POPIA Compliance Notice

Lawful basis

We process your personal information on the basis of your explicit, freely given consent, captured through the POPIA opt-in checkbox on every Ovitoz sign-up and waitlist form. No entry is accepted without it.

Minimality

We collect only what the Early Access requires: name, surname, mobile number, email, and the activity telemetry needed to calculate rewards. We do not collect ID numbers, banking details or medical records during Early Access.

Purpose limitation

Your information is used solely for Early Access, reward tracking, anti-fraud validation and programme communication. It is never sold or rented to third parties.

Operators and safeguards

• Cloud database and authentication providers bound by written operator agreements.
• WhatsApp Cloud API / Uchat for the Ovi Bot messaging channel.
• Health and fitness providers (Apple Health, Google Health Connect / Google Fit, Strava, Garmin) you authorise.
• Email delivery provider for account, application and partner emails.
• Affiliate networks receive only the click or campaign code needed to credit a referral, and only for External Partner Deals you choose to open. Marketing cookies load only with your consent.
• Industry-standard encryption in transit and at rest, plus row-level access policies.

Health telemetry permissions

Reward calculation relies on read-only permissions you grant through Apple Health (iOS) or Google Health / Google Fit (Android): steps, distance, active energy, heart rate and workout sessions. Heart rate is used only to band effort into zones for OVI multipliers, and workout type and duration only to convert non-step sports into step equivalents. Ovitoz never writes to your health platform and reads no clinical or medical categories. Permissions are revocable at any time in your device settings.

Non-commercialisation guarantee

Health telemetry is processed strictly for token allocation and anti-cheat verification. It is never sold, rented, licensed or shared with advertisers, insurers or credit providers, and is not used for profiling beyond reward calculation and fraud detection. Partners receive aggregated, de-identified metrics only, maintaining 100% compliance with South African privacy laws.

Your mobile number as master key

Your +27 mobile number links your web, app and WhatsApp identity into a single profile. It is stored uniquely, never displayed publicly on leaderboards, and only the last four digits are used for voucher fallback verification.

Data subject participation

To access, correct, delete or port your information, or to withdraw consent, email privacy@ovitoz.co.za. We respond within 30 days. You may also complain to the Information Regulator (South Africa).