Your data and your rights

How to see what we hold about you, correct it, delete it, stop a use you object to, or complain. In plain steps.

Last updated: [[LAST_UPDATED]]. Applies from [[EFFECTIVE_DATE]].

1. Summary

This document sets out the rights you have over the personal information SmartMatchHub holds about you, and how to use them. Requests are made by email, except for the early-access details you gave on our website, which you can usually see, change or delete yourself using the link in our early-access email. You may also send a request through the contact form on our website, and we then verify it in the same way as a request that arrives by email. A request about a message you sent us through that form takes more than the address it came from, because nothing checked that address when the message arrived. There is no charge. We respond within 30 days, and within one month if you are in the United Kingdom. Deleting your account removes your profile, your Smart Match Card, and your personality assessment answers and scores. A record of each call you took part in, safety reports, connection diagnostics, any early-access details you gave on the website, any message you sent us through the contact form on the website, and backups survive deletion. You may complain to us, and then to the Information Regulator of South Africa or, if you are in the United Kingdom, the Information Commissioner’s Office.

2. Who is responsible

The responsible party is [[LEGAL_ENTITY]], registration number [[COMPANY_REG_NO]], of [[REGISTERED_ADDRESS]]. The Information Officer is [[INFORMATION_OFFICER]]. If you are in the United Kingdom, our Article 27 representative is [[UK_REPRESENTATIVE]].

3. How to make a request

For the early-access details you gave on our website, you may not have to write to us at all. Our early-access email normally carries a link to a page that shows those details and lets you change them, stop the emails, or delete them. Deleting them there is immediate and cannot be undone. If your email has no such link, or you no longer have it, write to us in the ordinary way and we will do the same things for you. That page reaches only what you gave on the website, and nothing in your app account.

For everything else, send your request to [[PRIVACY_EMAIL]]. Tell us which right you are using and what you want us to do. If you are in the United Kingdom you may send it to our UK representative instead. You may also make a request for access to information under the Promotion of Access to Information Act, 2000.

The contact form on our website reaches us as well, and you may use it to make a request. It is a way to reach us and nothing more. The form cannot check who you are, so a request that arrives through it is verified the way section 4 sets out before we act on it, exactly as one that arrives by email is. For your account, and for the early-access details you gave on our website, writing from the email address they are held against is the shortest route, because it is already most of that check. A request about a message you sent through the form is not settled by the address alone, and section 4 says what it takes instead.

4. How we verify who you are

We verify your identity before acting on a request. Send the request from the email address on your account. If you cannot use that address, we will ask you to confirm the first name, last name and phone number on the account. We do not collect identity documents and do not require one to verify a request.

If you have no account and are asking about the early-access details you gave us on our website, send the request from the email address you submitted. That address is the only thing those details are held against, so it is all we need to find them, and it is all we will ask you for.

The link in our early-access email verifies you in the same way and without an exchange of messages: it carries a code that identifies your record, and because we sent that code only to the address on the record, being able to open the link shows that you can read that mailbox. The code does not expire and is not used up, so the link keeps working — which also means the email is worth keeping, and worth treating as you would any other message that can reach your information. If you no longer have it, write to us instead.

A message you send us through the contact form has no such link, and it does not work like an early-access record either. We send no code with it, and there is no page that shows it back to you. The address in a message is where our reply goes: nothing checks it when the message is sent, we send nothing to it to confirm it, and anyone can type anyone’s address into that form — so being able to read a mailbox does not show that you wrote a message held against it, and handing a message over on that basis could hand your message to somebody else, or somebody else’s to you. A request about a message is therefore always an exchange of messages with us, and it needs enough about the message itself, such as roughly when you sent it and what it was about, for us to satisfy ourselves that it is yours. Where we cannot satisfy ourselves, we tell you so and we do not act on the request.

5. Cost and response times

We do not charge for any request described in this document. We respond within 30 days of verifying your identity. If you are in the United Kingdom, we respond within one month, and we may extend that period by up to two further months where a request is complex, in which case we tell you within the first month and give the reason. If we refuse a request, we tell you why and how to complain.

6. Your rights

Access. Ask us for confirmation of what personal information we hold about you, a copy of it, and the identity of anyone who has received it. (POPIA section 23; UK GDPR Article 15.)
Correction. Ask us to correct personal information that is inaccurate, misleading, outdated or incomplete, or to delete information we no longer have grounds to hold. (POPIA section 24; UK GDPR Article 16.)
Deletion. Ask us to delete your account. Sections 7 and 8 set out what deletion removes and what survives it. Early-access details are separate from your account, and where our early-access email to you carries the link described in section 3 you can delete them yourself; otherwise ask us.
Objection. Object to processing we carry out on the ground of legitimate interest. (POPIA section 11(3); UK GDPR Article 21.)
Withdraw consent. Withdraw any consent you have given, including consent to special personal information: your sexuality, ethnicity, culture and religion, and the political opinion, religious belief and mood that some personality assessment items elicit. Withdrawal takes effect when we receive it and does not affect processing carried out before then.
Recommender training. Tell us to stop using records of your calls to improve future matching. We remove your history from the training set when we receive the request.
Direct marketing. Tell us to stop sending you direct marketing. (POPIA section 69.) Under the POPIA Regulations, an opt-out is not consent.
Automated decision-making. Ask us to explain how matching produced a result and ask for a person to review it. (POPIA section 71; UK GDPR Article 22.) Mixer, the only path that is built, pairs whoever is available in the order they became available.
Portability. If you are in the United Kingdom, ask for the information you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation where that is technically feasible. (UK GDPR Article 20.)
Restriction. If you are in the United Kingdom, ask us to stop using your information while we check its accuracy or consider an objection. (UK GDPR Article 18.)
Complain. Complain to us and to a regulator, as set out in section 9.

7. What deletion removes

Deletion removes your account and sign-in details; your profile, including date of birth, gender, sexuality, who you are interested in, relationship status, what you are looking for, preferred languages, age range, ethnicity, culture, religion and location; your Smart Match Card; every answer you gave in the personality assessment, including the archive of answers set aside as careless; your trait scores; and your rewards. A deletion request takes effect after [[GRACE_PERIOD]], and you may cancel it during that period. Deletion does not withdraw the Smart Match Card already given to a person you matched with. It does not reach the early-access details you gave on the website, or a message you sent us through the contact form, because neither is held against your account; section 8 says how long we keep them and how to have them removed as well.

8. What survives deletion

What survives	Why	How long we keep it
One record for each call you took part in, holding the outcome and both people’s trait scores	The record covers two people and cannot be removed without destroying the other person’s data. Your identifier is removed from it	[[RETENTION_CALL_METADATA]]
Safety reports made by you or about you	To detect patterns of harmful conduct and to defend legal claims	[[RETENTION_SAFETY]]
Connection diagnostics	To keep the service secure and working	[[RETENTION_LOGS]]
Early-access details you gave on the website: the email address, first name, age range, gender and sexuality	They are held against the email address you submitted, not against your account, so a request to delete the account does not reach them	Until you remove them yourself using the link in our early-access email, where that email carries one, or ask us to remove them, or withdraw the consent they are held on. Ask in the same email and we remove both together
A message you sent us through the contact form on the website: your name, your email address, the subject if you gave one, and what you wrote	It is held against the email address you gave in the message, not against your account, so a request to delete the account does not reach it	[[RETENTION_SUPPORT]] from the day we receive it, or until you ask us to remove it if that is sooner. Ask in the same email and we remove it with the account. Nothing on our side deletes a message automatically when that period ends, so until we build that, the period is the rule we work to and not one the system applies for us

Your information also remains in backups until those backups age out.

9. Complaints

Complain to us first at [[PRIVACY_EMAIL]]. We acknowledge your complaint on receipt and respond within [[COMPLAINTS_TURNAROUND]].

You may then complain to the Information Regulator of South Africa. A complaint is made on Form 5. Its offices are at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, its telephone number is 010 023 5200, and complaints are sent to POPIAComplaints@inforegulator.org.za.

If you are in the United Kingdom, you may complain to the Information Commissioner’s Office at ico.org.uk. You do not have to complain to us first.