Privacy notice

Who this notice covers

Perka is based at 1 Kingfisher Drive, Randfontein, Gauteng, 1755, South Africa and provides event guides, visitor accounts, and organiser and vendor workspaces at joinperka.com. This draft covers information used to provide those services. The legal person operating the trading name Perka still needs confirmation before this notice becomes effective.

Information Officer: Dip Rawal. Send privacy questions to legal@joinperka.com or the business address above. Event organisers also use information for their events. Their identity, contact details, and applicable privacy information must be provided for each live event. The final notice will identify responsibility for platform accounts, event administration, and marketing separately.

Information used by the app

We collect the details you enter and create records when you sign in, register, save a vendor, change a preference, or use an assigned workspace.

• Account: email address, account identifier, verification and sign-in/session information. A display name supplied during sign-up may also be held with the account.
• Software purchases: purchaser account and email, event, selected package, order and payment references, ZAR amounts, payment status and confirmation times. Payfast receives the account email, order details and payment instructions to process payment. Perka stores a provider subscription token for recurring billing, not a card number or CVV. Billing records support activation, reconciliation, support, refunds and dispute handling; see Payment methods and security.
• Google sign-in (optional): if you choose Continue with Google, Google shares your name, email address, Google account identifier and, where your profile has one, a profile picture link. Perka uses the name only to pre-fill the registration form, where you can change it. Perka does not receive your Google password, contacts, or other Google account content.
• Event registration: name, event identifier, registration time, privacy acknowledgement/version, and optional marketing choices with server-recorded times and versions.
• Saved makers: the event and vendor identifiers you save to your account.
• Organiser and vendor workspaces: assigned access, submitted business descriptions, products, offers, uploaded images, and records of administrative changes and exports. Invitations record the invited email address, who sent them, and when they were accepted; invitation emails are sent through our email delivery provider (Resend).
• Requests and infrastructure: information you include when contacting us, plus any operational logs and backups held by the production services. Their exact scope and retention remain to be confirmed.
• Error reports: when something fails, Perka records a short technical entry in its own database (the error message, the page or route without its query string, and when and how often it happened). Email addresses, identifiers and sign-in tokens are removed from the message first, and the entry does not record who you are, your IP address, cookies or what you entered. Platform administrators see these entries to fix faults. Entries are deleted after 30 days without a repeat.
• Competitions (where offered): your entries, any answer you give, your rules acceptance and age confirmation, and draw results. Organisers see entrants' names and email addresses to run the draw and contact winners.
• Event check-in (where offered): a random pass code linked to your registration, and the time staff scan your pass or check you in, with the staff account that did it. Organisers see and can export check-ins.
• Notifications (optional): if you turn them on, your browser's push address and encryption keys for this event, and the updates the organiser sends. Your browser's push service (for example Google, Apple or Mozilla) delivers them; message content is encrypted to your device.
• Personal agenda (where offered): the event sessions you save, so your agenda appears when you sign in on another device.
• Tickets (where offered): the free ticket you claim, its type, a ticket reference and when it was issued. Organisers see ticket counts and, at check-in, each visitor's ticket type. Tickets bought through an organiser's own ticket seller are handled by that seller under its terms; Perka does not receive payment details.
• Networking (optional, where offered): if you join, the role, organisation, short biography and link you add, shown with your event registration name to other attendees of that event who have also joined. Your email address is not shown. We record your choice to join or leave with the notice version. Contacts you save are visible only to you.
• Polls and questions (where offered): your poll votes, kept so you vote once and shown only as totals; the questions you ask, your choice to ask anonymously, and the questions you vote for. Attendees see your name with your question unless you ask anonymously; organisers always see who asked so they can moderate.
• Exhibitor lead capture (where offered): when an exhibitor scans your entry pass, a request is recorded. Nothing is shared unless you choose Share in the app; sharing gives that exhibitor your event registration name and email address, plus your networking role and organisation if you have a networking profile. Your choice is recorded with the time and notice version, and you can stop sharing later. Exhibitors who have already downloaded your details keep their copy and are responsible for it.
• Stamp trail (where offered): the stalls where you collected stamps, when, your reward code, and when it was redeemed.

Why information is used

Account details support email verification, sign-in (by email code or Google), and access control. Registration information connects you to an event. Saved vendor identifiers allow your saved makers to appear when you sign in on another device. Workspace records support publishing, approval, access management, and accountability.

An email address is needed to sign in, whether by email code or through Google. Google sign-in is optional; email sign-in remains available. A name and privacy acknowledgement are required for the current event-registration flow; marketing permission is optional. Without the required details, that flow cannot complete. Reading this notice does not give unlimited permission to use your information.

The final notice must specify the applicable processing ground for each purpose. Marketing choices are separate from providing the account and event service.

Organisers, vendors, and service providers

Authorised organisers can view event registrations and export names, current account email addresses, registration details, and privacy/marketing evidence. The app offers both an all-registrations export and a filtered marketing-opt-in export. Appearing in an administrative export does not itself mean you agreed to marketing.

Vendor workspace access does not provide access to the organiser's visitor registration reports. Registering for an event is not a general permission to distribute your details to vendors.

Supabase provides authentication and the database. Cloudflare R2 stores uploaded event and vendor images (earlier uploads remain in Supabase Storage). Browser push services deliver notifications to visitors who turn them on. The final production provider list must also identify hosting and email delivery, locations, and arrangements for any processing outside South Africa. Do not assume that all information stays in South Africa.

If you choose Google sign-in, Google confirms your identity under its own terms and privacy policy, and knows that you signed in to Perka. Google's sign-in screen may currently show Perka's authentication provider address rather than joinperka.com. You can remove Perka's access in your Google account settings; this stops future Google sign-in but does not delete your Perka account or event registrations.

An organiser's downloaded copy is outside the app's automatic update and removal process. Requests concerning those copies need to be addressed with the organiser as well as Perka.

Marketing choices

The marketing choice is optional and unchecked by default. You can change your event preference in your profile. The current app sends sign-in emails and does not include a marketing-message sending service.

Before marketing starts, the sender, communication channel, topics, and withdrawal process must be specified. Separate permissions are needed where separate senders or purposes require them. An app preference change does not automatically update a previously exported mailing list.

• Information Regulator guidance on direct marketing

Retention and removal

Removing an event registration currently deletes that registration, its saved makers, agenda, ticket, check-in, networking profile and saved contacts, poll votes, questions, stamps and reward, exhibitor sharing choices, and its associated consent records in the application. An exhibitor's downloaded copy of shared details is not affected. Leaving the network on its own deletes your networking profile and removes it from other attendees' saved contacts. Your sign-in account and registrations at other events remain. Event records otherwise remain until removal; an event ending does not currently trigger automatic deletion.

Deleting your whole Perka account removes the sign-in account and every event registration with everything listed above, plus your terms acceptances and data requests. Perka keeps a deletion record holding only a one-way hash of the email address, so the deletion can be confirmed later and repeated if a backup is restored.

Software billing records are separate: order and payment records can remain after account deletion for reconciliation, refunds, disputes and lawful recordkeeping, including the email and payment references recorded with the order. Purchase-policy acknowledgements remain attached to the order with the account link removed. The final retention schedule must specify and implement the required periods for these financial records.

The retention schedule for accounts, registrations, evidence, audit logs, backups, support correspondence, and exported copies is not yet agreed. It must be completed and implemented before this notice is final. Removal from the live app must not be described as immediate erasure of every backup or organiser-held copy.

Your rights and enquiries

Subject to applicable law, you may request access or correction, object to processing, withdraw marketing permission, and request deletion. We may need proportionate identity verification and must consider any lawful reason to retain information. A full-account deletion request is different from leaving one event.

Email legal@joinperka.com with your account email, relevant event, and the request. Do not send passwords, sign-in codes, or identity documents in your initial message. You can also download a copy of your data, send a request, or delete your whole account at Your data (/account/data).

• Data rights and practical steps
• Information Regulator: POPIA information and complaints

Browser storage and changes

Authentication uses session cookies. The installed web app also caches selected images, icons, and a reconnect page. While you are signed in, the event app keeps a copy of your account for that event on your device so it works without signal (see Cookies and storage). Perka collects aggregate event visits, vendor profile views and offer impressions. It uses a random per-tab, per-event, per-SAST-day token in session storage to avoid counting refreshes twice. Activity collection does not send account identifiers, names, email addresses, IP addresses or search text in its analytics payload. Hosting and provider operational logs still need production verification.

This draft has an update date and version. Final documents will need a published effective date and a process to communicate material changes. Existing privacy acknowledgement records refer to the notice version shown during registration, not this draft.

• Cookies and storage
• Payment methods and security