;
- customers: people who collect stamps and rewards with a Komweer card at card.komweer.co.za.
1. Who we are
Komweer is operated by Hexacon Investments (Pty) Ltd, registration number 2025/295261/07, of 41 Klopper Road, Centurion, South Africa ("Komweer", "we", "us").
- Privacy questions and requests: [email protected]
- Information Officer: Wynand Neethling, [email protected]
- WhatsApp: +27 71 493 0704
2. Our role and the merchant's role
- Komweer is the responsible party for our website, merchant accounts, billing, and each customer's Komweer account (name, contact details and verification).
- Each merchant is the responsible party for the loyalty information it holds about its own customers: membership of its cards, visits, stamps, rewards, notes and tags, and any marketing it sends. Komweer processes that information on the merchant's behalf, as an operator, under our Merchant Terms.
- A customer who uses cards at more than one merchant has a separate membership with each. Merchants cannot see each other's customers, and we do not share loyalty data between merchants.
3. What we collect
Website visitors
- Details you give us in an early-access or interest form: first name, surname, business name, type of business, town, province, mobile number, email address, number of branches and optional answers.
- If you accept analytics cookies: pages viewed, device and browser type, approximate location (town or region) and how you reached the site, through Google Analytics. We never send names, numbers, email addresses or business names to Google Analytics.
Merchants (owners and staff)
- Owner: first name, surname, email address, password (stored only as a secure hash) and two-factor authentication settings.
- Business: trading name, branch, brand colour and card settings.
- Staff: first name, surname and a 4-digit PIN (stored only as a secure hash).
- Activity records: which staff member and device issued or redeemed each stamp or reward, and when.
- Billing: plan, billing history and payment status. Card details are captured and stored by Paystack, not by Komweer.
Customers
- First name and surname.
- Mobile number and/or email address, and confirmation that you verified it.
- For each merchant card: the date you joined, stamps earned, rewards unlocked and redeemed, visit dates and times, and the branch.
- Your marketing choices for each merchant and channel (WhatsApp, SMS, email), with the date and the wording you agreed to.
- Notes and tags a merchant adds to your membership. Merchants are told not to record medical or other sensitive information.
Security information (everyone)
- Records needed to keep the service safe: PIN attempts on shop devices, verification attempts (with the number or email address being verified), single-use stamp and reward codes, sign-in sessions, and rewards that could not be confirmed after being handed over offline. We do not store IP addresses.
4. How we collect it
- From you, when you fill in a form, create an account, join a card or use the service.
- Automatically, when you scan a code, earn a stamp or redeem a reward.
- From service providers: payment status from Paystack; verification messages you send to our WhatsApp number through Meta; delivery status from our SMS and email providers.
5. Why we use it and our lawful basis
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Running Komweer: accounts, cards, stamps, rewards, staff access | Performance of our contract with you |
| Verifying your mobile number or email address | Contract, and our legitimate interest in preventing fraud |
| Detecting and preventing fraud (fake accounts, copied codes, unusual stamping) | Legitimate interest |
| Billing merchants and keeping financial records | Contract and legal obligation |
| Responding to early-access and support requests | Your request (contract) and legitimate interest |
| Website analytics | Your consent (you can decline in the cookie notice) |
| Marketing messages | Your consent (see section 6) |
| Complying with the law and lawful requests | Legal obligation |
6. Marketing
- From merchants to customers: a merchant may send you offers only if you ticked that merchant's marketing box for that channel (WhatsApp, SMS or email). The box is never ticked for you. Every message lets you opt out, and you can change your choices on your card at any time.
- From Komweer to merchants: we send Komweer news and tips only to people who opted in, or to existing merchant customers about similar Komweer services, as POPIA section 69 allows. Every message includes an unsubscribe option.
- We do not sell personal information or use it for advertising on other platforms.
7. Cookies and similar technologies
- komweer.co.za (marketing website): Google Analytics cookies, only if you accept them in the cookie notice. Advertising features, remarketing and Google Signals are switched off. Your choice is remembered on your device.
- card.komweer.co.za and app.komweer.co.za: only essential storage, to keep you signed in, remember your device and hold offline redemptions until they sync. No analytics or advertising cookies are used on these sites.
8. Who we share it with
- Merchants: each merchant sees only its own customers' memberships, visits, stamps, rewards and marketing choices.
- Service providers who process information for us under contract, only to run Komweer:
- Supabase: database, authentication and server functions
- Cloudflare: website hosting and security
- Paystack: card payments and subscriptions
- Meta Platforms (WhatsApp Business): verification and messages
- An SMS provider: SMS codes and messages (not in use yet; we will name it here before we start)
- Resend: email codes, receipts and notices
- Google: website analytics (marketing website only)
- Authorities, when the law requires it, or to protect people from fraud or harm.
- A buyer or successor, if Komweer's business is sold or restructured, under the same protections.
We never sell personal information.
9. Information sent outside South Africa
Some of our service providers store or process information outside South Africa, including the United Kingdom (London), and Google, Meta and Cloudflare servers elsewhere. We only use providers bound by laws, binding corporate rules or contracts that give a level of protection substantially similar to POPIA, as section 72 requires.
10. How we protect it
- Encryption in transit (HTTPS) everywhere.
- Strict access controls: database rules keep each merchant's data separate, and only authorised Komweer staff can access accounts for support.
- Passwords and PINs stored only as secure hashes; stamp and reward codes are signed, single-use and short-lived.
- Card payments handled entirely by Paystack; Komweer never sees or stores card numbers.
- If we believe personal information has been accessed without authority, we will notify the Information Regulator and affected people as section 22 of POPIA requires, and tell affected merchants without undue delay.
11. How long we keep it
| Information | Kept for |
|---|---|
| Website interest-form details | Up to 12 months for customers and 24 months for merchants after our last contact, unless you become a Komweer user, or until you ask us to delete them |
| Merchant account and business data | While the account is active, then 90 days after closure so you can export it, then deleted |
| Customer account | Until you delete it, or after 24 months with no activity at any merchant |
| Loyalty records for a merchant | While the merchant's account is active, unless the merchant or you delete them sooner |
| Billing and tax records | 5 years, as tax law requires |
| Verification codes, single-use stamp and reward codes, and sign-in sessions | 30 days after they expire or end |
| PIN attempts on shop devices | 90 days |
| Records of rewards that could not be confirmed offline | 12 months |
Anonymised totals, for example the number of stamps issued in a month, may be kept after personal information is deleted.
12. Your rights
You may:
- ask what personal information we hold about you and get a copy;
- ask us to correct or delete it;
- object to processing based on our legitimate interests;
- withdraw consent at any time, for example to marketing or analytics;
- complain to the Information Regulator: inforegulator.org.za">inforegulator.org.za
How: customers can export or delete their data from their card (My data). Anyone can email [email protected]. We may need to confirm your identity first, and we will respond within a reasonable time, and within 30 days where we can. Where a request concerns a merchant's records, we will pass it to that merchant or help them respond.
13. Children
Komweer is meant for people aged 18 and older. Anyone under 18 may only use a Komweer card with a parent's or guardian's permission. If we learn that we hold a child's information without that permission, we will delete it.
14. Changes to this policy
We will post any update here with a new effective date and version. If a change materially affects how we use your information, we will tell merchants by email and show a notice on the card or app before it takes effect.