Privacy policy

Welike Cape Town is a community-ranked directory of local businesses in South Africa. It is operated by Innovatech Group (Pty) Ltd (registration number 2017/044479/07), 113 Beach Road, Cape Town, 8001. We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). In this policy, "we", "us" and "our" mean Innovatech Group (Pty) Ltd.

This policy applies to every Welike Cape Town website and city site, and to the emails, WhatsApp messages and SMS messages we send. It explains what we collect, why, who receives it, how long we keep it and what you can do about it. Our cookie policy covers cookies in detail, and our terms of use cover the rules for using the service.

Our Information Officer is Cornelius Rykaart. Contact them at [email protected] or by post at 113 Beach Road, Cape Town, 8001 for any question or request about your personal information, including access, correction, deletion and objection. We may ask you to confirm your identity before we act on a request, so that we never hand one person's information to another.

When you browse, with or without an account

• A session record. While your session lasts (up to 120 minutes of inactivity), our server keeps a session record to keep you signed in and to protect forms against forgery. It holds only a keyed (HMAC-SHA256) hash of your IP address, never the address itself, and not your browser's user-agent string. The record is then deleted.
• Anonymous listing activity. Page views and clicks on a listing's contact buttons are counted against a keyed hash of your session, never against your account or your IP address, so that businesses can see how their listing performs.
• Abuse protection. Your IP address is used briefly to limit how many requests can be made, and Cloudflare Turnstile checks that sign-up and other forms are being filled in by a person. Where we keep an IP address for longer, we keep only a keyed (HMAC-SHA256) hash of it, never the address itself.
• Cookies and analytics, as set out in the cookie policy. Google Analytics and Google's advertising tags load only after you accept them in the cookie banner.
• Your location, only if you ask. If you use "near me", your device's location is used to sort results and is remembered only in your own browser.

When you create an account

• Your name, email address and password (stored only as a one-way hash).
• If you sign in with Google or Apple, the account identifier and email address that provider gives us.
• Anything you add to your public profile: display name, handle, photo, bio and home city.
• Your language, notification choices, and the security settings you turn on (two-factor authentication, passkeys).
• A keyed hash of the IP address you signed up and last signed in from, and when you last signed in.
• Which version of our terms you accepted, and when.

When you verify that you are a real person

• Phone verification. Your mobile number and a one-time code we send by WhatsApp or SMS. We store the code only as a hash, together with which channel delivered it and a keyed hash of your IP address.
• Identity verification (optional). Your South African ID number, a photo of your identity document and live selfie images. A member of our team compares them by hand. Your ID number is stored encrypted, the images are kept on private storage and deleted 30 days after upload, and every time a reviewer opens your documents, that view is logged. Selfie images are biometric information, which POPIA treats as special personal information. We process them only with your consent, which you give on the verification screen.

When you take part

• Votes. Who voted for what, and when. To detect vote manipulation, each vote is also recorded with a keyed hash of your IP address and a hash of your browser's user agent.
• Reviews, collections and your public profile. Everyone can see these, with your display name.
• Check-ins. If you check in with your location, your device's position is used at that moment to confirm you are at the business. We do not store the coordinates, only that you checked in and when.
• Saved listings, perk redemptions, reports you file and reviews you mark as helpful.

When you list, claim or advertise a business

• Business contact details: phone, WhatsApp, email and address. For a sole proprietor these can be personal information. Some of these details are suggested from Google Places and the business's own website, and a person on our team approves each suggestion before it is published.
• Claim evidence: the phone number or email address used to verify a claim, and any evidence you provide, which may include a selfie.
• Owner responses and announcements, which are public.
• Advertiser details: name, contact email and phone, and payment records. Payments are processed by Paystack or Stitch, and we never receive or store your card number.
• Our team visits businesses in person, unannounced, to vet them. Visit notes are stored encrypted, and the identity of the person who visited is never published.

Information we did not collect from you directly

• If you joined our launch list, your email address and the time you gave consent to be contacted about the launch.
• If you are a hosting client of Innovatech Group (Pty) Ltd, we may have created a Welike Cape Town account or launch-list entry for you from your existing client record. You can delete it at any time, as described under Your rights.
• Public business information from Google Places and businesses' own websites, as described above.

POPIA allows processing only for a lawful reason (section 11). Ours are:

We do not sell your personal information, and we do not use it for any purpose not listed here without telling you first.

We share personal information only with the service providers ("operators") below, and only what each one needs to do its job for us. Each processes it on our behalf.

Beyond these providers, everyone can see what you publish (reviews, public collections and your public profile). A business sees anonymous statistics about its listing. We disclose information to authorities only when the law requires it.

Some of the providers above process information outside South Africa: Hetzner in Germany, and Google, Meta, Apple, Cloudflare, Vonage and the payment providers in the United States and elsewhere. Under section 72 of POPIA, we transfer information only to recipients who are bound by law, binding corporate rules or agreements that give it protection substantially similar to POPIA (Germany, for example, is bound by the EU General Data Protection Regulation), or where the transfer is necessary to perform our agreement with you.

Deleted information can remain in encrypted backups until those backups are replaced.

All traffic is encrypted in transit. Passwords are stored only as one-way hashes. ID numbers and vetting notes are encrypted at rest. IP addresses we keep, including in session records, are stored only as keyed hashes. Staff access is limited by role, and every view of an identity document is logged. If we have reasonable grounds to believe your information has been accessed by someone unauthorised, we will tell you and the Information Regulator as section 22 of POPIA requires.

Anyone can browse Welike Cape Town, but you must be 18 or older to create an account. We do not knowingly process children's personal information. If you believe a child has created an account, tell our Information Officer and we will delete it.

Members receive a weekly email digest of what is new in their city. Every digest carries a link to unsubscribe from it in one click, with no need to sign in. Offers and news from businesses you saved are off unless you turn them on. You can change either at any time under Settings → Notifications, or by asking our Information Officer. We never sell or rent your contact details to anyone for their own marketing.

Under POPIA you have the right to:

• Access your information. Signed-in members can download a copy under Settings → Privacy. It covers everything we hold about you: your profile and linked sign-in accounts, votes and vote history, reviews and helpful marks, saved listings, collections you made or follow, check-ins, perk redemptions, reports you filed, listings you submitted or claimed, change requests, owner responses and announcements, photos you uploaded or removed, your advertiser accounts with their campaigns, adverts and payments, memberships, passkeys, verification history, phone-number appeals (yours and any made against your number), the reasons for any action we took on your account, and your launch-list entry. It leaves out identity document and selfie images, your full ID number (it shows the masked form), raw payment-gateway data, sign-in credentials, staff notes, and the identity of anyone who acted on your account; ask our Information Officer for those.
• Correct it. Edit your profile, or ask us to correct anything you cannot edit yourself.
• Delete it. Under Settings → Privacy you can delete your account permanently. Your votes are withdrawn from every ranking straight away. Reviews and owner responses you published stay visible, shown as written by a "Deleted member", because they are part of a business's public record.
• Object, and withdraw consent. You can object to processing based on legitimate interest. You can withdraw consent at any time: for cookies, through "Cookie preferences" in the site footer; for messages, in your notification settings. Withdrawing consent does not affect processing that already took place.
• Complain to the Information Regulator. If you are unhappy with how we handle your information, please tell us first so we can put it right. You may also complain to the Information Regulator (South Africa) at inforegulator.org.za or [email protected].

Rankings are calculated automatically from members' votes, and they rank businesses, not people. Votes from members with a higher verification level carry more weight. We do not make decisions about you with legal or similarly significant effect based solely on automated processing.

When we change this policy, we update the effective date at the top of this page. If a change materially affects how we use information we already hold, we will tell members by email before it takes effect.