Your data and your rights

How to see what we hold about you, correct it, delete it, stop a use you object to, or complain. In plain steps.

Last updated: [[LAST_UPDATED]]. Applies from [[EFFECTIVE_DATE]].

1. Summary

This document sets out the rights you have over the personal information SmartMatchHub holds about you, and how to use them. Requests are made by email. There is no charge. We respond within 30 days, and within one month if you are in the United Kingdom. Deleting your account removes your profile, your Smart Match Card, and your personality assessment answers and scores. A record of each call you took part in, safety reports, connection diagnostics and backups survive deletion. You may complain to us, and then to the Information Regulator of South Africa or, if you are in the United Kingdom, the Information Commissioner’s Office.

2. Who is responsible

The responsible party is [[LEGAL_ENTITY]], registration number [[COMPANY_REG_NO]], of [[REGISTERED_ADDRESS]]. The Information Officer is [[INFORMATION_OFFICER]]. If you are in the United Kingdom, our Article 27 representative is [[UK_REPRESENTATIVE]].

3. How to make a request

Send your request to [[PRIVACY_EMAIL]]. Tell us which right you are using and what you want us to do. If you are in the United Kingdom you may send it to our UK representative instead. You may also make a request for access to information under the Promotion of Access to Information Act, 2000.

4. How we verify who you are

We verify your identity before acting on a request. Send the request from the email address on your account. If you cannot use that address, we will ask you to confirm the first name, last name and phone number on the account. We do not collect identity documents and do not require one to verify a request.

5. Cost and response times

We do not charge for any request described in this document. We respond within 30 days of verifying your identity. If you are in the United Kingdom, we respond within one month, and we may extend that period by up to two further months where a request is complex, in which case we tell you within the first month and give the reason. If we refuse a request, we tell you why and how to complain.

6. Your rights

Access. Ask us for confirmation of what personal information we hold about you, a copy of it, and the identity of anyone who has received it. (POPIA section 23; UK GDPR Article 15.)
Correction. Ask us to correct personal information that is inaccurate, misleading, outdated or incomplete, or to delete information we no longer have grounds to hold. (POPIA section 24; UK GDPR Article 16.)
Deletion. Ask us to delete your account. Sections 7 and 8 set out what deletion removes and what survives it.
Objection. Object to processing we carry out on the ground of legitimate interest. (POPIA section 11(3); UK GDPR Article 21.)
Withdraw consent. Withdraw any consent you have given, including consent to special personal information: your sexuality, ethnicity, culture and religion, and the political opinion, religious belief and mood that some personality assessment items elicit. Withdrawal takes effect when we receive it and does not affect processing carried out before then.
Recommender training. Tell us to stop using records of your calls to improve future matching. We remove your history from the training set when we receive the request.
Direct marketing. Tell us to stop sending you direct marketing. (POPIA section 69.) Under the POPIA Regulations, an opt-out is not consent.
Automated decision-making. Ask us to explain how matching produced a result and ask for a person to review it. (POPIA section 71; UK GDPR Article 22.) Mixer, the only path that is built, pairs whoever is available in the order they became available.
Portability. If you are in the United Kingdom, ask for the information you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation where that is technically feasible. (UK GDPR Article 20.)
Restriction. If you are in the United Kingdom, ask us to stop using your information while we check its accuracy or consider an objection. (UK GDPR Article 18.)
Complain. Complain to us and to a regulator, as set out in section 9.

7. What deletion removes

Deletion removes your account and sign-in details; your profile, including date of birth, gender, sexuality, who you are interested in, relationship status, what you are looking for, preferred languages, age range, ethnicity, culture, religion and location; your Smart Match Card; every answer you gave in the personality assessment, including the archive of answers set aside as careless; your trait scores; and your rewards. A deletion request takes effect after [[GRACE_PERIOD]], and you may cancel it during that period. Deletion does not withdraw the Smart Match Card already given to a person you matched with.

8. What survives deletion

What survives	Why	How long we keep it
One record for each call you took part in, holding the outcome and both people’s trait scores	The record covers two people and cannot be removed without destroying the other person’s data. Your identifier is removed from it	[[RETENTION_CALL_METADATA]]
Safety reports made by you or about you	To detect patterns of harmful conduct and to defend legal claims	[[RETENTION_SAFETY]]
Connection diagnostics	To keep the service secure and working	[[RETENTION_LOGS]]

Your information also remains in backups until those backups age out.

9. Complaints

Complain to us first at [[PRIVACY_EMAIL]]. We acknowledge your complaint on receipt and respond within [[COMPLAINTS_TURNAROUND]].

You may then complain to the Information Regulator of South Africa. A complaint is made on Form 5. Its offices are at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, its telephone number is 010 023 5200, and complaints are sent to POPIAComplaints@inforegulator.org.za.

If you are in the United Kingdom, you may complain to the Information Commissioner’s Office at ico.org.uk. You do not have to complain to us first.