← Back to homepage

Privacy Notice & POPIA Policy

Operated by Wheres The Function Holdings (Pty) Ltd

1. INTRODUCTION

Wheres The Function Holdings (Pty) Ltd (“WTF Holdings”, “Where’s the Function”, “we”, “us” or “our”) respects the privacy and protection of personal information of people who use, interact with or conduct business through the Where’s the Function platform. This Privacy Notice explains how we collect, use, store, share, protect and otherwise process personal information when you:

  • use the Where’s the Function mobile application;
  • use our website;
  • create or maintain an Account;
  • browse Events or Venues;
  • purchase or access Tickets;
  • use location-based functionality;
  • communicate with us;
  • receive marketing communications from us;
  • submit Content;
  • interact with advertisements or promotions;
  • use integrated third-party services;
  • act as an Event Organiser, Venue or other Business User; or
  • otherwise interact with Where’s the Function.

    • This Privacy Notice is intended to provide information required under applicable privacy and data-protection law, including the Protection of Personal Information Act 4 of 2013 (“POPIA”). It should be read together with our Terms of Use and other applicable policies.

    2. WHO IS RESPONSIBLE FOR YOUR PERSONAL INFORMATION?

    Where Wheres The Function Holdings (Pty) Ltd determines the purpose and means of processing personal information, the responsible party is: Wheres The Function Holdings (Pty) Ltd Company Registration Number: 2026/732588/07 Registered / Physical Address: 17 Leerdam Street, Witpoortjie, Roodepoort, 1724, South Africa Privacy Contact: info@wheresthefunction.co.za Information Officer: Motheo Nqobile Matloha Information Officer Email: info@wheresthefunction.co.za General Contact Email: info@wheresthefunction.co.za Website: wheresthefunction.co.za In some circumstances, another organisation may independently determine why and how it processes personal information. In those circumstances, that organisation may be an independent responsible party rather than an operator acting solely on our instructions. The applicable role depends on the actual processing arrangement.

    3. WHAT IS PERSONAL INFORMATION?

    “Personal information” has the meaning given to it under POPIA and generally includes information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person. Depending on how you use Where’s the Function, personal information may include:

  • your name;
  • email address;
  • mobile number;
  • date of birth or age information;
  • Account identifiers;
  • location information;
  • transaction information;
  • Ticket information;
  • device information;
  • communications;
  • marketing preferences;
  • photographs or videos;
  • online identifiers; and
  • other information capable of being associated with you.

    • Technical information such as an IP address, device identifier or similar online identifier will be treated as personal information where it relates to, can reasonably be linked to, or contributes to the identification of an identifiable person.

    4. INFORMATION WE COLLECT

    The personal information we collect depends on how you use the Platform.

    4.1 Account and profile information

    When you create or maintain an Account, we may collect:

  • first and last name;
  • email address;
  • mobile number;
  • date of birth or age confirmation;
  • username;
  • profile photograph, where offered;
  • Account preferences;
  • password or authentication information in protected form;
  • communication preferences; and
  • other information you choose to add to your profile.

    • We do not intend to store passwords in readable plain-text form.

    4.2 Age and eligibility information

    Because Where’s the Function is intended for adult Users, we may collect information necessary to establish or confirm that a User satisfies the applicable minimum-age requirement. Depending on the verification method used, this may include:

  • date of birth;
  • age confirmation;
  • verification status; or
  • limited identity information where additional verification is legitimately required.

    • We will not collect copies of identity documents merely because they may be useful. Where stronger age or identity verification is introduced, the relevant collection, purpose and retention practice will be disclosed.

    5. LOCATION INFORMATION

    The intended mobile app requests permission to access device location when opened. Location permission is optional: people may search manually by city or area instead. If permission is granted, precise device location is intended to be used temporarily while the app is actively in use to identify nearby events, not for background tracking. Exact GPS coordinates are not intended to be saved to the Supabase database. General location, such as city or area, may inform event recommendations and sponsored content. Location permission can be withdrawn using device settings. Location permission does not constitute consent to personalised advertising. The developers must verify that precise coordinates are not inadvertently retained in logs, analytics or third-party SDKs.

    6. EVENT, TICKET AND TRANSACTION INFORMATION

    The planned app allows visitors to browse and search events and view event details. It does not offer a saved-events or favourites function. Users who choose to buy tickets are redirected to independent ticketing services such as Quicket or Ticketmaster, where available. The ticketing provider, not Where's the Function, handles checkout, payments, ticket delivery and refunds under its own terms and privacy notice. Where's the Function may process event searches, event views and outbound-link interactions for discovery, personalisation, aggregate analytics and security. It should not claim to collect ticket purchase details or payment credentials unless a verified integration actually supplies that information.

    7. PAYMENT INFORMATION

    Where's the Function does not currently plan to process event-ticket payments within its own app. Ticket purchases take place on independent providers' platforms. Those providers determine what payment information they collect and how they handle payments, cancellations and refunds. We do not intend to receive or store full payment-card details from those purchases. Any future direct payments or business billing arrangements must be assessed and separately disclosed before introduction.

    8. DEVICE, TECHNICAL AND USAGE INFORMATION

    When you use the Platform, we may automatically collect technical information such as:

  • device type;
  • operating system;
  • App version;
  • browser type;
  • IP address;
  • device or application identifiers;
  • language settings;
  • time zone;
  • crash information;
  • diagnostic data;
  • login information;
  • security events;
  • pages or screens viewed;
  • buttons or features used;
  • search activity;
  • session information; and
  • timestamps associated with Platform activity.

    • Where technical information relates to or can reasonably be linked to an identifiable person, we treat it as personal information for purposes of this Privacy Notice and applicable law. We may process this information to:

  • operate the Platform;
  • maintain security;
  • diagnose technical problems;
  • prevent fraud;
  • understand feature performance;
  • improve the User experience;
  • measure Platform performance; and
  • generate appropriate analytics.

    • 9. EVENT DISCOVERY AND PERSONALISATION

    Registered users' searches, event views and app interactions may be linked to their accounts to provide personalised organic event recommendations and sponsored content. Search history is intended to be retained for 12 months and event-viewing history for 24 months, subject to the deletion and anonymisation commitments in Section 23. Guests may browse without registering. Their in-session activity may personalise results during that session, but preferences are intended to reset when the app closes. Guest analytics may be retained only in genuinely anonymous form that cannot reasonably identify or be linked to a person; implementation must be verified. Clearing a visible recent-search list does not necessarily erase stored search analytics. We will explain that distinction clearly in the app. Personalisation may use general location, searches, viewed events and interactions. It must not intentionally infer or target sensitive personal characteristics unlawfully.

    10. THIRD-PARTY TRANSPORTATION INTEGRATIONS

    A future transportation feature may link users to an independent service such as Uber. Users will be redirected to that provider to arrange and pay for transportation. This feature is planned and not confirmed as live. Any data passed to a transportation provider and its independent privacy practices must be reviewed and disclosed before launch.

    11. ACCOMMODATION AND OTHER THIRD-PARTY INTEGRATIONS

    A future accommodation-discovery feature may show hotels near the location of an event the user is viewing and redirect users to an independent accommodation booking platform. The third party would handle booking and payment. This integration is planned and not confirmed as live. Any referral data shared with third parties must be assessed before implementation.

    12. EVENT ORGANISERS AND VENUES

    Where necessary to provide Ticketing or Event services, certain User information may be made available to the relevant Event Organiser or Venue. Depending on the Event and service provided, this may include:

  • User name;
  • Ticket information;
  • Ticket status;
  • booking reference;
  • admission or validation information; and
  • other information reasonably necessary to administer the Event.

    • The Event Organiser or Venue may, depending on the circumstances, process that information:

  • on our instructions as an operator;
  • in circumstances where purposes are determined jointly; or
  • independently for its own lawful purposes.

    • The applicable role depends on the actual arrangement and use of the information. Our Event Organiser & Venue Terms will impose appropriate privacy, confidentiality, security, retention, deletion and data-use obligations on Business Users receiving personal information through the Platform. Those terms will also address the handling of data-subject requests where more than one party holds or processes relevant User information. Event Organisers may not automatically use Ticket purchaser information obtained through Where’s the Function for unrelated direct marketing merely because they received it for Event administration. Any separate marketing use must have an appropriate lawful basis and comply with POPIA.

    13. USER CONTENT

    Where Users are able to upload photographs, videos, reviews, comments or other User Content, that Content may contain personal information. Content you choose to make public may be visible to other Users or third parties. Before uploading Content relating to another person, you are responsible for considering whether you have the necessary rights or permission to do so. Our rights relating to User Content are also governed by the Terms of Use and Community Guidelines.

    13.1 Public profiles and content

    Registered users may have public usernames, biographies, profile photographs and posts. Reviews are intended to appear under the relevant event listings rather than on users' profile pages. Users may post comments, ratings and reviews and delete their own posts and reviews. The developers must confirm whether deleting content removes underlying database copies and how backups and moderation records are handled.

    13.2 Reports, confidentiality and blocking

    Users may report inappropriate posts, comments, reviews, profiles or messages. Reports will be assessed by authorised human moderators. The reporter's identity will not ordinarily be disclosed to the reported person, except where disclosure is legally required or otherwise lawfully necessary. Reporting does not automatically block the reported user. Users may block another account. A blocked account should lose access to the blocking user's profile and posts through the app. Existing direct-message history remains visible to both participants, but neither can send new messages while the block remains active. Blocking cannot guarantee that public information is inaccessible through other accounts or outside the app.

    13.3 Private messaging — planned E2EE design

    The intended direct-message system uses true end-to-end encryption so ordinary message content can be decrypted only by the intended participants, not routinely by Where's the Function. This security property has not yet been independently verified and must not be advertised as live until implementation and testing are complete. The service may still process limited routing, account and security metadata. Any registered user may send a message request. The recipient can preview the initial message and accept, decline or block the sender. A declined sender may submit another request unless blocked. New-request push notifications are optional and controlled by the recipient's message-notification settings. The preview and notification design must preserve the confidentiality of encrypted content. Users may delete an individual message for themselves or for everyone, without a fixed time limit. Deleting an entire conversation removes it only from the deleting user's inbox. There is no planned automatic disappearing-message feature. Deletion cannot retract screenshots, copies or evidence already voluntarily submitted for moderation. When reporting messages, the reporter may select any number of messages from anywhere in the conversation and explicitly submit those selected messages in decrypted form as evidence. Authorised moderators may read only submitted evidence, not browse the rest of the E2EE conversation. The report interface must clearly explain what is being shared. Submitted evidence is subject to the retention rules in Section 23.

    13.4 Moderation and appeals

    Where's the Function may remove content, issue warnings, restrict accounts or permanently ban users for violations of its rules. Permanent bans may be appealed through a designated support channel and reviewed by an authorised person. The platform may retain limited identifiers to prevent banned users from immediately re-registering, where necessary and lawful.

    14. COMMUNICATIONS WITH US

    When you contact customer support, submit a complaint, request a refund, report Content or otherwise communicate with us, we may process:

  • your identity and contact information;
  • the content of your communication;
  • relevant Account information;
  • Ticket or transaction information;
  • attachments you provide; and
  • records of our response.

    • We may retain relevant communications where reasonably necessary for customer support, dispute resolution, security, fraud prevention, legal compliance or record keeping.

    15. WHY AND ON WHAT BASIS WE PROCESS PERSONAL INFORMATION

    We process personal information only where an appropriate basis recognised by applicable law exists. Depending on the processing activity, this may include processing that is:

  • necessary to perform a contract with you or take steps requested by you before entering into a contract;
  • required to comply with a legal obligation;
  • necessary to protect a legitimate interest of the User;
  • necessary to pursue a legitimate interest of the Company or a third party to whom information is supplied, subject to applicable legal requirements; or
  • based on your consent where consent is the appropriate or required basis.

    • Examples may include: Account creation and administration: processing necessary to establish and perform the service relationship with the User. Ticket purchases and Event administration: processing necessary to process the transaction, issue and administer Tickets and perform related contractual obligations. Location functionality: depending on the feature and information involved, processing may be based on User permission or consent and/or another applicable lawful basis. Device permission and POPIA lawful basis will be assessed separately where appropriate. Fraud prevention and Platform security: processing may be necessary to protect legitimate interests and/or comply with legal obligations, depending on the circumstances. Transaction and financial records: processing may be required to perform contractual obligations and/or comply with legal record-keeping requirements. Direct electronic marketing: processing will be undertaken in accordance with POPIA section 69, including consent or the applicable existing-customer provisions where their requirements are satisfied. Customer support and dispute handling: processing may be necessary to perform contractual obligations, protect legitimate interests, comply with legal obligations or establish and defend legal rights. Analytics and Platform improvement: processing will be undertaken on an appropriate lawful basis having regard to the information and technology involved. Where consent is required, it will be requested appropriately and may be withdrawn subject to applicable law. Withdrawal of consent does not retrospectively make lawful processing undertaken before withdrawal unlawful.

    Internal lawful-basis register

    In addition to this public Privacy Notice, the Company will maintain an internal processing and lawful-basis register mapping material processing activities to:

  • categories of personal information;
  • data subjects;
  • purpose;
  • applicable lawful basis;
  • recipients;
  • operator or responsible-party status;
  • international-transfer requirements;
  • retention period;
  • security requirements; and
  • applicable data-subject rights.

    • This register is intended to support accountability and the Company's ability to assess objections or other data-subject requests.

    16. INFORMATION THAT IS REQUIRED OR OPTIONAL

    Certain personal information is necessary to provide particular services. For example, we may require:

  • contact information to create an Account;
  • age information to establish eligibility;
  • transaction information to issue a Ticket;
  • payment-related information to process a purchase; and
  • identifying information to investigate certain Account, fraud or security matters.

    • Where information is optional, Users may choose whether to provide it. If required information is not provided, we may be unable to provide the corresponding service or functionality.

    17. WHERE WE OBTAIN PERSONAL INFORMATION

    We may obtain personal information:

    Directly from you

    For example when you register, purchase a Ticket, update your profile, contact us, submit Content, participate in a promotion or change your preferences.

    Automatically through use of the Platform

    For example through device information, Platform logs, cookies or similar technologies, analytics, security systems and permitted location functionality.

    From Event Organisers or Venues

    For example where information is necessary to resolve an Event issue, validate a Ticket or administer a booking.

    From service providers

    For example payment status, authentication information, fraud signals or technical information.

    From integrated Third-Party Services

    Where you expressly interact with or connect a supported integration.

    From publicly available or lawful sources

    Where appropriate and permitted by law.

    18. WHEN WE SHARE PERSONAL INFORMATION

    We do not treat personal information as a product to be indiscriminately sold. We may disclose or make personal information available where reasonably necessary to categories of recipients including:

  • payment processors;
  • cloud-hosting and infrastructure providers;
  • authentication providers;
  • communications providers;
  • Event Organisers;
  • Venues;
  • ticketing and access-control providers;
  • transportation providers;
  • accommodation or booking providers;
  • mapping and location-service providers;
  • analytics providers;
  • advertising or marketing service providers;
  • fraud-prevention and cybersecurity providers;
  • professional advisers;
  • insurers;
  • auditors;
  • regulators;
  • law-enforcement authorities where legally justified; and
  • other suppliers necessary to operate the Platform.

    • The information disclosed depends on the service involved. We seek to limit disclosure to information reasonably necessary for the relevant lawful purpose.

    19. OPERATORS AND SERVICE PROVIDERS

    Some suppliers process personal information on our behalf. Where a supplier acts as an operator under POPIA, we will require appropriate contractual, confidentiality and security safeguards applicable to that processing. Operators may process personal information only in accordance with the applicable arrangement and legal requirements. Not every third party receiving personal information is necessarily an operator. For example, a payment provider, transportation provider or Event Organiser may in some circumstances determine its own purposes and means of processing and therefore have independent responsibilities. Our vendor and integration arrangements will be assessed according to their actual processing roles rather than assigning the same classification to every provider. Before launch, material operator relationships will be documented through appropriate agreements or contractual provisions where required.

    20. INTERNATIONAL TRANSFERS

    The intended backend provider is Supabase, with the app database hosted in Europe. Accordingly, some personal information will be stored or processed outside South Africa. Other service providers may also process information internationally depending on their actual configuration. Cross-border transfers must satisfy section 72 of POPIA. Before launch, Where's the Function will verify the actual hosting region, subprocessors, access locations, contractual protections and the lawful transfer mechanism. Hosting in Europe does not, by itself, establish that every transfer complies with POPIA.

    21. DIRECT MARKETING

    We may offer Users the opportunity to receive information concerning:

  • Events;
  • Venue recommendations;
  • promotions;
  • Platform features;
  • premium services;
  • offers; and
  • other Where’s the Function products or services.

    • Electronic direct marketing will be conducted in accordance with POPIA. Where prior consent is required for unsolicited electronic direct marketing, we will seek the User's consent as required by law. Where we rely on the existing-customer provisions permitted by law, we will do so only where the applicable requirements are satisfied. Marketing communications will identify the sender as required and provide a free and reasonably uncomplicated method to opt out. Users who opt out of marketing may still receive necessary non-marketing communications relating to Accounts, security, Ticket purchases, Event changes, refunds, transactions, service administration or legal matters. We will maintain appropriate records of marketing preferences, consent where relied upon, and objections or withdrawals where reasonably necessary to demonstrate compliance.

    22. ADVERTISING AND ANALYTICS

    The intended app uses Supabase-backed event-view, search and interaction analytics to understand app use and personalise event discovery. Sponsored events and advertisements may be selected using general location, searches, event views and interests. Organisers and advertisers are intended to receive aggregate views and click statistics, not individual users' personal information. Users are intended to have a separate preference to turn promotional push notifications off while retaining ordinary service notifications. The app does not yet have a confirmed separate personalised-advertising consent or objection setting. Before launching personalised advertising, Where's the Function must assess and implement the appropriate POPIA lawful basis, notices, objection or consent mechanisms and records. Device location permission is not advertising consent. The main event-discovery website has not yet been built; website cookies and tracking must be described according to technologies actually deployed. Mobile analytics SDKs and identifiers must be assessed separately from browser cookies. Anonymous guest analytics must not use identifiers that make them reasonably re-identifiable.

    23. HOW LONG WE KEEP PERSONAL INFORMATION

    We keep personal information only for as long as reasonably necessary for a lawful purpose or as required or permitted by law, applying a documented retention schedule. Planned app-specific periods: Registered users' stored search history: 12 months; registered users' event-view history: 24 months. Anonymous guest search and event analytics are intended to follow the corresponding periods. Evidence deliberately submitted with a private-message report: up to 12 months after the report is resolved, unless longer retention is lawfully necessary for an investigation, dispute, legal obligation or proceedings. Ordinary private messages are not intended to disappear automatically. Users can delete individual messages for themselves or request deletion for everyone at any time; deleting an entire conversation removes it from the deleting user's inbox only. Actual server-side deletion, backups, offline-device synchronisation and retention of message metadata require developer verification. When a registered user deletes their account, account/profile information is intended to be deleted and any retained search or event-view records must be irreversibly anonymised so that they can no longer reasonably be linked to that person. Limited records may be retained where legally justified, including necessary ban-prevention identifiers, compliance records or moderation evidence. Such retention must be proportionate and periodically reviewed. Financial, security, support and other categories will follow documented, legally justified periods. At expiry, information will be securely deleted, destroyed or properly de-identified as appropriate.

    24. ACCOUNT DELETION

    Registered users are intended to be able to delete their accounts in the app. Ordinary account and profile data will be removed from Supabase in accordance with the verified deletion workflow. Retained search and event-view data must be anonymised, rather than merely having visible identifiers hidden. A permanently banned user may also request deletion. Where legally justified, Where's the Function may retain the minimum account identifiers needed to enforce a ban and prevent repeated misconduct, subject to access controls and retention reviews. Users may appeal permanent bans for human review. Deletion does not automatically erase material another participant has lawfully retained, or evidence submitted to a moderation report.

    25. SECURITY OF PERSONAL INFORMATION

    We take reasonable technical and organisational measures designed to protect personal information against:

  • loss;
  • damage;
  • unauthorised destruction;
  • unlawful access;
  • unauthorised processing; and
  • other security threats.

    • Measures may include, where appropriate:

  • access controls;
  • authentication controls;
  • encryption or protected transmission;
  • secure infrastructure;
  • restricted administrative access;
  • logging and monitoring;
  • backups;
  • vulnerability management;
  • security reviews;
  • vendor safeguards; and
  • incident-response procedures.

    • No information system can be guaranteed to be completely secure. We therefore maintain security measures appropriate to the nature of the information and risks involved and review them as the Platform develops.

    26. SECURITY COMPROMISES AND INCIDENT RESPONSE

    Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will respond in accordance with POPIA and applicable regulatory requirements. This may include:

  • investigating the incident;
  • containing or mitigating the compromise;
  • preserving relevant evidence;
  • assessing affected information and data subjects;
  • taking remedial security measures;
  • escalating the incident to our Information Officer;
  • notifying the Information Regulator as required; and
  • notifying affected data subjects as required.

    • Internal escalation target

    As an internal incident-response standard, suspected material personal-information security compromises should be escalated to the Company's Information Officer or designated privacy/security lead as soon as practicable and, where reasonably possible, within 72 hours of internal discovery. This 72-hour internal target is an operational escalation standard and does not replace or redefine the notification period required by POPIA. External notification will be handled according to the applicable statutory standard and regulatory requirements, including notification as soon as reasonably possible where required. Where an operator processing personal information for us experiences a security compromise, the operator must notify us in accordance with applicable law and its contractual obligations so that we can assess and fulfil our own obligations. Affected users will ordinarily be notified by email, with an in-app notification where appropriate, when notification is required. The method and timing must comply with POPIA and applicable regulator directions.

    27. YOUR RIGHTS

    Subject to POPIA and other applicable law, you may have rights to:

  • ask whether we hold personal information about you;
  • request access to personal information held about you;
  • request correction of inaccurate or incomplete information;
  • request deletion or destruction where legally applicable;
  • object to certain processing on reasonable grounds where the law permits;
  • withdraw consent where processing depends on consent;
  • object to direct marketing;
  • request that marketing communications stop;
  • lodge a complaint with the Information Regulator; and
  • exercise other rights available under applicable law.

    • Some rights are subject to statutory limitations. For example, we may be legally required to retain certain transaction or financial records even after a deletion request. Where a User objects to processing, we will assess the objection against the lawful basis and circumstances applicable to the relevant processing activity.

    28. HOW TO EXERCISE YOUR RIGHTS

    Privacy requests may be submitted to: Information Officer / Privacy Contact: Motheo Nqobile Matloha Email: info@wheresthefunction.co.za We may need to take reasonable steps to verify your identity before disclosing, correcting or deleting personal information. This is intended to prevent another person from obtaining or altering your information without authority. Where prescribed POPIA forms apply, those forms may also be used. We will respond to valid requests in accordance with applicable legal requirements. Where another responsible party, such as an Event Organiser, independently controls relevant information, we may where appropriate explain that party's role or coordinate the request in accordance with our contractual and legal arrangements. Users will be able to select Contact Privacy Support in app settings to open an email to info@wheresthefunction.co.za. Requests are overseen by Information Officer Motheo Nqobile Matloha. Identity may be reasonably verified before access or alteration of personal information.

    29. INFORMATION ABOUT CHILDREN

    The standard consumer Platform is intended for persons aged 18 years and older. We do not intentionally design the standard consumer Account service for children. If we become aware that a person under 18 has created an Account contrary to our age requirements, we may suspend or remove the Account and take appropriate steps regarding associated personal information. If future Platform functionality is intentionally made available to children, we will assess and implement the additional legal requirements applicable to processing children's personal information before introducing that functionality.

    30. SENSITIVE NIGHTLIFE INFORMATION AND INFERENCES

    Use of a nightlife and Events platform can sometimes reveal information that is more sensitive than ordinary Event-preference data. For example, a User's:

  • attendance at a particular Event;
  • photographs or videos;
  • accessibility request;
  • communications;
  • Event searches; or
  • pattern of Platform activity could, in some circumstances, reveal or be used to infer information concerning matters such as religion, health, sexual orientation or other characteristics afforded additional protection under applicable law. We will not assume that attendance at or interest in a particular Event necessarily establishes a sensitive characteristic about a User. However, where information does reveal or is deliberately used to infer special personal information, we will treat the resulting information with heightened care and apply the additional requirements of POPIA where applicable. In particular, we will not intentionally create sensitive marketing profiles based on inferred special personal information or use such information for targeted advertising unless:
  • the processing is legally permitted;
  • an applicable authorisation exists; and
  • explicit consent has been obtained where required.

    • 31. SPECIAL PERSONAL INFORMATION

    POPIA places additional restrictions on the processing of certain categories of special personal information. Where’s the Function does not intend to collect special personal information merely because it might be commercially useful. Special personal information may nevertheless arise through:

  • User Content;
  • Event activity;
  • accessibility requests;
  • support communications;
  • safety incidents; or
  • information voluntarily provided by Users.

    • Where processing of special personal information is necessary, we will determine whether an applicable legal authorisation exists and implement appropriate safeguards. Access to such information will be limited where appropriate to persons or systems requiring it for the relevant lawful purpose. Users should avoid unnecessarily including highly sensitive information in public User Content or ordinary support communications.

    32. THIRD-PARTY LINKS AND SERVICES

    The Platform may contain links to websites, applications or services not controlled by Wheres The Function Holdings (Pty) Ltd. Once you interact directly with an independent third party, that party may collect and process personal information under its own privacy notice. We encourage Users to review the privacy practices of third-party services before providing information to them. We do not control an independent third party's privacy practices merely because its service is linked or integrated through Where’s the Function.

    33. BUSINESS USERS

    If you use Where’s the Function on behalf of an Event Organiser, Venue or other business, we may process business contact and Account information including:

  • names;
  • job titles;
  • business contact details;
  • authorised-user details;
  • company information;
  • payment or settlement information;
  • Event information;
  • communications;
  • verification information; and
  • Platform activity.

    • Additional processing terms will be contained in the Event Organiser & Venue Terms or another applicable commercial agreement. Those terms will also allocate responsibilities relating to customer information, marketing, security incidents, retention, deletion and data-subject requests.

    34. CORPORATE TRANSACTIONS

    If the Company undergoes a legitimate corporate transaction such as restructuring, merger, acquisition, financing, sale of business assets or transfer of part of the business, personal information may be disclosed or transferred where reasonably necessary and permitted by applicable law. Appropriate confidentiality, security and legal safeguards will be applied where required.

    35. CHANGES TO THIS PRIVACY NOTICE

    We may update this Notice as the app develops, providers change, or legal requirements evolve. We will show the effective and last-updated dates. For material changes, we intend to notify registered users by email and in-app notification. Where additional consent is legally required, we will obtain it before undertaking the relevant processing. The effective date will be completed when the Notice is approved for publication.

    36. COMPLAINTS

    If you believe your personal information has been processed unlawfully or have concerns about our privacy practices, we encourage you to contact our Information Officer so that we can investigate. You also have the right, where applicable, to lodge a complaint with the Information Regulator (South Africa). Using our internal complaint process does not remove your right to approach the Information Regulator where legally entitled to do so. The current official contact and complaint channels of the Information Regulator will be linked from the published version of this Privacy Notice. The Information Regulator’s official website is https://inforegulator.org.za/ . Its current complaints channels should be verified at publication.

    37. RELATED DOCUMENTS

    This Privacy Notice should be read together with: Terms of Use (link to be added before publication) Ticket Purchase, Cancellation & Refund Policy (link to be added before publication) Cookie & Tracking Technologies Policy (link to be added before publication) Community Guidelines (link to be added before publication) Event Organiser & Venue Terms (link to be added before publication) Additional privacy disclosures may be provided at the point where a particular feature collects information requiring further explanation.

    38. CONTACT US

    For privacy questions, requests or complaints relating to personal information, contact: Wheres The Function Holdings (Pty) Ltd Company Registration Number: 2026/732588/07 Information Officer: Motheo Nqobile Matloha Privacy Email: info@wheresthefunction.co.za General Email: info@wheresthefunction.co.za Physical Address: 17 Leerdam Street, Witpoortjie, Roodepoort, 1724, South Africa Website: wheresthefunction.co.za © Wheres The Function Holdings (Pty) Ltd. All rights reserved.