Organiser and Admin Privacy Policy

1. Who We Are and Who This Policy Covers

Bookaroo is operated by FlowIQ (Pty) Ltd, registration number 2025/503612/07. This Policy applies to organisers, authorised representatives, venue and client administrators, staff users and other people who access the Bookaroo organiser portal.

FlowIQ is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information of organiser personnel that it processes to administer the Organiser Agreement, provide access to the Platform, support users and protect the service.

This Policy is separate from Bookaroo's customer-facing Privacy Policy. For Customer information collected in connection with an organiser's Events, Tickets, Products and Add-ons, the organiser is the responsible party and Bookaroo acts as its operator under the Organiser Agreement.

2. Contact Details

General support: support@bookaroo.co.za

Information Officer: Jonathan Nel at legal@flowiq.africa

Website: https://bookaroo.co.za

3. Information We Collect

Identity and Contact Information

• name, email address and phone number;
• job title, role and organisation;
• authorised representative and authorised person details; and
• support and business correspondence.

Account and Security Information

• account status, workspace membership, role and permissions;
• authentication, multi-factor authentication and trusted-browser status;
• login activity, IP address, browser and device information;
• security events, audit records and timestamps; and
• a phone number enrolled for WhatsApp sign-in verification, if you choose that method.

Agreement and Service Information

• organisation, billing and commercial configuration information;
• the Acceptance Record and records relating to the Organiser Agreement;
• events and configurations created or managed through your account;
• admin actions, operational notes and support requests; and
• technical and usage information needed to operate and improve the organiser portal.

Payment card and bank account details used for payment processing are captured and processed by the applicable Payment Provider, not by Bookaroo.

4. How We Use Organiser User Information

We use this information to:

• administer and evidence the Organiser Agreement and Acceptance Record;
• create accounts, verify authorised access and apply permissions;
• provide the Platform, onboarding, billing, support and operational notices;
• authenticate users and protect accounts, Customers and the Platform;
• investigate errors, misuse, fraud and security incidents;
• maintain audit records and comply with applicable legal obligations; and
• understand and improve the organiser portal and our support services.

Depending on the purpose, processing may be necessary to perform or administer the Organiser Agreement, comply with a legal obligation, pursue a legitimate interest permitted by law, or act on your consent. Where we rely on consent, you may withdraw it, but this does not affect processing that was lawful before withdrawal.

5. Customer Information on the Platform

Customer, attendee, booking, Product and Add-on information available to an organiser is controlled by that organiser. Bookaroo processes it only to operate the Platform and provide the contracted services, on the organiser's documented instructions and for no other purpose.

Bookaroo does not sell this information and does not use it to train, develop or improve any model, product or service. Organiser users may access and use it only for authorised, lawful and disclosed purposes connected with the relevant Event or Order.

Where an organiser configures collection of dietary, allergy, health, religious or other special personal information, the specific controls, consent requirements and allocation of responsibility in the Organiser Agreement apply.

6. Who We Share Information With

Information may be shared with:

• authorised users within the relevant organiser workspace, according to permissions;
• Payment Providers and providers of hosting, infrastructure, authentication, email, messaging, analytics, security and support services;
• professional advisers where reasonably necessary; and
• courts, regulators, law-enforcement bodies or other recipients where disclosure is required or permitted by law.

Service providers receive only the information needed to provide their services and are subject to appropriate confidentiality and data-protection obligations. Bookaroo does not sell personal information for another party's independent marketing.

7. Processing Outside South Africa

Some service providers process information outside South Africa. Where section 72 of POPIA applies, we use a permitted transfer basis, including a binding agreement that requires an adequate level of protection where appropriate.

If a Customer requests operational WhatsApp messages, those messages are transmitted through the WhatsApp Business service operated by Meta outside South Africa. Bookaroo uses the Customer's mobile number for those requested operational messages and not for direct marketing. The organiser must describe that transfer in its customer privacy notice, as required by the Organiser Agreement.

8. Cookies and Similar Technologies

The organiser portal uses strictly necessary cookies and similar technologies for authentication, session management, workspace routing, security, multi-factor authentication and trusted-browser functionality. Disabling them may prevent the portal from working correctly.

Optional analytics technologies are used only where permitted by your cookie choice. You can change that choice at any time.

9. Retention

Organiser user information is kept only for as long as needed to provide and secure the Platform, administer and evidence the Organiser Agreement, comply with a lawful retention requirement, or establish, exercise or defend a legal claim. The applicable period depends on the information and its purpose.

Customer special personal information collected through an organiser-configured checkout question is deleted from the Bookaroo Platform 30 days after the Event. The organiser is responsible for any exported copy and must delete it when it is no longer needed for the purpose stated at checkout.

On termination, Customer information is returned or deleted as required by the Organiser Agreement, unless Bookaroo is required by law to retain it.

10. Your POPIA Rights

Subject to POPIA and other applicable law, you may ask whether FlowIQ holds your personal information, request access to it, ask for inaccurate information to be corrected, or ask for information that FlowIQ is no longer authorised to retain to be deleted. You may also object to certain processing on reasonable grounds and object at any time to direct marketing.

Send a request concerning your organiser or admin account to legal@flowiq.africa. We may ask for information needed to verify your identity before acting on a request.

Requests relating to Customer or attendee information should be directed to the relevant organiser as responsible party. Bookaroo will assist the organiser as set out in the Organiser Agreement.

11. Security and Compromises

Bookaroo uses appropriate, reasonable technical and organisational measures to protect personal information. Organisers must manage user access, protect credentials and secure all exports, reports, screenshots and offline copies taken from the Platform.

If Bookaroo becomes aware of a compromise involving Customer information processed as an operator, it will notify the organiser immediately and in any event within 24 hours, as contractually agreed. POPIA does not prescribe that 24-hour period. The organiser, as responsible party, is responsible for notifications to the Information Regulator and affected data subjects, with Bookaroo's reasonable assistance.

Where FlowIQ is the responsible party for the affected information, it will handle any required notification in accordance with POPIA.

12. Direct Marketing

We send electronic direct marketing only where you have consented or where applicable law permits us to contact an existing customer about our own similar services and you were given a reasonable opportunity to object. You can unsubscribe using the link in the message or by contacting us. Operational, contractual and security notices are not direct marketing.

13. Changes to This Policy

We may update this Policy when our organiser services or processing practices change. We will post the updated version with a new effective date and provide additional notice where a material change warrants it. This Policy does not amend the Organiser Agreement.

14. Complaints

Please send privacy concerns to the Information Officer at legal@flowiq.africa. You may also lodge a complaint with the Information Regulator of South Africa:

• Email: POPIAComplaints@inforegulator.org.za
• Telephone: 010 023 5200 or 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: https://inforegulator.org.za