Privacy policy

1. Who is responsible for your information

Campflow is the responsible party for the personal information described in this policy. Our information officer handles questions, access requests and complaints about how we process your information. The information officer’s details are in section 10 below.

2. What we collect

We collect only what we need to run the programme:

• Identity and contact details — your full name, email address, WhatsApp or phone number and, where relevant, identification required to verify eligibility and complete payouts.
• Application information — your social media handles and links, your approximate follower count, the share of your audience you estimate is in South Africa, and why you want to join.
• Account information — your role and account status, and the dates on which you gave consent, confirmed you are 18 or older, accepted the creator agreement, and, where applicable, completed identity and bank verification.
• Programme activity — the campaigns assigned to you, the tracking links issued to you, your content submissions and their approval history.
• Aggregated click data — the date and time of a click, the referring website host, an approximate country, and whether the click was flagged as a bot. Visitor IP addresses are never stored in raw form: we store only a keyed cryptographic hash, which cannot be reversed to an address.
• Financial information — your payout method, the bank account details you supply for payouts, and the commission, payout and adjustment records linked to you. Bank details are encrypted before they are stored.
• Technical information — limited server logs needed to keep the service secure and available.

We do not collect special personal information, we do not buy personal information from data brokers, and we do not ask you for more than the programme needs.

3. Why we collect it and on what basis

• To assess your application — on the basis of your consent and our legitimate interest in selecting suitable creators.
• To operate your account and campaigns — performing our agreement with you.
• To review your promotional content — performing our agreement and meeting the obligations imposed by affiliate networks and advertisers.
• To record and verify conversions and calculate commission — performing our agreement and meeting our financial record-keeping duties.
• To pay you — performing our agreement, and complying with tax, anti-fraud and financial obligations.
• To prevent fraud and invalid traffic — our legitimate interest in protecting the programme, and the interests of networks and advertisers.
• To meet legal obligations — where law requires us to keep or disclose information.

Where we rely on consent, you may withdraw it at any time. Withdrawing consent may mean we can no longer operate your account, and we will explain the consequences before acting.

4. Who we share it with

• Affiliate networks and advertisers — limited to what is needed to attribute a conversion, verify its validity and satisfy their compliance checks. This normally means your unique tracking identifier rather than your personal details.
• Payment and banking providers — to make payouts to you.
• Service providers — hosting, email and infrastructure providers who process information on our instructions under appropriate confidentiality obligations.
• Authorities — where we are legally required to disclose information.

We do not sell your personal information. Where a service provider processes information outside South Africa, we take reasonable steps to ensure the transfer is lawful and that comparable protection applies.

5. How long we keep it

• Applications that are declined or withdrawn — retained for a short period so we can answer questions about the decision, then deleted.
• Active creator records — kept while your account is active.
• Financial records — commission, conversion, payout and ledger records are kept for as long as required by South African tax and financial record-keeping obligations, even after your account closes. These records are needed to explain every amount attributed to you.
• Click data — kept for a limited period sufficient for reporting and fraud prevention, then deleted or further aggregated.

6. How we protect it

• Access to personal information is limited to those who need it, and administrative actions are logged.
• Bank details are encrypted before storage and are never displayed to creators through the programme or written to logs.
• Visitor IP addresses are never stored in raw form, only a keyed hash is retained.
• Passwords are stored as one-way hashes by our authentication layer, and sign-in is rate limited.
• Traffic is served over HTTPS, and security headers are applied to every response.
• Where a security compromise affecting your information occurs, we will notify you and the Information Regulator as POPIA requires.

7. Cookies

The public website does not use advertising or third-party tracking cookies. We use a small number of strictly necessary cookies and equivalents to keep the site and the application form working securely, for example to carry a one-time form result and to protect against cross-site request forgery. These are not used to build a profile of you or to serve adverts.

If you follow a creator’s tracking link, a click is recorded as described in section 2. That record contains no raw IP address and no personal identifiers beyond the hashed values described above.

8. Your rights

Under POPIA you have the right to:

• be told whether we hold personal information about you and to receive a copy of it;
• ask us to correct or update information that is inaccurate, misleading or out of date;
• ask us to delete or destroy information that we are no longer authorised to keep;
• object to processing in certain circumstances, and to withdraw consent where consent is the basis;
• object to unsolicited electronic marketing; and
• lodge a complaint with the Information Regulator.

9. How to request access, correction or deletion

Email our information officer using the address in section 10, or use any contact route published on this site, and tell us what you want. We will respond within a reasonable period, and in any event within the time required by POPIA. We may ask you to verify your identity before we act, so that we do not disclose your information to someone else.

Some records cannot be deleted on request, for example financial records we must keep by law, and records needed to resolve a dispute or an open investigation. Where that is the case, we will tell you why and for how long we must keep them.

10. Our information officer

Name: Emmanuel Shima
Email: [email protected]

11. Complaints to the Information Regulator

If you are unhappy with how we have handled your information, please raise it with our information officer first, because most issues are resolved quickly that way. If you are still not satisfied, you may lodge a complaint with the Information Regulator (South Africa), which is the body that enforces POPIA.

The Information Regulator publishes its complaint procedures, forms and current contact details on its official website: inforegulator.org.za. Use the contact details published there rather than any address quoted elsewhere, so that your complaint reaches the correct office.

12. Age

The programme is for people aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with information, contact our information officer and we will remove it.

13. Changes to this policy

We may update this policy. The version published on this page applies, and we update the “last updated” date when it changes. Material changes will be brought to your attention where we are able to do so.