Test Privacy Notice

Editable draft for internal testing. Bracketed details must be completed before this is used as a published policy.

Status and operator

DRAFT FOR INTERNAL TESTING — complete the bracketed fields before publishing this notice or inviting entrants. Effective date: [DATE]. The responsible party operating this test is [LEGAL NAME], at [BUSINESS OR POSTAL ADDRESS]. Privacy contact: [MONITORED EMAIL]. This notice applies to the Stumbo test entry service on apexshuttle.co.za. It does not represent approval or sponsorship by Meta.

What we collect

Depending on the selected campaign, the form requests your name, surname, age, mobile number, document type and number, video or photograph, and purchase-receipt image. We also process your entry reference, consent choices, WhatsApp messages sent to the competition number, review decisions and technical security records. During internal testing, use an agreed dummy passport reference instead of a real identity number and a clearly labelled sample receipt. Do not upload identity-document images, bank details, bystanders or children.

Why information is needed

We use information to save and process your test entry, associate evidence with the correct reference, check campaign requirements and duplicates, troubleshoot the service, respond to requests and protect it from misuse. Fields marked required are needed to complete the configured form; without them submission may not proceed. Participation and optional updates are voluntary. Consent may be withdrawn by contacting the privacy contact; this does not undo processing already lawfully performed.

Messages and choices

If you choose and consent to updates, we may send entry confirmations and status messages through the configured SMS or WhatsApp provider after the required phone verification. Sending a campaign keyword requests a reply containing your private entry link. Keep that link confidential. Reply STOP on WhatsApp to stop optional updates, or contact us. STOP is not a data-deletion request. No unrelated marketing is authorised merely by entering this test.

Media screening and human review

Authorised staff can view submitted evidence. If enabled for the test, automated tools may inspect media, extract video frames, check receipt content, identify duplicates and suggest review outcomes. OpenAI and a separately configured authenticity-screening provider may receive the media or extracted images needed for those checks. These checks do not establish identity or prove whether all media is AI-generated. An uncertain detector result requires review; request human review through the privacy contact. AI services remain subject to their actual configuration and are not enabled by this notice.

Recipients and international processing

Information may be handled by authorised test administrators, hosting and private-storage providers, the selected SMS provider, Meta/WhatsApp for WhatsApp interactions, and enabled screening providers. Some providers may process information outside South Africa. Before using them, the operator must confirm appropriate contractual and cross-border safeguards. [CONFIRM THE ACTIVE PROVIDERS, PROCESSING LOCATIONS AND SAFEGUARDS BEFORE PUBLICATION.] We do not sell entry information. Any publicity use of a person’s image requires separate permission or an appropriately disclosed lawful basis.

Storage and retention

Identity details and messages are protected by application access controls and encryption where implemented; uploaded evidence is kept in private media storage. No service can guarantee absolute security. Draft links expire after seven days under the current application configuration; expiry alone is not a guarantee that every copy has been erased. Submitted records and backups require a managed retention and deletion process. [SET THE TEST RETENTION PERIOD, CLEANUP OWNER AND BACKUP EXPIRY BEFORE PUBLICATION.] We retain information only as needed for the disclosed purposes or a lawful retention obligation, then delete or anonymise it.

Your rights and complaints

You can ask to access or correct your information, request deletion where applicable, object to processing, withdraw consent and request human review. Contact [MONITORED EMAIL], quoting your entry reference if available. We may reasonably verify ownership without requesting unnecessary documents. You may complain to South Africa’s Information Regulator: https://inforegulator.org.za/ or enquiries@inforegulator.org.za. Material changes to this notice will be explained before information is used for a new purpose.

Cookies

The entry service uses session and security cookies to maintain your progress and protect requests. [CONFIRM WHETHER ANY ANALYTICS OR ADVERTISING COOKIES ARE ACTIVE AND DISCLOSE THEM BEFORE PUBLICATION.]