Legal
POPIA Compliance
Protection of Personal Information Act 4 of 2013 — Last updated 1 May 2026
Loyalty Engine is designed to be POPIA-compliant by default. Member pseudonymisation, right-to-erasure, and lawful-basis tooling are built into the core API.
Our commitment
Yoyo Group is committed to complying with the Protection of Personal Information Act 4 of 2013 (POPIA). We have appointed an Information Officer responsible for ensuring compliance across all products including the Loyalty Engine API.
Roles under POPIA
When you integrate Loyalty Engine into your product, you are the Responsible Party — you decide why and how your customers' personal data is processed. Yoyo acts as the Operator — we process data only on your documented instructions. This relationship is formalised in our Data Processing Agreement (DPA).
What personal information we process
The Loyalty Engine processes: member external references (typically your internal customer ID or a hashed identifier), optional display names and contact details if you choose to send them, transaction metadata (amounts, timestamps, items), and points balances. We strongly recommend using pseudonymous identifiers (hashed phone numbers, UUID-mapped IDs) as external references to minimise personal data exposure.
Lawful basis for processing
You must have a lawful basis under POPIA section 11 before sending us your customers' personal information. Typical bases include: performance of a contract (the loyalty programme your customer enrolled in), legitimate interest (providing personalised rewards), or explicit consent. You are responsible for obtaining and recording this basis.
Right to access (section 23)
Your customers have the right to request a copy of their personal information that you hold. Loyalty Engine exposes GET /members/:id so you can retrieve a member's full data record to fulfil access requests.
Right to erasure (section 24)
Your customers have the right to request deletion of their personal data. Loyalty Engine provides DELETE /members/:id which anonymises all personally-identifying fields (name, email, phone, external reference) while retaining anonymised transaction totals for financial audit purposes. This satisfies the POPIA right to erasure while preserving legally required records.
Cross-border transfers
All data is stored and processed in AWS af-south-1 (Cape Town, South Africa). We do not transfer personal data outside South Africa unless you explicitly request it and you have taken responsibility for ensuring adequate protection under POPIA section 72.
Security safeguards
We maintain appropriate technical and organisational measures including: TLS 1.2+ in transit, AES-256 at rest, bcrypt-hashed API keys, regular penetration tests, role-based access controls, and audit logging. Our security practices are described in detail in our Security Overview available on request.
Breach notification
In the event of a security breach that affects your data we will notify you within 72 hours of becoming aware, consistent with POPIA section 22. We will provide details of the breach, the categories of data affected, and the remedial steps taken.
Contact our Information Officer
Information Officer: privacy@yoyorewards.com Yoyo Group (Pty) Ltd, Cape Town, South Africa For Data Processing Agreements or POPIA queries please email us and we will respond within 5 business days.