Bodywork4men

Your privacy

Privacy & POPIA policy

This policy explains what personal information we collect, why we collect it, who we share it with, and the rights you have under the Protection of Personal Information Act, 2013 (POPIA). It is written to reflect how this platform actually handles your data.

Last updated: 25 July 2026

1. Who we are

Bodywork4men (“we”, “us”, “our”) is a men’s wellness organisation offering events, retreats and related content. For the purposes of POPIA we are the Responsible Party for the personal information described in this policy.

Legal entity: [registered legal name]
Registration number: [company/registration number, if applicable]
Address: [registered / physical address]

2. Adults only (18+)

This platform is intended for adults aged 18 and over and may reference adult wellness themes. We do not knowingly collect personal information from anyone under 18. By using the site and its services you confirm that you are at least 18 years old. If you believe a minor has provided us with personal information, contact us and we will delete it.

3. Our Information Officer

POPIA questions, requests and complaints can be directed to our Information Officer:

[Information Officer name]
Email: [privacy@bodywork4men.co.za or equivalent]
Address: [postal address for privacy requests]

Our Information Officer is (or will be) registered with the Information Regulator of South Africa as required by POPIA.

4. The personal information we collect

Depending on how you use the site, we may collect:

  • Account & identity. Your name, email address and profile photo, obtained when you register or sign in — including where you choose to sign in with Google or Apple.
  • Contact & emergency details. For retreats and events: your full name, preferred name, phone number, and the name, relationship and phone number of an emergency contact you provide.
  • Special-category health information. Where you complete a retreat or event profile, we may collect dietary requirements, allergies, medical conditions, medications, injuries or physical limitations, and any additional notes you share. This is special personal information under POPIA — see section 5.
  • Bookings & interests. The events and retreats you register for or express interest in, retreat applications, and related booking status.
  • Communications & marketing. Newsletter sign-ups and your marketing preferences, and a record of the consent you gave.
  • Consent & age-confirmation records. A log of consents you provide (for example, confirming you are over 18, or agreeing to marketing), kept so we can show what you agreed to and when.
  • Technical information. Basic information needed to run the site securely, such as your authentication session and rate-limiting data. We do not currently run advertising or third-party analytics trackers (see section 11).

We do not store your card or bank details. Payments for tickets are handled by our ticketing partner (see section 8).

5. Special personal information (health)

Health information is treated as special personal information under POPIA and is subject to additional protection. We process it only:

  • with your explicit, voluntary consent; and
  • where it is necessary to run an event or retreat safely — for example so that facilitators can accommodate dietary needs, allergies, medications or physical limitations.

This information is encrypted at rest using managed encryption keys and is accessible only to authorised staff who need it. When a staff member views it, that access is recorded in an audit log. You choose separately whether it may be shared with the facilitators leading your event, and you can withdraw that consent at any time.

6. Why we use your information, and our lawful basis

Under POPIA we process personal information on one or more of these grounds:

  • To provide our services (contract): creating and managing your account, processing event and retreat bookings, and communicating with you about them.
  • With your consent: sending marketing emails, processing health information, and sharing your details with facilitators.
  • Legitimate interests: keeping the platform secure, preventing abuse, and maintaining records such as audit logs and consent history.
  • Legal obligations: where we are required to keep or disclose information by law.

7. Consent, and how to withdraw it

Where we rely on your consent — for marketing, for processing health information, or for sharing your details with facilitators — that consent is voluntary and you can withdraw it at any time. You can unsubscribe from marketing using the link in any email or from your account, and you can update or withdraw other consents by contacting our Information Officer. Withdrawing consent does not affect processing that already took place, and some services may not be available without the information they require.

8. Who we share your information with

We do not sell your personal information. We share it only with the following categories of recipients, and only as far as needed:

  • Facilitators leading an event or retreat you attend — including the health information you have consented to share with them.
  • Our staff, on a need-to-know basis, to run events and support you.
  • Service providers (Operators) who process information on our behalf under contract, including:
    • Google Firebase — authentication, database, file storage and supporting infrastructure;
    • Vercel — website hosting;
    • Quicket — ticketing and payment processing (they handle payment details directly under their own privacy terms);
    • Campaign Monitor — sending newsletters and transactional email;
    • Google and Apple — where you choose to sign in with their accounts, and Google Maps where venue maps are shown.
  • Authorities, where we are legally required to disclose information.

9. Information sent outside South Africa

Some of the service providers above store or process information on servers outside South Africa. Where personal information is transferred across borders, we take reasonable steps to ensure it is protected to a standard comparable to POPIA — for example through providers who are bound by appropriate data-protection commitments. By using the site you acknowledge that your information may be processed outside South Africa for these purposes.

10. How long we keep your information

We keep personal information only for as long as we need it for the purposes described here, or as required by law. Account and profile information is kept while your account is active; booking, consent and audit records are kept for a reasonable period afterwards for legal, safety and record-keeping reasons; and marketing information is kept until you unsubscribe. When information is no longer needed we delete or de-identify it. [Confirm specific retention periods with your advisor.]

11. Cookies and local storage

We use only the cookies and browser storage needed to make the site work: an authentication session so you stay signed in, a record that you have dismissed the 18+ notice, and small preferences such as remembered list filters in the admin area. We do not currently use advertising cookies or third-party analytics trackers. If this changes, we will update this policy.

12. How we protect your information

We take appropriate technical and organisational measures to protect your information, including encryption of sensitive data at rest, encrypted connections, role-based access controls so staff see only what their role requires, audit logging of access to sensitive records, and server-side authorisation on privileged actions. No system can be guaranteed perfectly secure, but we work to protect your information and to respond promptly to any incident.

13. Your rights under POPIA

You have the right to:

  • ask what personal information we hold about you, and request a copy;
  • ask us to correct or update information that is inaccurate or incomplete;
  • ask us to delete or destroy information we no longer have grounds to keep;
  • object to processing in certain circumstances;
  • withdraw consent where we rely on it;
  • not receive unsolicited direct marketing; and
  • complain to the Information Regulator (see section 14).

To exercise any of these rights, contact our Information Officer (section 3). You can also request access to records under the Promotion of Access to Information Act, 2000 (PAIA); our PAIA manual is available on request. We may need to verify your identity before acting on a request.

14. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information, you may lodge a complaint with the Information Regulator of South Africa:

Website: inforegulator.org.za
POPIA complaints email: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017

Please verify these details against the Regulator’s website before relying on them.

15. Changes to this policy

We may update this policy from time to time. When we do, we will change the “last updated” date at the top. Significant changes may also be communicated to you directly.

16. Contact us

For any question about this policy or your personal information, contact our Information Officer at [privacy@bodywork4men.co.za or equivalent]. You can also manage your account and marketing preferences from your account.