PRIVACY NOTICE

This notice explains what personal information we collect when you play Play to Win, why we collect it, and what rights you have. Please read it before you enter your mobile number.

1. Who we are

The responsible party for the personal information described in this notice is:

Beactivelife.COM (Pty) Ltd (2019/025287/07), trading as be.UP Park
Address: 25 Stegman Road, Claremont, Cape Town, Western Cape
Information Officer: Damon Walmsley, COO
Privacy contact: hello@beactivelife.com

Prize codes can be redeemed at participating be.UP Park, Rush and Playstation by Rush parks. Where a prize is redeemed at a park run by a different operating company in our family of parks, the minimum detail needed to honour the code (the code itself and its status) is shared with that company for that purpose only.

2. What we collect and why

• Your mobile number — the key to your monthly play: one play per verified mobile number per calendar month. We text you a one-time code to confirm it is yours, and we use it to deliver your prize code by SMS where you give no email address.
• A one-time verification code (OTP) — to confirm the number is really yours. We generate it; you type it back in. It is never stored in a readable form.
• Your name, email address and home park — to run the game, show your PlayPass, and send your prize code and its expiry date. Prize and verification messages are service messages and are not affected by your marketing choice.
• Marketing choice — whether you want the monthly play reminder and offers by email and SMS. You can untick the box when you register and unsubscribe at any time, free, with one tap.
• Your child's first name and birthday (day and month only — never the year) — only if you choose the marketing option and add your child, and used only to send birthday messages to you, the parent or guardian. We never ask for or store a child's year of birth, surname or any other detail.
• Your park waiver details — if your mobile number matches a family waiver you completed at the park, we show you your name, a masked email and your children's first names from it, purely to save you typing; you tick the children who are yours and only those are kept. If you chose the marketing option and the waiver already holds a ticked child's birthday, we take the day and month from it rather than ask you again. The masked email is display-only and is never stored by Play to Win.
• Play records — which prizes you won, your prize codes, your streak, and a record of what you agreed to (your phone number in a hashed, non-reversible form plus the last 4 digits, the time, and your consent choices). Competition records are kept as the Consumer Protection Act requires.

3. Our legal basis

• Running the game and delivering prizes — performance of the promotional competition you enter, and our legitimate interest in running it fairly and preventing abuse (the OTP check, play limits and bot protection).
• Marketing messages — your choice at registration, recorded with its date and wording version. Every marketing message carries a free, one-tap unsubscribe. If you opt out, we also record that opt-out against your family's record in our customer system so other be.UP Park marketing respects it.
• Your child's birthday — your consent as parent or legal guardian ("competent person" consent, POPIA section 35(1)(a)), given by entering it under the marketing option. You can withdraw it at any time, which stops the birthday messages.

4. Who we share information with

We use a small number of service providers ("operators" under POPIA). They may only use your information to provide their service to us, under written agreement, never for their own purposes:

• Email delivery (Resend) — sends prize, verification and (if chosen) reminder and birthday emails. Birthday emails include your child's first name. Processes in the United States.
• SMS delivery (BulkSMS) — sends your one-time code and, where needed, your prize code. Processes in South Africa, with standard SMS network routing.
• Cloud hosting (Google Cloud) — hosts the game, the database and our scheduled jobs. Processes in the European Union.
• Bot protection (Google reCAPTCHA Enterprise) — confirms a real person is playing. Processes in the United States.
• Customer system (Salesforce) — holds your family's park waiver, which we look up (after you verify your number) to pre-fill the form, and where we record a marketing opt-out. Processes in the United Kingdom and United States.

Where processing happens outside South Africa we rely on contractual protections requiring a standard consistent with South African law (POPIA section 72). We never sell your information.

5. How we protect it

Connections are encrypted. Verification codes and phone-number records used for abuse detection are stored hashed. Prize codes display in full only once, in the winning session. Sessions expire automatically, and every returning screen carries a "Start over" control that signs the device out. Child names and birthdays never appear in our logs, alerts or exports.

6. Your rights

Under POPIA you may ask what we hold about you and your child, ask us to correct or delete it, object to processing on reasonable grounds, opt out of marketing at any time free of charge, and withdraw the consent described above. Contact hello@beactivelife.com or our Information Officer, Damon Walmsley. We respond within 30 days. If you are not satisfied you may complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za · 010 023 5200 · toll-free 0800 017 160 · eservices.inforegulator.org.za.

7. Children's information

Only a parent or legal guardian can consent to a child's information being processed. The only child information Play to Win holds is a first name and a birthday day and month, entered by you or taken from your park waiver as described above, used only for the birthday messages sent to you. It is never shown to anyone else, never shared with the parks' partners, and never used for any other purpose. Withdraw consent at any time via hello@beactivelife.com or by unsubscribing from marketing, which stops birthday messages. When you remove a child, we stop using their details straight away; we keep the first name with your account, and delete it with your account, only so the same child cannot be added again for a second birthday benefit.

8. Cookies

The game uses a session cookie (keeps you signed in; expires automatically) and Google's reCAPTCHA cookie (bot protection). No analytics, advertising or tracking cookies.

9. Retention — how long we keep your information

• Your account — deleted after 24 months without a visit (we email a warning first if you chose marketing).
• Sign-in sessions — expire automatically; absolute limit 6 months.
• Play, prize-code and streak records — 3 years after the competition cycle, as the Consumer Protection Act requires; once your account is deleted these are kept only in anonymous form.
• The audit record of what was agreed and done — 5 years (hashed number and last 4 digits, never a child's name).
• Abuse-prevention counters and system alerts — 90 days.

After these periods information is deleted or made anonymous by an automatic nightly process.

10. Changes to this notice

We may update this notice from time to time — for example if a service provider changes. The date at the top shows when it last changed.