Privacy Notice

Last updated: 6 July 2026

1. Who we are

This Privacy Notice explains how Rift Space (Pty) Ltd (trading as "Rift Spaces"), a company registered in the Republic of South Africa, collects and uses your personal information. Rift Space (Pty) Ltd is the responsible party (data controller) for the personal information described here, in accordance with the Protection of Personal Information Act, 2013 ("POPIA").

2. Information we collect

• Account & identity — name, email address, phone number, login credentials.
• Membership & booking — plan tier, check-in history, meeting-room bookings, café orders.
• Support — messages you send us via email, forms or chat.
• Usage & device — IP address, browser type, pages viewed, timestamps, approximate location.
• Access control — QR / access-token usage at our physical space.

Payment details (card numbers, billing address) are collected and processed by our Merchant of Record, Paddle — we don't store your payment card data.

3. How we use your information

• Provide the service — create your account, manage your membership, grant access to our physical spaces (contract).
• Billing — pass order data to Paddle for payment, invoicing and tax compliance (contract, legal obligation).
• Support — respond to your questions and requests (contract, legitimate interest).
• Security & fraud prevention — protect our members, staff and systems (legitimate interest).
• Product improvement — understand usage patterns and improve the service (legitimate interest).
• Marketing — send occasional updates about Rift Spaces (consent — you can unsubscribe at any time).

4. Who we share information with

• Paddle — our Merchant of Record for payments, subscription management, invoicing and tax compliance.
• Service providers / subprocessors — hosting, email delivery, analytics and customer-support tooling, bound by data-processing agreements.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect our legal rights.

5. International transfers

Some of our service providers are based outside South Africa. Where personal information is transferred abroad, we rely on appropriate safeguards such as recipients bound to laws providing an adequate level of protection or contractual data-protection commitments.

6. How long we keep it

We keep personal information for as long as needed to provide the service and to meet legal, tax and accounting obligations. When it's no longer needed, we delete or anonymise it.

7. Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and request a copy;
• correct information that is inaccurate or out of date;
• ask us to delete information we no longer need;
• object to processing based on legitimate interests or direct marketing;
• withdraw consent where we rely on it;
• lodge a complaint with the Information Regulator of South Africa (inforeg@justice.gov.za).

To exercise any of these rights, email abdiwahab@branddrive.co.za. We aim to respond within a reasonable period and in any event within one month.

8. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and row-level security in our database — to protect your personal information against unauthorised access, loss or alteration.

9. Cookies

We use a small number of cookies and similar technologies that are essential for the site to work (e.g. keeping you signed in) and, where applicable, aggregated analytics to understand how the site is used. You can control cookies through your browser settings.

10. Contact

Rift Space (Pty) Ltd — Information Officer: abdiwahab@branddrive.co.za.