Legal
Privacy Policy
Last updated 1 May 2026
1. Who we are
Yoyo Group (Pty) Ltd ("Yoyo", "we", "us", "our") operates the Loyalty Engine API platform. We are registered in South Africa and are subject to the Protection of Personal Information Act 4 of 2013 (POPIA) and the General Data Protection Regulation (GDPR) where applicable.
2. What we collect
When you sign up for API access we collect: your email address, display name, and the API keys you create. When your integration calls the Loyalty Engine we store: the member external references you send us, transaction data (basket totals, items, timestamps), and points balance changes. We do not collect raw customer payment card data.
3. How we use your data
We use collected data to: provide and operate the Loyalty Engine service, authenticate API requests, generate analytics visible in your merchant dashboard, send transactional emails (account alerts, billing), and comply with our legal obligations. We do not sell personal data to third parties.
4. Data retention
Transaction and member records are retained for the duration of your subscription plus 7 years to satisfy South African accounting regulations. You may request deletion of a specific member's personal data at any time via the DELETE /members/:id endpoint — this anonymises all identifying fields while retaining aggregate points history for audit purposes.
5. Your rights
Under POPIA you have the right to access, correct, or delete personal data we hold about you. To exercise these rights contact privacy@yoyorewards.com. We will respond within 30 days. For member data processed on your behalf, you act as the responsible party; we act as the operator.
6. Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). API keys are stored as bcrypt hashes. We conduct regular penetration tests and security reviews. Our infrastructure is hosted on AWS in the af-south-1 (Cape Town) region.
7. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance of the updated policy.
8. Contact
Questions or complaints: privacy@yoyorewards.com. Postal address: Yoyo Group (Pty) Ltd, Cape Town, South Africa.