Privacy & POPIA Policy

This Privacy and POPIA Compliance Policy explains how GuestDrop ("GuestDrop", "we", "us", or "our"), operated by CodeWays (Pty) Ltd, acts as a "Responsible Party" under the Protection of Personal Information Act, No. 4 of 2013 (POPIA) and the Promotion of Access to Information Act, No. 2 of 2000 (PAIA).

GuestDrop provides a friction-free, web-based group photo and video sharing platform designed for events, vacations, weddings, milestone birthdays, celebrations, corporate offsites, and gatherings. Our platform allows hosts to create shared event albums and allows attendees to instantly contribute media via QR code or shared link without forcing any mobile application installation.

In strict compliance with POPIA Condition 2 (Processing Limitation) and data minimisation principles, GuestDrop collects only the personal information strictly necessary to operate our event photo sharing service:

We operate under strict ethical data policies:

• No Selling or Licensing: We never sell, lease, monetize, or license your photos or personal data to advertisers, brokers, or third parties.
• No AI Model Training: Your private photos, faces, and audio guestbook notes are never ingested, used, or processed to train machine learning or generative AI models.
• Private by Default: Event galleries are accessible only to individuals with the event QR code, link, or host-configured password/PIN.
• High-Resolution Preservation: We preserve original capture fidelity and deliver untampered, original full-resolution files to the host via 1-click ZIP export.

When purchasing an event pass on GuestDrop:

• Card details and CVV security codes are entered directly into the PCI-DSS compliant checkout iframe/gateway and never touch our servers.
• All payment transmissions are strictly secured with end-to-end TLS 1.3 cryptographic encryption.
• GuestDrop receives only an encrypted authorization token and transaction reference verifying that payment has cleared.

Under Section 11 of the Protection of Personal Information Act, personal information may only be processed on recognized lawful grounds. GuestDrop processes data under the following legal bases:

GuestDrop strictly restricts email and electronic messages to essential transactional service notices:

Under POPIA Sections 20 and 21, third-party service providers who process data on our behalf are classified as "Operators". All GuestDrop operators are vetted and bound by strict written data processing agreements requiring state-of-the-art security:

GuestDrop utilizes high-speed distributed edge cloud infrastructure to provide ultra-fast photo uploads worldwide. Consequently, encrypted media files may be transmitted or cached across international cloud data center nodes.

In strict compliance with Section 72 of POPIA, all cross-border data transmissions occur only to jurisdictions that maintain adequate legal data protection standards substantially equivalent to POPIA (such as GDPR-compliant European and UK jurisdictions), or under robust contractual clauses ensuring recipient compliance with equivalent privacy safeguards.

In accordance with POPIA Section 19, we apply comprehensive physical, technical, and operational measures to safeguard personal data against loss, damage, or unauthorized access:

In compliance with POPIA Section 14, personal data is retained only for the duration necessary to deliver the service or satisfy legal record obligations:

• Standard Event Albums: Every event pass includes 31 days of active gallery access and high-res ZIP downloads following the conclusion of the event. Hosts receive reminder emails at 30 days, 14 days, 7 days, 3 days, and 24 hours before expiration.
• Permanent Post-Expiration Purging: After the 31-day retention window expires, all stored photos, videos, and associated media are automatically and permanently purged from Cloudflare R2 cloud storage.
• Immediate Host Deletion: Hosts have complete authority to delete individual photos or purge their entire event album at any time via the Host Console.
• Financial & Tax Records: Invoiced billing transactions are retained for 5 years as required by the Tax Administration Act and Companies Act.

GuestDrop empowers event hosts and guests with intuitive privacy and moderation tools:

Under Section 35 of POPIA, the processing of personal information concerning children (persons under 18 years of age) is prohibited unless carried out with the consent of a parent, legal guardian, or competent person.

GuestDrop is designed for general family events, weddings, and celebrations. When photos containing minors are uploaded by attendees, the host and uploader warrant that they have obtained the necessary consent from the child's parent or legal guardian. If a parent or guardian wishes to have any photo containing their child removed, they may contact us at [email protected] for expedited takedown.

As a Data Subject under the Protection of Personal Information Act, you hold explicit statutory rights regarding your personal information:

To exercise any of these statutory rights, please submit a written request to our Information Officer at [email protected]. We respond to verified data subject requests within thirty (30) calendar days without undue delay.