1. Identity, scope and controller status
1.1. This Policy explains the processing of personal information associated with the Event Partner relationships conducted by Iconic Connex (Pty) Ltd (registration number 2018/371055/07), trading as TAPDX Tags ("TAPDX") through its website, physical NFC products and configured digital experiences.
1.2. TAPDX's business contact address is 9 Pebble Lake, Florin Road, Strubensvalley, Roodepoort, 1724, South Africa; the privacy contact is iconic.connex25@gmail.com. The Information Officer is Kubashni Govender, registration reference 2026-066035, as provided in TAPDX's current company compliance particulars.
1.3. This Policy covers proposed and approved partners, authorised business representatives, participating organisations, event users where relevant, customers, suppliers and persons who expressly submit information through an agreed experience.
1.4. It supplements TAPDX's general website privacy notice and applies only to processing actually undertaken. A demonstration screen, proposal or future product description does not establish that a processing capability is live.
2. Governing legislation and definitions
2.1. The Protection of Personal Information Act 4 of 2013 (POPIA), the Promotion of Access to Information Act 2 of 2000 (PAIA), and other applicable South African law govern processing and data subject rights.
2.2. Terms such as responsible party, operator, data subject, personal information and processing have the meanings given to them under POPIA. In appropriate cases, personal information also includes information concerning an identifiable juristic person.
2.3. Any attempt to contract out of a mandatory security, transparency, disclosure or rights requirement is ineffective to the extent prohibited by law.
3. Allocation of processing roles
3.1. TAPDX acts as responsible party for its own partner applications, contracts, quotations, invoices, direct sales, financial reconciliations, support records, security operations and other processing purposes it determines.
3.2. A Partner ordinarily acts as responsible party for personal information used in its own event, organisational, package billing, referral contact or customer relationships, where it determines the purpose and means of processing.
3.3. A sponsor, exhibitor or introduced business may independently be the responsible party for personal information lawfully sent directly to it through a journey or other authorised route.
3.4. Where TAPDX or the Partner processes information solely on the instructions of another responsible party, the processing shall be governed by the appropriate written operator terms and POPIA requirements.
3.5. Use of a common journey, tag or dashboard does not make every participant a joint owner of all information or confer automatic access to participant-level records.
4. Categories of personal information
4.1. Business identity and contact information may include names, organisation, professional title, telephone number, email address, business address, websites and correspondence.
4.1A. Identity verification categories: each individual commercial partner or authorised business representative provides a valid South African identity document once at the final joining verification step. Data may include the document image, full legal name, identity number, verification timestamp and result. Only a registered business applicant supplies business-registration particulars and evidence of authority; an individual sole trader need not invent a registration number.
4.2. Commercial information may include applications, orders, contracts, approved materials, assigned representatives, event or programme details, quotations, invoices, payments, tax information, banking details necessary for verified payouts and transaction records.
4.2A. Payout bank verification categories: for a partner to whom TAPDX pays, bank account-holder particulars, bank confirmation letter or equivalent, and verification status are collected before the first payout and after every account change. No bank documents are required solely for purchasing discounted wholesale tags.
4.3. Where a journey or site feature actually collects it, technical information may include browser or device details, network data, session identifiers, access events, actions and timestamps, subject to the applicable privacy notice and lawful controls.
4.4. An individual may voluntarily submit a name, message, contact route, organisational information and stated purpose to a specific recipient through an expressly presented form or action.
4.5. No policy provision authorises indiscriminate collection of special personal information, children's data, conversation recordings or contact books.
5. Specified and lawful purposes
5.1. Processing purposes include evaluating partner enquiries, administering approved contracts, maintaining authorised accounts, preparing and fulfilling orders, configuring agreed journeys, delivering support, and observing lawfully required financial records.
5.2. Where an approved commission arrangement exists, processing may include order attribution, checking eligible cleared receipts, calculating amounts due, investigating adjustments and documenting payment.
5.2A. Verification information is processed for confirming identity and authority, prevention of impersonation and duplicate partner identities, and authorised payment administration. One verified person may represent multiple accepted businesses. Identity numbers are not used for marketing or event profiling. Referral attribution is limited to eligible business buyers; the independent consumer refer-a-friend rewards route is not a B2B commission programme.
5.3. Where a participant voluntarily submits an enquiry, information may be processed to deliver that enquiry to the disclosed recipient and permit a response within the stated purpose.
5.4. Security and aggregated service analysis may be undertaken where permitted by law and consistent with the information provided to affected persons.
5.5. Information collected for performance, enquiries or order fulfilment shall not automatically be repurposed for unrelated marketing, profiling or sale to a third party.
6. Lawful justification and notices
6.1. Each responsible party shall identify and document an appropriate lawful justification for each material processing activity under POPIA, including consent where required and other conditions where law permits.
6.2. Notices shall state the collection purpose, identity of the responsible party, intended recipient and relevant consequences of refusing optional information, as required by law.
6.3. Acceptance of a commercial contract by a Partner does not establish personal marketing consent for each employee, attendee, exhibitor, sponsor or customer associated with that Partner.
6.4. Consent shall be specific and informed where required and shall be withdrawn or amended through the available lawful mechanism; withdrawal shall not erase separately lawful retention duties.
7. Partner applications and contractual records
7.1. Information submitted by a prospective Partner may be used to review business suitability, arrange discussions, assess its proposed commercial model and decide whether to enter into a relationship.
7.2. Submitting an application does not result in automatic approval, recruitment, certification, commission entitlement or permission to receive communications unrelated to the application.
7.3. Once approved, relevant contact and commercial records may be retained for performance, financial accountability and lawful contract administration.
7.4. Declined application records shall not be retained longer than necessary for lawful purposes or statutory requirements.
7.5. Identity and registration verification is mandatory before activating a commercial partner appointment; simply uploading a document is not verification. Incorrect or unclear documents may be corrected by the applicant. An auditable verification outcome may be kept without exposing full document images or identity numbers on a partner dashboard.
8. Event, customer and referral interactions
8.1. A tap of an NFC tag, opening of a webpage or viewing of a sponsor or business profile shall not by itself be treated as consent to direct marketing or disclosure of a person's contact particulars.
8.2. The choice to submit an enquiry must be distinguished from merely viewing a page or clicking an external platform. Only confirmed submissions and other suitably supported actions shall be recorded as such.
8.3. Where an individual selects an external booking, messaging, payment or social-media service, the third party may have separate terms and privacy practices, which should be disclosed when appropriate.
8.4. Any sharing of a potential customer introduction shall be limited to the lawful and disclosed purpose; a Partner shall not transfer indiscriminate contact lists solely to claim commission.
8.5. For each commissioned Event Partner activation, attendees, exhibitors and sponsors receive only the specifically selected lawful experience. An attendee tap or sponsor payment does not create marketing consent or a right to disclose identifiable participant information to an organiser or sponsor.
10. Partner and programme billing data
10.1. Where the Partner contracts with its own package or institutional customers, it remains responsible for the information used in its own billing, communication and customer-service processes.
10.2. TAPDX shall process only information reasonably required to invoice and fulfil the separate products or services purchased by the Partner, unless a specific lawful customer-facing relationship exists.
10.3. A separately concluded direct TAPDX sale shall be subject to the applicable TAPDX customer privacy terms and shall not convert all Partner package customers into TAPDX billing customers.
10.4. Financial information shall be disclosed and retained only as needed for payment security, reconciliation and legal record-keeping.
10.5. Payout banking information is used only for account verification, authorised EFT payments, reconciliation and necessary financial records. Payout statements and payment notifications appear only in the partner account and are never emailed. Application approvals, declines and requests for additional information are communicated both as an account notification and by email, and a decline or a request for additional information states clear, specific reasons.
11. Analytics and reporting integrity
11.1. The parties shall define any analytics or reporting deliverable in the accepted commercial and processing schedules, and only actually implemented categories shall be represented as available.
11.2. Physical tags issued, activated tags, journeys viewed, calls to action, completed submissions, qualified enquiries and independently verified sales are different measurements and shall not be presented as interchangeable.
11.3. Where a report is supplied to a Partner or organiser, aggregates or suitable de-identification shall be the default unless identifiable information is necessary and lawfully authorised.
11.4. No demonstration results, simulated indicators, unverified client outcomes or modelled uplift shall be presented as observed production data.
11.5. Referral-attribution records, where authorised, shall be limited to necessary source, qualifying order, collection, relevant adjustment and agreed payment status.
11.6. The Event Partner's report must distinguish live observations from illustrative performance, and must not infer that an event tap proves attendance by a uniquely identified person.
12. Direct marketing and communications
12.1. Electronic direct marketing shall comply with section 69 of POPIA and other applicable marketing requirements.
12.2. A person's submission of an enquiry authorises its handling for the specified purpose but does not automatically constitute unrestricted consent to unrelated promotional communications.
12.3. Where consent is required, the sender shall obtain and appropriately record it. Where a statutory existing-customer exception applies, its conditions, including notice and opportunities to opt out, shall be met.
12.4. A Partner, exhibitor, sponsor or introduced business that independently markets to individuals remains responsible for the legality of its own communications.
12.5. Operational notices necessary to fulfil an agreement are distinguishable from promotional messages, but shall still be limited to lawful purposes.
14. Security of information
14.1. TAPDX shall maintain appropriate and reasonable technical and organisational security measures under POPIA, including assessment of foreseeable risks, access control and improvement of safeguards.
14.2. Authorised users shall protect credentials and shall not share personal information, reports, exports, passwords or administrative access outside their approved roles.
14.3. Neither party shall use event or referral access to scrape third-party data, bypass permissions, or send personal information to unauthorised services.
14.4. Security measures shall be proportionate to the sensitivity and nature of the information and shall be reviewed when the processing activity materially changes.
14.5. Sensitive partner documentation must be received through access-controlled private uploads, securely transmitted and stored, accessed under role-based permissions and auditable controls, and omitted from ordinary analytics, public URLs and error logs. Upload, retrieval, verification and deletion must be tested before real collection is activated.
15. Operators and subcontractors
15.1. An operator may process personal information only with the knowledge or authorisation of the responsible party and must preserve confidentiality as required by POPIA.
15.2. Where required, the responsible party shall secure a written contract requiring the operator to maintain appropriate security safeguards and to notify the responsible party immediately when unauthorised access or acquisition is reasonably suspected.
15.3. Further operators or subcontractors may be used only under the relevant lawful agreement and controls, with appropriate restrictions on onward disclosure.
15.4. A software feature or general privacy notice is not a substitute for a written operator arrangement where POPIA requires one.
16. International processing and transfers
16.1. Any transfer of personal information outside South Africa shall comply with section 72 of POPIA and other applicable requirements.
16.2. TAPDX shall not claim that all processing occurs in South Africa unless actual hosting, service provider and transfer locations have been verified.
16.3. Where an external messaging, payment or other service is independently selected by a Partner or user, the respective responsible parties shall disclose and manage any lawful transfer obligations arising from their processing.
17. Security incidents
17.1. A party becoming aware of a suspected security incident affecting information within its responsibility shall take reasonable steps to investigate, contain and mitigate the matter.
17.2. An operator shall notify its responsible party immediately where it has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.
17.3. The responsible party shall fulfil its applicable notification duties to the Information Regulator and affected data subjects under section 22 of POPIA without unwarranted delay where that section applies.
17.4. The parties shall cooperate in investigations and lawful notifications, subject to the boundaries of their actual processing responsibilities.
18. Retention, deletion and completion
18.1. Personal information shall not be retained longer than necessary or lawfully permissible for the purpose for which it was collected, subject to accounting, tax, contract, dispute and other retention duties.
18.2. Different periods may apply to applications, accepted orders, tax records, programme participation, event interaction data, opt-in enquiries and security logs; the actual retention schedule shall be documented before activation.
18.3. Upon expiry of the relevant purpose, information shall be deleted, destroyed or appropriately de-identified, subject to any continuing lawful retention and operator instructions.
18.4. Anonymisation and aggregation shall not be claimed where a data subject remains reasonably identifiable through available means.
18.5. Identity documents, bank confirmations, verification outcomes, contracts and financial records may have different retention obligations. The specific retention and deletion triggers, including backups and service operators, must be recorded in the completed processing schedule before collection begins. A declined application does not promise immediate deletion if lawful retention is still required.
19. Access and other rights
19.1. Data subjects may exercise applicable POPIA rights, including lawful requests for access, correction, objection, deletion or destruction and withdrawal of consent where the relevant requirements are met.
19.2. Requests concerning information for which TAPDX is the responsible party may be directed to its Information Officer at iconic.connex25@gmail.com. Appropriate identity or authority verification may be required.
19.3. Where TAPDX acts only as operator, it shall assist the actual responsible party as appropriate under the written processing agreement and refer requests to that party where necessary.
19.4. Nothing in this Policy restricts a complaint or other statutory remedy before the Information Regulator of South Africa.
20. Children and special categories
20.1. The Partner shall disclose in advance if the contemplated deployment involves children, special personal information or regulated contact data so that the relevant purpose, notices, approvals and safeguards may be agreed.
20.2. No collection functionality for such information shall be enabled unless the processing is lawful, documented and appropriate to the circumstances.
20.3. A general event ticket, sponsorship payment or physical tap does not create permission to collect such information for unrelated purposes.
21. Confidentiality, changes and precedence
21.1. Commercial partner rates, supplier costs, business secrets and private financial arrangements remain confidential independently of their status under personal-information law.
21.2. A future update to this notice shall not retrospectively authorise an incompatible use of data or silently amend an accepted processing agreement.
21.3. Where an applicable signed data-processing schedule specifies a narrower lawful purpose or access rule than this general Policy, that specific restriction shall apply to the relevant operation, subject to mandatory law.
21.4. South African law governs this Policy. The parties shall not introduce unverified data collection, new service providers or new disclosure categories without the required assessment and authority.
22. Information Officer and contact details
22.1. Responsible party for TAPDX's own processing: Iconic Connex (Pty) Ltd (registration number 2018/371055/07), trading as TAPDX Tags. Website: https://tapdxtags.com. Business correspondence: 9 Pebble Lake, Florin Road, Strubensvalley, Roodepoort, 1724, South Africa.
22.2. Information Officer: Kubashni Govender, Information Regulator registration reference 2026-066035. Privacy contact: iconic.connex25@gmail.com.
22.3. The Information Regulator of South Africa provides public complaint and guidance mechanisms through https://inforegulator.org.za.
22.4. This notice shall be reviewed against the actual deployed data-flow, retention, cookie and service-provider configuration before publication.
Schedule A — Event Partner Processing and Access Particulars
A.1 Responsible parties and operators, verification and payout processes, signing entities, approved recipients, responsible information officers: (a) The responsible party in respect of all personal information processed under this Policy is Iconic Connex (Pty) Ltd (registration number 2018/371055/07), trading as TAPDX Tags ("TAPDX"), which is also the entity that enters into each partner agreement. (b) TAPDX's Information Officer is Kubashni Govender. The Information Officer personally reviews every application, identity document, company registration document and bank confirmation letter, decides whether each application is approved, declined or requires further information, and authorises and makes every payment to a partner. No other person employed or engaged by TAPDX has access to those documents or takes those decisions. (c) TAPDX uses the following operators, each of which processes personal information only on TAPDX's instructions and under its own data processing terms: Cloudflare, Inc., which hosts the TAPDX website, its database and its private document store; and Resend, Inc., which delivers TAPDX's emails. (d) A partner accepts its partner documents electronically, in its own TAPDX account, and may do so only after TAPDX has approved its application.
A.2 Lawful processing purposes and corresponding basis for identity, company registration, bank verification, duplicate checks, business referral attribution, payments and record retention: (a) TAPDX processes an applicant's South African identity document, and a secure matching code made from its number, for the purposes of confirming the applicant's identity and authority, preventing impersonation and preventing any person from holding more than one partner profile. (b) TAPDX processes a company registration document, where it asks for one, for the purpose of confirming that the business exists and that its representative is authorised to bind it. (c) TAPDX processes a bank confirmation letter for the sole purpose of ensuring that any payment is made only into an account held in the name of the partner or of its business. (d) TAPDX compares the secure matching code of each identity number, and each email address, telephone number and company registration number, with those of every other application, for the purpose of preventing duplicate partner profiles. (e) For business referral attribution, TAPDX records only the time at which a partner's referral link was first opened and the partner to whom it belongs, together with the buyer's own answer at checkout as to whether the order is placed for a business. (f) TAPDX keeps statements and payout records for the purpose of accounting for every amount paid to a partner. (g) The lawful basis for the processing described in this row is that it is necessary for the conclusion and performance of the partner agreement, that it protects TAPDX's legitimate interest in preventing fraud, and that it complies with TAPDX's obligations to keep financial records, as contemplated in sections 11(1)(b), 11(1)(f) and 11(1)(c) of POPIA respectively.
A.3 Actual data fields, documents, data subjects and verification audit records, and business-buyer classification data: (a) The personal information processed consists of the applicant's full name, email address, WhatsApp or mobile number and province; the name and company registration number of the applicant's business, where given; the ways of partnering for which the applicant applies; any further information the applicant chooses to provide; and whether the applicant has asked to receive TAPDX news. (b) The documents processed are the image of the applicant's South African identity document, together with a secure matching code made from its number; a company registration document, where TAPDX asks for one; and a bank confirmation letter, together with the name of the bank and the last four digits of the account number. TAPDX does not keep the identity number as a separate field in the partner's profile: the number is used to validate the application and to make the matching code, and it appears only on the uploaded image. The name of the bank and the last four digits are the only account details kept in the partner's profile: the full account number appears only on the bank confirmation letter. The image and the letter are kept only until they have been checked, and are deleted as row A.7 sets out. (c) The verification and audit records kept are TAPDX's decisions on each application and the reasons given for them; the applicant's answers to any request for further information; the record of each acceptance, comprising the partner's name and email address, the time in Johannesburg, the version and the documents accepted; and a record of each occasion on which a document was opened, stating by whom, when and which document. (d) The business-buyer classification data are the time at which a partner's referral link was first opened and the buyer's answer at checkout as to whether the order is for a business. (e) The data subjects are applicants, partners and their authorised representatives.
A.4 Where documents are uploaded, when referrals and business checkout status are recorded, and which customer notifications are displayed: (a) An applicant uploads its South African identity document at the final joining step at tapdxtags.com/partners/apply. Any document TAPDX requests thereafter, and the bank confirmation letter, are uploaded in the partner's own TAPDX account, under Your partnership. (b) The first opening of a partner's referral link is recorded at the moment the link is opened, and whether an order is placed for a business is recorded at checkout from the buyer's own answer. (c) The notifications in the partner's TAPDX account display TAPDX's decision on the application, being an approval, a request for further information or a decline together with its reason, each of which is also sent by email; the partner's acceptance; the checking of the bank confirmation letter or a request that it be provided again, the latter also being sent by email; and each payment sent, which is never sent by email. Every statement is kept in the partner's account, under Your partnership.
A.5 Authorised persons by role; verification/finance administrator rights; partner-only views; limits on sponsor, exhibitor and organiser access: (a) Only the Information Officer, signed in to TAPDX's owner dashboard by means of a one-time code sent to her email address, may open an identity, company or bank document, decide an application, check a bank confirmation letter or record a payout. TAPDX has no staff member or other person with such access. (b) A partner may see only its own application, the state of its own documents, its agreements, its orders and quotes, its earnings and its statements. A partner is never shown a document back once uploaded, nor the full number of its identity document. (c) A Refer & Earn partner sees each order that it introduced only as "A business you sent us", together with the amount concerned, and is never shown the business's details or order number. (d) No sponsor, exhibitor or event organiser may see any identity, company or bank document of any partner, or any partner's earnings.
A.6 Actual storage providers, operators and subprocessors, system locations, cross-border controls and operator contracts: (a) Cloudflare, Inc. hosts the TAPDX website, its database and its private document store, the database and the document store each being located in Cloudflare's Western Europe region. (b) Resend, Inc. delivers TAPDX's emails and receives only the recipient's email address, the subject and the message, and never any document or identity number. (c) Personal information is accordingly transferred outside the Republic of South Africa, and each such transfer is made under the relevant provider's data processing terms, as contemplated in section 72 of POPIA. (d) No identity, company or bank document is sent to any other service provider, to any analytics service or to any error record.
A.7 Specific approved retention periods and deletion triggers per document or record type, active storage, backups, operators and deletion owner: (a) An image of a South African identity document, a company registration document and a bank confirmation letter are each deleted 30 days after the Information Officer has checked it, the check taking place when she approves or declines the application or checks the bank confirmation letter, as the case may be. After deletion TAPDX keeps only the fact that the document was checked, the date on which it was checked, the type of document and, for a bank account, the name of the bank and the last four digits of the account number. (b) An application that is not approved is deleted, together with its notifications, 12 months after TAPDX's decision on it. An application that is not completed is deleted 12 months after it was last changed. An email address left by a person outside South Africa who asked to be told when partnering opens there is deleted after 12 months. (c) A partner's contact details and account are kept for as long as it remains a partner and for 3 years after the partnership ends. Acceptance records, statements and payout records are kept for 7 years, and the partner's name and email address are kept during that period only as part of those records. (d) Recovery copies of the database held by Cloudflare are deleted within 30 days, and no identity, company or bank document is copied to any other place. (e) The TAPDX website carries out each of these deletions automatically every morning, and the Information Officer is responsible for ensuring that they take place.
A.8 Marketing and communication: record lawful purpose, consent or existing-customer exception, message owner and objection mechanism. (a) TAPDX sends its news only to a person who has ticked the box offered for that purpose when applying, which box is never ticked in advance, and every such message contains a means of declining further messages. (b) An application, a tap on a TAPDX tag or a visit to the TAPDX website never constitutes consent to direct marketing. (c) TAPDX is the owner of every such message, and any objection to direct marketing may be sent to iconic.connex25@gmail.com.
A.9 Named security and incident contacts, private storage location, access-control owner and escalation/notification process: (a) The security and incident contact, and the owner of access control, is Kubashni Govender, Information Officer, who may be contacted at iconic.connex25@gmail.com. (b) Identity, company and bank documents are kept in a private Cloudflare document store that has no public address, may be opened only through the Information Officer's signed-in review, and records each occasion on which a document is opened. (c) Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, TAPDX shall notify the Information Regulator and each affected data subject as soon as reasonably possible, in accordance with section 22 of POPIA.
A.10 Required acceptance, dates, named responsible parties and operator sign-off: (a) Each partner accepts its partner documents electronically in its TAPDX account once TAPDX has approved its application, and TAPDX records that acceptance together with the partner's name and email address, the time in Johannesburg, the version and the documents accepted. (b) These documents were signed off for Iconic Connex (Pty) Ltd by Kubashni Govender on 2 November 2026, and this Schedule A was completed and signed off by her on 8 November 2026.