Privacy Policy

The Challenger (Pty) Ltd, registration no. 2019/092803/07, of 13 Viola Road, Blouberg, Cape Town, 7441 (“we”), is the responsible party for the personal information you give us through thechallenger.co.za, WhatsApp or email. We process it in line with the Protection of Personal Information Act, 2013 (POPIA). This page explains what we collect, why, who helps us process it, and what you can ask us to do.

What we collect

• When you book: your name, email address, phone number, the service, date and time, number of participants, any extras, and notes you type. If you book for a company: the company name, VAT number and billing address, which appear on your invoice.
• When you pay: Paystack processes the payment and tells us the amount, currency, transaction reference and outcome. We never receive or store card numbers.
• When you send an enquiry form: the details you enter in the form.
• Automatically: standard web server logs (IP address, browser, pages visited) kept by our hosting provider for security, and Google Analytics and Google Ads measurement cookies that tell us how the site is used and whether our advertising works. Google reCAPTCHA is used on enquiry forms to filter automated spam.

Why we use it

• To take, confirm, change and run your booking, and to contact you about it.
• To issue invoices and keep the financial records the law requires.
• To answer enquiries you send us.
• To keep the site secure and understand how it is used.

We do not sell personal information, and we do not send marketing email. If we ever want to, we will ask first.

Who processes it for us

These providers handle data on our behalf, each only for the purpose shown:

• Paystack (Paystack Payments Ltd): online payment processing.
• Supabase: the database that stores bookings.
• Resend: sends booking confirmation emails and invoices.
• EmailJS: delivers enquiry form messages to us.
• Google: Analytics, Ads measurement, reCAPTCHA and the map on our contact page.
• Our hosting provider in South Africa: runs the website and keeps server logs.
• WhatsApp (Meta): if you choose to message us there.

Some of these providers store data outside South Africa. They are bound by their own privacy commitments and by our agreements with them.

How long we keep it

Booking and invoice records are kept for five years, as South African tax law requires. Enquiries are kept for as long as needed to answer them, normally under a year. Analytics data is retained according to Google’s settings, currently 14 months.

Your rights

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it where we do not have to keep it. You can also object to processing or complain to the Information Regulator (inforeg.org.za). To exercise any of these, email ralph@thechallenger.co.za or use the contact page. We answer within 30 days.

Cookies

The site itself sets one cookie only, for the administrator login. Google Analytics, Google Ads and reCAPTCHA set their own cookies when their scripts load. You can block cookies in your browser; the booking flow still works without them.

Security

The site is served over HTTPS. Booking data is stored in a database that is not readable from the browser, and payment details never touch our systems. Access to booking records is limited to the business owner.