Privacy Notice

To operate our two-sided gig marketplace and fulfil our legal and operational obligations, we collect the following categories of Personal Information.

We process your Personal Information strictly for specified, explicit, and lawful purposes in accordance with POPIA Condition 3 (Purpose Specification):

• Service delivery & gig allocation: To enable account registration, manage Gig Requests and Gig Posts, render interactive location maps, and facilitate communication between Buyers and Merchants.
• Financial execution & escrow management: To transmit transactional data to our regulated partner for operating secure escrow holding accounts and payouts.
• Identity verification & compliance (KYC/FICA): To perform automated real-time identity verification checks, combat financial crime, fraud, money laundering, and comply with legal mandates.
• Platform security & dispute resolution: To arbitrate escrow disputes, review uploaded job completion evidence, enforce our Terms of Use, and detect suspicious or fraudulent activity.
• App stability & performance: To monitor software crashes, optimise data usage for low-bandwidth devices, and debug platform errors.

In order to run the platform without operating as an unlicensed bank or accountable institution, Daala securely shares data with specialised, regulated third-party operators under strict data-processing agreements, as set out in the table above.

We implement robust administrative, technical, and physical safeguards to protect Personal Information from loss, misuse, unauthorised access, disclosure, alteration, or destruction, as required by Section 19 of POPIA:

• In-transit encryption: All communications between the mobile application frontend, cloud databases, and third-party API endpoints are encrypted using industry-standard SSL/TLS protocols.
• At-rest encryption: Personal identifiers, chat messages, and account details stored within database environments are protected with server-side encryption key management.
• Device storage policy: No sensitive financial credentials or official South African ID documents are stored locally on your mobile device.
• Access control: Personnel access to user data is restricted on a strict need-to-know basis and protected by multi-factor authentication.

Because Daala uses serverless cloud computing infrastructure (such as Google Firebase), your encrypted Personal Information may be transferred to, processed, and stored on cloud servers located outside the Republic of South Africa.

Where cross-border data transfer occurs, Daala ensures compliance with Section 72 of POPIA by confirming that:

• The recipient foreign cloud host is subject to data privacy laws, corporate rules, or binding agreements that provide an adequate level of protection equivalent to POPIA; and
• The transfer is necessary for the performance of the contract between you and Daala.

As a data subject under South African law, you hold the following explicit rights regarding your Personal Information:

• Right to access (Section 23): You have the right to request confirmation of whether we hold Personal Information about you and receive a copy of that record.
• Right to correction/deletion (Section 24): You have the right to request the correction, updating, or deletion of inaccurate, irrelevant, out-of-date, incomplete, or unlawfully obtained data.
• Right to object (Section 11(3)): You may object on reasonable grounds to the processing of your Personal Information, subject to applicable contractual or statutory obligations.
• Right to object to direct marketing (Section 69): You may opt out of receiving direct electronic marketing communications at any time by using the “unsubscribe” link or toggling notifications in the app settings.
• Right to lodge a complaint: You have the right to lodge a complaint with the South African Information Regulator if you believe your data privacy rights have been infringed.