Who is responsible for your information

TheCapeTownHub (thecapetownhub.com) is operated by Hub Network SA. Email: [email protected].

Under the Protection of Personal Information Act 4 of 2013 (POPIA) we are the “responsible party” for the personal information described in this notice. This notice is the information section 18 of POPIA says we must give you, written in plain language. The same notice applies to all three hub sites — TheCapeTownHub, PretoriaHub and PolokwaneHub — which Hub Network SA runs together.

Requests and questions about personal information are handled by the operator personally: email [email protected] with “POPIA request” in the subject line.

What we collect, why, and on what legal basis

POPIA (section 11) lets us process personal information only where we have a lawful basis. For everything below, that basis is one of: your consent, which you can withdraw at any time; a contract with you (for example your account or a paid plan); a legal obligation (for example keeping tax records); or a legitimate interest of ours or of the public that does not override your rights (for example keeping the site secure, or publishing a directory of businesses).

Accounts. When you register we collect your email address and a password (stored only as a one-way hash), or — if you sign in with Google — your Google account email and a Google account identifier. We use these to run your account, show you your listings and events, and send you the account and billing emails described below. Basis: contract.

Listings and claims. When you submit or claim a business we collect your name, the business name, phone number, email address, physical address, trading hours, description, photos and website or social links, and — for a claim — your role at the business and a contact phone number or email we use to verify you. Business contact details are published on the listing; that is the purpose of the directory. Your own name and the verification details are not published. Basis: contract and legitimate interest.

Claim documents. If you upload documents to prove you may act for a business (for example a letterhead or a municipal account), we store them privately so a person can review the claim. They are never published. Basis: legitimate interest in verifying who controls a listing, and your consent in uploading them.

Enquiries and contact messages. An enquiry sent through a business page, or a message sent through our contact form, is stored together with the name and email address or phone number you give, and emailed to the business (for an enquiry) or to us (for a contact message). Basis: your consent in sending it, and performance of the service you asked for.

Reviews, event submissions, reports and removal requests. We store what you submit (your display name and review text, event details and the contact details on an event, or the reason and email address on a report or removal request) so we can moderate it, publish what is meant to be public, and show what was decided. Reviews and events are published under the name you choose; reports and removal requests are not published. Basis: consent, and our legitimate interest in keeping the directory accurate.

Payments. Paid plans, sponsorship spots and featured events are paid through PayFast. PayFast collects your card or bank details on its own secure pages; card numbers never reach our systems. We receive from PayFast only a confirmation of the payment, its amount, a PayFast reference and the subscription token we need to cancel a recurring plan, and we keep an invoice naming the business and the account email. Basis: contract and legal obligation (tax records).

Technical and usage data. Our hosting provider keeps standard server logs (IP address, browser, pages requested) for security. When you send a form or view a business page we store a one-way hash of your IP address — not the address itself — so we can stop abuse (a few messages per hour per visitor) and count profile views, phone and website clicks and search appearances for the business owner’s own dashboard; the hash cannot be turned back into your IP address. Cookies and analytics are described in the Cookies tab. Basis: legitimate interest in running a secure, working website.

Where listing data comes from

Business listing data (name, location, trading contact details, hours) comes from business owners’ own submissions and from research against publicly available sources — business websites, social media pages, other directories and map services such as Google Maps — never from private or personal accounts. Where POPIA requires it, this notice is how we tell a business owner that information about their business was collected from those public sources. If a listing is yours and you want it corrected or removed, use the “Claim”, “Report this listing” or “Request data removal” links on the listing page, or email us.

If you submit a business listing or a correction, we store the contact details you provide solely to publish or verify that listing.

Who we share it with

We do not sell personal information, and we do not share email lists with anyone. We use the following service providers (“operators” under sections 20 and 21 of POPIA), each bound by its own terms to process data only on our instructions and to protect it: Cloudflare (website hosting, database, file storage, content delivery and security logs); Resend (sending our emails); PayFast (payment processing — PayFast is also a responsible party in its own right for the payment data it collects, under its own privacy policy); Google (Google Analytics, Google AdSense advertising, and optional “Sign in with Google”); and GitHub (the build pipeline that turns the directory data into web pages). The homepage weather card uses the MET Norway weather service, to which no personal data is sent.

Business owners receive the enquiries sent to their listing, including the sender’s name and contact details. We will disclose personal information where the law requires it (for example a lawful request from a court or regulator).

Transfers outside South Africa

Our servers, database, file storage, email and analytics providers store and process data in data centres outside South Africa (mainly in the United States and the European Union). Section 72 of POPIA allows this where the recipient is bound by contractual terms that give the information substantially similar protection to POPIA, where the transfer is necessary to perform a contract with you, or where you consent. Each provider above is bound by a written data-processing agreement or terms to that effect, and using the site to create an account, list a business or send a message necessarily involves this transfer. If you do not want your information processed outside South Africa, please do not use those features; you can still browse the directory.

How long we keep it

Section 14 of POPIA says we may keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires. Our retention periods are:

Account data: for as long as your account exists. Ask us to close it and we delete it within 30 days, except what we must keep as a tax record (see payments). Login sessions: 30 days, or until you log out.

Listing data: while the listing is live and for 12 months after it is removed, so we can restore a listing removed by mistake and show what was published if there is a dispute. Submissions never confirmed by the owner: deleted about 7 days after our approval if the owner does not respond to our confirmation email and reminder.

Claim documents: kept while the listing is live, as the record of who was allowed to control it, and deleted together with the listing. Once a claim has been decided you can ask us to delete the documents sooner and we will.

Enquiries and contact messages: 24 months, then deleted. Reviews: while the listing is live, or until you ask us to remove your review. Reports and removal requests: 24 months, as the record of what was reported and what we did about it. Events: removed 14 days after the event ends (an event with a payment or ownership claim attached is kept as part of that record). News articles: 90 days.

Payment and invoice records: 5 years from the end of the tax year, as section 29 of the Tax Administration Act 28 of 2011 requires. Rate-limit hashes: deleted after 24 hours. Dashboard statistics (hashed visitor id and event): 24 months. Server logs: kept by Cloudflare under its own short retention periods.

When a period ends we delete or anonymise the record. We may keep information longer where we need it to deal with a complaint, a legal claim or a request from a regulator.

How we protect it, and what happens if something goes wrong

Section 19 of POPIA requires reasonable security measures. Ours include: HTTPS for every page and API call; passwords stored only as salted one-way hashes; login sessions in HttpOnly, Secure cookies that expire; one-time email links (password reset, claim verification, unsubscribe) stored only as hashes so a copy of the database cannot replay them; card details handled entirely by PayFast; claim documents stored in private storage that is only reachable through a review link; rate limits on every public form; and access to the admin tools limited to the operator. Our providers (Cloudflare, Resend, PayFast, Google) maintain their own independently audited security programmes.

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible after discovering it, as section 22 of POPIA requires, and tell you what happened and what you can do.

Your rights under POPIA

You have the right to: ask whether we hold personal information about you, and get a copy (section 23 — we confirm free of charge and may charge the prescribed fee for copies); have it corrected or deleted if it is inaccurate, out of date, excessive or no longer needed (section 24); object to processing based on our legitimate interests, on reasonable grounds (section 11(3)); object to direct marketing at any time (section 11(3)(b)); and withdraw consent where consent is our basis for processing (section 11(2)) — withdrawal does not affect what was lawfully done before it.

To exercise any of these, email [email protected] with “POPIA request” in the subject line, or use the contact form with “POPIA request” as the topic. Every business page also has a “Request data removal” link that sends us a removal request with your reason — we review each one by hand and confirm by email once it is actioned, usually within a few days. We may ask you to confirm your identity (for example by replying from the email address on the account or listing) before we act. We respond within 30 days.

If you are not satisfied with our response, you have the right to complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; postal address P.O. Box 31533, Braamfontein, Johannesburg, 2017; POPIA complaints [email protected]; PAIA complaints [email protected]; general enquiries [email protected]; telephone 010 023 5200 or toll-free 0800 017 160; inforegulator.org.za. The Regulator publishes the complaint form on its website.

Emails we send, and how to stop them

Service emails are the emails your account or request needs and are not marketing: confirming a listing, claim or event; a password reset; an enquiry forwarded to your business; a payment confirmation; a renewal, cancellation or expiry notice; a reply to something you reported; or a notice that we have changed these terms. You receive these for as long as you have an account or an open request.

Service announcements. Occasionally (a few times a year at most) we email account holders about TheCapeTownHub itself — for example when we launch a new feature. Section 69 of POPIA lets us send these to our own customers about our own similar services, and you can stop them at any time: every announcement carries an “Unsubscribe from updates” link that takes effect immediately, or you can email us. Opting out never affects the service emails about your own account or billing.

We do not send marketing by SMS or telephone, we do not send marketing to visitors who only sent an enquiry or a report, and we never pass your details to anyone else for their marketing.

Children

The site is not directed at children. You must be at least 18 to create an account, list a business or event, or buy a plan. We do not knowingly collect personal information from anyone under 18; if you believe we have, email us and we will delete it.

Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects (section 71 of POPIA). Rate limits and spam filters act automatically on form submissions, but a person reviews every listing, claim, review, event, report and removal request before anything is published, declined or removed.

PAIA manual

The Promotion of Access to Information Act 2 of 2000 (PAIA) treats anyone carrying on a business as a “private body”, and section 51 requires every private body to keep a manual explaining what records it holds and how to ask for them. Our PAIA manual is available on request: email [email protected] with “PAIA manual” in the subject line and we will send you a copy free of charge.

Changes to this notice

If we change this notice in a way that matters we will update the date at the top and, for account holders, say so by email. The current version always lives at this web address.

Contact

Questions about this notice or your data: [email protected] (or use the contact form). POPIA and PAIA requests: the same address, with “POPIA request” or “PAIA manual” in the subject line.

Essential cookies

When you sign in we set one cookie, session, that keeps you logged in for up to 30 days (or until you log out). It is HttpOnly and Secure, contains only a random id, and is strictly necessary for the account features to work. During “Sign in with Google” a short-lived oauth_state cookie (10 minutes) protects the sign-in against forgery. Browsing the directory without signing in sets no cookies of our own.

Analytics

We use Google Analytics (GA4) to count page views and search terms in aggregate so we can see which parts of Cape Town and which categories people use. Google sets its own cookies for this (_ga and _ga_…, up to 2 years) and processes the data on our behalf outside South Africa. Analytics only runs on the live thecapetownhub.com address, never on preview or admin pages. You can opt out with Google’s browser add-on or by blocking cookies for this site.

Advertising

This site shows advertising through Google AdSense on some pages, including the pages of businesses on the free listing (never on a page where a paid plan or sponsorship is shown). Google and its partners may use cookies to serve and measure ads, including personalised ads based on your visits to this and other sites. You can view or opt out of personalised advertising at Google’s Ads Settings, opt out of third-party vendors’ cookies at aboutads.info, and read more at Google’s How Google uses information from sites that use its services.

Hosting and security

The site is served by Cloudflare, which may set a small number of security cookies (for example __cf_bm, up to 30 minutes) to tell real visitors from bots. They contain no personal information we can read.

Managing cookies

If you install the site as an app on your phone, it keeps an anonymous random device id in your browser’s local storage, used only to count app installs and opens; it is not linked to you or your account, and clearing your browser data removes it. You can delete or block cookies in your browser settings at any time. Blocking the session cookie means you cannot stay signed in; blocking the Google cookies does not affect anything else on the site. We do not use any other tracking: the only cookies we set ourselves are the essential ones above.