Privacy Policy

AviateClubHub ([registered company name and registration number — to be confirmed]) is a South African software-as-a-service platform that provides operational management tools — including golf operations, hospitality and point of sale, sports bookings, estate management, events, HR and finance — to golf clubs, country clubs, sports facilities, hospitality venues and residential estates ("participating clubs").

This policy explains how personal information is collected and processed when you use the AviateClubHub platform, whether as a club administrator, staff member, club member, resident or visitor, in accordance with the Protection of Personal Information Act, 2013 (POPIA).

When a participating club uses AviateClubHub to manage its members, bookings, orders and operations, the club is ordinarily the responsible party under POPIA for the personal information of its members, guests and staff, and AviateClubHub acts as an operator processing that information on the club's instructions.

For information we collect about the clubs themselves and their authorised users (for example platform account details, billing and support records), AviateClubHub is the responsible party. Each participating club remains responsible for its own privacy notices to its members and for lawfully collecting the information it loads onto the platform. Data belonging to one club is isolated from every other club on the platform.

Depending on how you use the platform, the following may be processed:

• Identity and contact details — name, email address, phone number.
• Account details — login credentials, role and access permissions, club affiliation.
• Membership and booking information — memberships, tee times, court bookings, event attendance.
• Transaction information — orders, payments, wallet balances, invoices and statements.
• Employment information (staff of participating clubs) — rosters, attendance, payroll-related records loaded by the club.
• Technical information — device and browser type, IP address, usage logs and security audit trails.
• Communications — support requests, consent records and marketing preferences.

• Providing and operating the platform and the club services you request (bookings, orders, memberships, payments).
• Authenticating users and enforcing role-based access.
• Billing, accounting and financial reconciliation for participating clubs.
• Service communications (booking confirmations, receipts, account notices).
• Direct marketing only where permitted by POPIA and your recorded consent preferences.
• Security, fraud prevention, auditing and compliance with legal obligations.
• Aggregated, de-identified analytics to improve the platform.

The platform uses strictly necessary cookies and browser storage to keep you signed in, remember preferences (such as a selected branch) and secure your session. We do not use third-party advertising cookies. If analytics cookies are introduced, this policy will be updated and consent obtained where required.

We use a limited number of service providers to operate the platform, each bound by contractual confidentiality and security obligations, including:

• Cloud hosting and database infrastructure (application and data hosting).
• Payment service providers, for processing card and online payments (payment card details are processed by the provider, not stored by AviateClubHub).
• Email delivery services, for transactional messages.
• AI model providers, for the optional Jarvis assistant (see section 11).
• Social media platforms, only where a club connects its own accounts (e.g. Facebook).

We apply appropriate, reasonable technical and organisational measures as required by section 19 of POPIA, including encrypted transmission (HTTPS), role-based access control, tenant-level data isolation between clubs, audit logging of access and permission changes, and secured credential storage. No system is completely secure; if a data breach occurs that is likely to cause harm, affected parties and the Information Regulator will be notified as required by section 22 of POPIA.

Personal information is kept only as long as needed for the purposes above, for the duration of the club's use of the platform, and thereafter as required by law (for example, financial and tax records retained for the periods prescribed by South African tax and company legislation). Records no longer required are deleted or de-identified.

Some service providers (such as cloud hosting and AI model providers) may store or process information outside South Africa. Where this occurs, we ensure the recipient is subject to laws, binding corporate rules or contracts providing substantially similar protection to POPIA, as required by section 72 of POPIA.

Under POPIA you may:

• Request confirmation of, and access to, the personal information we hold about you.
• Request correction or deletion of inaccurate, outdated or unlawfully held information.
• Object to processing, including for direct marketing, at any time.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Information Regulator (South Africa) — inforeg.org.za.

Where your information is held on behalf of a participating club, we may refer your request to that club as the responsible party, and will assist the club in responding.

Clubs may use the optional Jarvis AI assistant to query their own operational data. Queries and relevant club data are processed by a third-party AI model provider to generate responses. Jarvis only accesses data of the club the user belongs to, and its outputs are informational — they are not used to make automated decisions with legal effect about you.

Privacy enquiries and POPIA requests: [information officer name — to be confirmed], [privacy contact email address — to be confirmed], [registered business address — to be confirmed]. You can also reach us via the contact page.

We may update this policy from time to time. The "Last updated" date above reflects the current version, and material changes will be communicated through the platform.