Distinct-app Privacy Notice

Who this notice covers

This notice explains how the Distinct-app platform - DNF Financial Services (Pty) Ltd (Companies and Intellectual Property Commission (CIPC), registration 2025 / 778485 / 07) - handles personal information across its apps (Distinct-app business applications such as Rental Ease, Event Hub, and the rest of the platform). It is a company-level notice; an individual app may publish a shorter, app-specific notice for details unique to it, which this notice sits behind, not replaces. DareToFish, run by the same company, is a separate consumer product with its own notice at daretofish.com.

Our roles

Depending on the app and the information involved, Distinct-app acts in different roles:

• When a business uses a Distinct-app app to manage its own customers, staff or bookings, that business is the Responsible Party for that information under POPIA, and Distinct-app is an Operator processing it on the business's behalf and instruction.
• For account, billing, security, platform administration, and information collected directly by Distinct-app for its own purposes (such as who has a login, or platform usage logs), Distinct-app is itself the Responsible Party.

Categories of information

Depending on which app you use, we may process:

• Names, surnames, email addresses, telephone numbers
• Account and business information (login, role, business name)
• Booking, rental, event, and ticket information
• Transaction references, payment status, and invoices (never full card numbers)
• Employee/staff information, where an app is used for staff management
• Marketing preferences and communications
• Support enquiries
• IP address and device information, and security logs
• Location information, where an app's function requires it (e.g. venue locations)
• Uploaded files and photos, where an app's function requires it
• General usage information about how an app is used

Not every app processes every category above - see an individual app's own Privacy Notice for what it actually collects.

Why we process it, and on what basis

We do not treat every use of your information as consent-based. Depending on the purpose:

• Performance of a contract - creating your account, providing the app features you're subscribed to, invoicing, and customer support are necessary to provide the service you requested.
• Legal obligation - accounting records, tax-related information, and responding to lawful requests from authorities.
• Legitimate interest - security monitoring, fraud prevention, and keeping the platform working reliably, balanced against your rights.
• Consent - direct marketing communications specifically.

Marketing vs. transactional communications

A booking confirmation, receipt, waiver copy, security notice, or other message needed to deliver a service you requested is a transactional communication and is never conditional on marketing consent. Direct marketing - special offers, newsletters, event news - is sent only if you've actively opted in; that box is never pre-ticked, and opting in to one business's marketing does not opt you in to another business's marketing, or to Distinct-app's own marketing. You can withdraw consent at any time via the Data Request form.

Payment processing

Where a customer subscribes to a Distinct-app application and pays by EFT, we provide banking details for the payment and process the information needed to identify and verify that payment, including any proof of payment the customer chooses to upload.

Where a Distinct-app app uses a third-party payment provider - including Paystack South Africa (Pty) Ltd, where enabled - to process a subscription payment, information necessary to initiate, process, verify, manage and support the transaction may be provided to or collected by that provider. Depending on the transaction, this can include identifying and contact information, transaction information, and payment-related information. Distinct-app does not receive or store full payment-card details where those details are collected directly by the payment provider. See "International transfers" below and the Subprocessors page for how a payment provider fits in.

Business and payment verification

Certain features, including payment functionality, may require additional business or identity verification. Where required, a business must provide accurate and current information reasonably necessary for Distinct-app or the applicable third-party provider to enable, maintain or review the service - for example legal and trading name, contact details, business address, relevant company details, bank or settlement information, and information reasonably required for fraud, risk or compliance purposes. We don't request more than is reasonably necessary for that purpose.

Sharing information

We share information with service providers who help run the platform (hosting, database, storage, payments, email/SMS delivery) under appropriate instructions, with the relevant business you're transacting with, where required by law, or with your consent. See the Subprocessors page for the current list of providers.

International transfers

Some of our service providers process or store information outside South Africa, including Supabase (database, authentication and file storage - hosted in Sweden), Vercel (application hosting - hosted in the United States), and Resend (outbound email - processed in the United States); a shared file-storage bucket is also hosted in Western Europe. See the Subprocessors page for the full list and each provider's processing location. Where information crosses borders, we apply appropriate safeguards under POPIA section 72. If you are in the EU/EEA or UK, note that POPIA compliance does not by itself mean GDPR or UK GDPR compliance - see the app-specific notice or contact us for details relevant to your jurisdiction.

Retention

We keep information for as long as needed to provide the service, meet accounting and legal obligations, and resolve disputes, then delete or anonymise it. See the Data Retention Schedule for the current, category-by-category detail.

Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or outdated information
• Request deletion of information, where legally possible
• Object to processing
• Withdraw consent, including for marketing, at any time
• Complain to us, and if unresolved, to South Africa's Information Regulator

Submit any of these requests through our Data Subject Request form.

Security

We take reasonable technical and organisational safeguards to protect personal information, appropriate to the sensitivity of what we hold. See our Trust Centre for the specific controls we've verified; we do not claim certifications, encryption standards, or audit outcomes beyond what's stated there.

Contact and Information Officer

For privacy questions or to exercise your rights, contact privacy@distinct-app.com. Our Information Officer is registered with the Information Regulator - see the Legal hub for the current published contact details.