Kamp-Mal Privacy Policy

Last updated: 12 May 2026 · Compliant with the Protection of Personal Information Act, 4 of 2013 (POPIA), Republic of South Africa.

1. Who we are (Responsible Party)

Effekt Studios is the responsible party under POPIA for any personal information processed through the Kamp-Mal mobile application, the Kamp-Mal web app, kampmal.co.za, kampmalwinkel.co.za, and any related services (collectively, the "Service").

• Trading name: Effekt Studios
• Product: Kamp-Mal — the South African camping & overlanding ecosystem
• Country of establishment: Republic of South Africa
• General contact: hello@effektstudios.com
• Support: support@effektstudios.com

2. Information Officer & how to reach us

In line with section 56 of POPIA, Effekt Studios has appointed an Information Officer to oversee compliance and to receive your data-subject requests and complaints.

• Information Officer: Franco Landman (Effekt Studios)
• Email: privacy@effektstudios.com
• Response target: we acknowledge data-subject requests within 7 business days and aim to resolve them within 30 days, in line with POPIA timelines.

3. Scope and your acceptance

This policy applies to all individuals who download, install, register for, or use the Service. By creating a Kamp-Mal account or by continuing to use the Service, you confirm that you have read and understood this policy and, where required, you consent to the processing described.

You may withdraw consent at any time (see section 12). Withdrawing consent for required processing will mean we can no longer provide the related feature.

4. What personal information we collect

4.1 Information you provide directly

• Account & profile: name (or display name), email address, optional phone number, optional profile photo, optional date of birth, preferred language, theme preference.
• Digital Garage: vehicle, trailer, caravan, boat, and pet details you add (make, model, registration, licence-disk data scanned via your camera, photos, towing weights, service history).
• Trips, routes & journal: destinations, dates, itineraries, meal plans, shopping lists, packing lists, recorded GPS routes, photos, notes, and journal entries.
• Insurance vault: documents you upload (policies, certificates) — encrypted at rest.
• FICA verification: identity document and proof-of-address documents, if you choose to verify for the Marketplace.
• Marketplace: listings (photos, descriptions, prices, location), orders, shipping addresses, dispute correspondence, and ratings.
• Campfires: group memberships, chat messages, shared photo albums, scorecards, and chore assignments.
• Signal reports & points of interest: network operator, signal strength, GPS coordinates, photos, and notes you submit.
• Emergency contacts: names and phone numbers of the people you nominate for SOS alerts.
• Communications: messages you send to other users, support requests, and feedback you submit.

4.2 Information collected automatically

• Location data: precise GPS coordinates while you actively use route recording, signal submission, the SOS feature, "Near Me", or the map. Location is sampled only while the relevant feature is active and only with the operating-system permission you have granted.
• Device & technical data: device model, operating-system version, app version, language and region settings, IP address, mobile-network operator (where the OS exposes it), push-notification token, and crash diagnostics.
• Usage analytics & crash reports: screens visited, feature interactions, and error stack traces, gathered via Firebase Analytics and Firebase Crashlytics.
• Advertising identifiers: on Android we read the Advertising ID via Google Mobile Ads SDK for non-personalised in-app advertising (free tier only). You can reset or limit this through your device settings.

4.3 Information from third parties

• Sign-in providers: if you sign in with Google or Apple, we receive your name, email, and profile photo from that provider.
• Payment providers: PayFast (for once-off and subscription card payments) and the Apple App Store / Google Play Billing (for in-app purchases) provide us with transaction status and reference numbers. We never see or store your card number, CVV, or full bank details.
• Shipping providers: The Courier Guy returns waybill and tracking events for Marketplace orders.

5. Why we process your information (purpose & lawful basis)

POPIA requires us to tell you, for each category of processing, why we do it and on what lawful basis. Our processing falls into the buckets below.

6. Special personal information & information about children

Kamp-Mal is not designed to collect special personal information (POPIA §26): we do not require race, health, religion, sexual orientation, political opinions, trade-union membership, criminal behaviour, or biometric identifiers. If you choose to upload such information (for example, by writing about a medical condition in a trip journal entry) you do so at your own initiative and remain responsible for that content.

Children: the Service is intended for users aged 18 years or older. We do not knowingly process the personal information of children. If you are a parent or guardian and believe a child has registered for the Service, please email privacy@effektstudios.com so we can deactivate the account and delete the data, in line with POPIA §34–35.

7. Operators (data processors) we use

We use trusted operators to run Kamp-Mal. Each operator processes personal information only on our written instructions and under appropriate confidentiality and security obligations.

8. Cross-border transfers

Some of the operators above store or process personal information outside South Africa, primarily in the United States and the European Union. In line with POPIA §72, we only transfer personal information across borders where at least one of the following applies:

• You have consented to the transfer (for example, by signing up for the Service);
• The transfer is necessary to perform a contract with you or to take steps at your request before entering a contract;
• The recipient is subject to laws, binding corporate rules, or contractual safeguards (for example, Google's Standard Contractual Clauses and POPIA addendum) that provide an adequate level of protection.

9. Sharing with other users and the public

• Profile: your display name, profile photo, and "FICA verified" status (if applicable) are visible to other users when you participate in campfires, marketplace listings, signal reports, or public points of interest.
• Marketplace: your listing photos, descriptions, prices, town/province, and seller rating are public. Buyers see your shipping address; sellers see the buyer's shipping address after a successful payment.
• Campfires: content you post in a campfire (messages, photos, chores, scorecard entries) is visible to other campfire members.
• Signal map & POIs: the network type and coordinates you submit feed an aggregated community map. Your display name appears alongside POIs you contribute.
• Routes & journal: private by default. They become public only if you explicitly mark a route as public or share it.
• Insurance vault & FICA documents: never shared with other users; only available to you and to our compliance reviewers when verification is in progress.

10. How long we keep your information (retention)

11. Security safeguards

In line with POPIA §19, we apply appropriate, reasonable technical and organisational measures to protect personal information:

• All client <> server traffic is encrypted in transit via HTTPS / TLS.
• Data at rest is encrypted by Firebase (Google Cloud) using AES-256-equivalent encryption. Insurance vault documents receive an additional application-level encryption layer.
• Access to backend systems requires multi-factor authentication.
• Firestore security rules and Firebase App Check are configured so users can only read & write data they own.
• Production access to operator dashboards is limited to a small set of named Effekt Studios personnel.
• We log security events and review them periodically.

No internet-based service can be guaranteed 100% secure. If we suffer a security compromise that affects your personal information, we will notify you and the Information Regulator without undue delay, as required by POPIA §22.

12. Your rights under POPIA

You have the following rights with respect to your personal information:

• Access — confirm whether we hold information about you and obtain a copy (POPIA §23).
• Correction or deletion — ask us to correct inaccurate or out-of-date information, or delete information we are no longer entitled to keep (POPIA §24).
• Object — object to the processing of your personal information on reasonable grounds (POPIA §11(3)).
• Withdraw consent — where we rely on your consent, you can withdraw it at any time (this will not affect lawful processing that happened before the withdrawal).
• Data portability — request an export of your information in a structured, machine-readable format.
• Complain — lodge a complaint with the Information Regulator (see section 18).

To exercise any of these rights, email privacy@effektstudios.com. We may need to verify your identity before we act on a request. The Regulator's Form 1 (Request for Correction or Deletion) and Form 2 (Objection) are accepted.

13. Automated decisions (AI features)

Kamp-Mal includes AI-assisted features such as trip planning, gear suggestions, and the camping assistant chat. These features generate suggestions only and never make decisions that have legal or significant effects on you (POPIA §71). You remain in control: every itinerary or list the AI produces is editable before you save it. Prompts are sent to Anthropic via our Cloud Functions; we do not share your contact details, identity documents, or financial information with the AI provider.

14. Direct marketing

We will only send you direct marketing — for example product updates, new partner offers, or competitions — if you have given explicit opt-in consent or are an existing customer for similar Kamp-Mal products (POPIA §69). Every marketing communication includes a one-click unsubscribe link or an in-app toggle. We never sell your contact details to third parties for marketing purposes.

15. Cookies, analytics & advertising identifiers

The Kamp-Mal web app uses a small number of first-party cookies and similar storage technologies to keep you signed in, remember your language and theme preference, and measure crashes and usage. The native apps use device-level identifiers (the Advertising ID on Android and the IDFA on iOS) only where you have allowed tracking in the operating-system prompt or via Google's User Messaging Platform (UMP) consent banner.

You can review and change your consent at any time:

• In-app: Settings → Privacy & Consent (re-open the UMP form).
• Device: reset or disable your advertising identifier in iOS Settings or Android Settings.
• Web: clear cookies for kampmal-ca490.web.app and kampmal.co.za in your browser.

16. Account deletion

You can delete your Kamp-Mal account at any time from Settings → Account → Delete Account, or by visiting kampmal-ca490.web.app/delete-account.html.

When you delete your account we permanently remove:

• Your profile and Digital Garage (vehicles, trailers, pets, boats).
• Your trips, routes, journal entries, packing & meal plans, saved campsites, trip invitations.
• Your insurance vault documents and emergency contacts.
• Your marketplace listings, signal reports, journal photos.
• Your campfire memberships (your contributions inside group albums and chats remain visible to the other group members but are detached from your identity).
• Files you uploaded under users/{your-uid}/ in Firebase Storage (avatars, vehicle photos, FICA documents, etc.).
• Your Firebase Authentication record.

Some records we are legally required to keep for the periods set out in section 10 (marketplace transactions, tax invoices, FICA records). These are retained in anonymised form where possible.

17. Changes to this policy

We will update this policy from time to time. Material changes will be communicated through an in-app notice and/or push notification at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

18. How to lodge a complaint with the Information Regulator

If you are not satisfied with how we have handled your personal information or your data-subject request, you may complain to the Information Regulator of South Africa:

• Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email (POPIA complaints): POPIAComplaints@inforegulator.org.za
• Email (general enquiries): enquiries@inforegulator.org.za
• Website: https://inforegulator.org.za

We would, however, appreciate the chance to address your concern first — please reach out to privacy@effektstudios.com before escalating.

19. PAIA Manual

Effekt Studios maintains a Manual under section 51 of the Promotion of Access to Information Act, 2 of 2000 (PAIA). The PAIA Manual sets out the categories of records we hold and how to request access. You can request a copy by emailing privacy@effektstudios.com.