Privacy Policy

PebblePay provides the software that businesses use to run their point of sale, memberships, loyalty and online storefronts, and that you use through the PebblePay, PebblePay Rewards and CannaClub apps and the pebblepay.online website.

The platform is operated by PebblePay, a company established in Cyprus. It is the data controller under the GDPR for your account with PebblePay, and the processor — in South Africa, the operator under POPIA — for the information a business holds about you.

The business you sign up with or buy from is the merchant of record and is a separate responsible party (controller) for its relationship with you. This policy explains how PebblePay handles your personal information as the platform operator; a business may also have its own privacy notice for how it uses your information.

Account details you give us: your name, email address, phone number, date of birth, and — where a membership requires it — a physical address and an identity or age-verification detail. Each member is assigned a membership number.

Activity on the platform: your memberships, loyalty points and store-credit balance, purchases and orders, and related transaction records created when you use a business through the platform.

Device and technical data: information needed to operate and secure the service, such as app version and basic diagnostic and sign-in information. We use your device camera only when you actively scan a QR code or barcode; those scans are processed on the device and we do not store photographs.

We do not knowingly collect information from anyone under 18. The apps that involve age-restricted goods require you to confirm you are 18 or older.

To create and run your account, memberships and loyalty; to process and record your purchases and orders on the relevant business’s behalf; to verify age and eligibility where the law or the business requires it; to send service and account communications; to keep the platform secure and prevent fraud and abuse; and to meet legal, tax and accounting obligations.

We rely, depending on the activity, on your consent, on performing the contract with you, on our and the business’s legitimate interests in running and securing the service, and on compliance with the law.

With the business you interact with: the business whose membership, till or store you use can see the account and transaction information needed to serve you.

With service providers who operate the platform under contract, including our cloud database and hosting provider and, where you pay online, the payment processor. They may only use the information to provide their service to us.

When required by law, regulation, or a lawful request, or to protect the rights, safety and property of users, businesses or the public.

We do not sell your personal information.

The platform is hosted on managed cloud infrastructure located in the United Kingdom. For customers in the European Economic Area, this is a transfer to a country the European Commission has found to provide an adequate level of protection.

For South African customers this means personal information is transferred outside South Africa. The business you deal with is the responsible party for that transfer under section 72 of POPIA; PebblePay acts as its operator and is contractually bound to a comparable standard of protection for the information it holds on that business’s behalf.

We keep your personal information for as long as your account is active and as long as we need it for the purposes above. You can permanently delete your account at any time — in the app under Profile → Delete account, or on the web at pebblepay.online/account/delete.

Deleting your account removes or anonymises your personal information, revokes your access to every business, and disables sign-in. Some records — for example transaction and accounting records — may be retained for the period the law requires, but they are anonymised so they are no longer linked to you.

Information is encrypted in transit using standard HTTPS/TLS. Access is restricted by per-business database rules and least-privilege controls, and optional two-factor authentication is available on your account. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.

Subject to the applicable law, you may request access to the personal information we hold about you, ask us to correct or update it, object to or restrict certain processing, and request its deletion (see “deleting your account” above). Where processing is based on consent, you may withdraw that consent.

To exercise a right, contact us at the address below. If you are in South Africa you also have the right to complain to the Information Regulator; in the EU/UK, to your local data protection authority.

The website uses only the cookies needed to keep you signed in and to remember the business you are operating. We do not use advertising cookies.

We may update this policy as the service changes or the law requires. We will change the version date at the top, and material changes will be brought to your attention where appropriate.

Questions or requests about your privacy: privacy@pebblepay.online, addressed to PebblePay.

If you are in South Africa and are not satisfied with our response, you may complain to the Information Regulator. In the EEA you may complain to your national supervisory authority, or to the Office of the Commissioner for Personal Data Protection in Cyprus, and in the UK to the ICO.

For matters concerning a specific business (for example your membership or an order), contact that business directly; it is the responsible party for its relationship with you.