Privacy policy

Last Updated: 23 July 2026

Step-Up ("we", "our" or "us") is committed to protecting your personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA). This Privacy Policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have. It applies when you visit www.step-up.africa, enter one of our competitions, subscribe to our emails, or communicate with us by email or WhatsApp.

1. Who is responsible for your information

The responsible party under POPIA is:

Step Up Competitions (Pty) Ltd, trading as Step-Up
Registration number: 2025/929384/07
Physical address: The Dream Factory, 6 Riverside Terrace, Hout Bay, Western Cape, 7806, South Africa
Email: [email protected]

Step Up Competitions (Pty) Ltd is wholly owned by the Hout Bay United Football Community Trust. Our competitions are society lotteries promoted on behalf of the Hout Bay United Football Community (NPO 165406), registered with the National Lotteries Commission (NLC).

Privacy queries and requests are handled by our Information Officer, who can be reached at [email protected].

2. What we collect, and what is mandatory

Required to enter a competition. When you buy a ticket we collect your name, email address and mobile phone number. Supplying these is mandatory: without them we cannot allocate your ticket numbers, contact you if you win (our competition terms require winner notification by email and telephone), or keep the entry records the Lotteries Act requires us to hold. If you do not provide them, you cannot enter.

Required if you win. To verify and pay a winner we collect a copy of your South African ID and, for cash prizes, your bank account details. This is mandatory for winners: we are required to verify age, residency and identity under our NLC-registered scheme before paying a prize.

Optional. Account details if you choose to create an account (accounts are not required to enter), delivery address where a prize must be shipped, your marketing preferences, and any messages you send our support team.

Collected automatically. Technical information such as IP address, device and browser type, and how you use the site (see section 8, Cookies and analytics).

Payment information. We do not collect or store your card details. Payments are processed by Shopify's hosted, PCI DSS compliant payment system and its payment partners. We receive confirmation that payment succeeded or failed, never your card number.

3. Why we process your information and our lawful basis

  • Running the competition you entered (allocating tickets, the draw, winner notification): necessary to perform our contract with you.
  • Legal obligations: the Lotteries Act 57 of 1997 and the conditions of our NLC-registered scheme require us to keep records of entries and ticket sales, verify winner eligibility (18 or older, resident in South Africa), submit post-draw returns to the NLC, and retain lottery records for at least five years. Tax law also requires us to keep transaction records.
  • Publishing winners: our registered scheme requires us to publish the winning entrant's name and winning ticket number on this website and our social media channels. We publish only that; no contact details, ID numbers or photographs are published without separate consent.
  • Service communications: order confirmations, your e-ticket, draw reminders for competitions you entered, and responses to your enquiries.
  • Marketing: only as described in section 5, with your consent or as permitted by POPIA section 69.
  • Improving the site: analytics on how visitors use the site, based on our legitimate interest in running an effective service.
  • Protecting our rights: preventing fraud, duplicate or ineligible entries, and payment reversals.

4. Direct marketing (email, SMS and WhatsApp)

  • We only send electronic marketing if you have opted in (for example the unticked "email me" checkbox at checkout or the newsletter signup), or if you are an existing customer, in which case we may tell you about similar Step-Up competitions with an opt-out in every message.
  • Every marketing message identifies us as the sender and contains a working unsubscribe or opt-out.
  • WhatsApp: if you give us your mobile number, we may send you a single WhatsApp message inviting you to opt in to WhatsApp communications. We will not continue messaging you on WhatsApp unless you opt in. You can withdraw at any time by replying STOP or contacting us.
  • If you opt in to WhatsApp messages, your number and message history are processed by our authorised WhatsApp Business platform provider, Sonar, acting on our instructions as our operator under POPIA.
  • Declining or withdrawing from marketing never affects your competition entries.

5. Who we share your information with

We do not sell your personal information. We share it only with:

  • Shopify: our e-commerce platform and payment infrastructure, which hosts the site, the order records and the checkout.
  • Our competitions platform provider (nfcube): allocates ticket numbers and manages competition entries.
  • Google: analytics and tag management (Google Analytics 4, Google Tag Manager), used to understand how the site is used.
  • Microsoft: session analytics (Microsoft Clarity heatmaps and session replays), used to understand how visitors use the site (see section 8).
  • Trustpilot: collects and displays customer reviews if you choose to leave one.
  • Payment processors: to take payment and prevent fraud.
  • Our email service provider: to send order confirmations, e-tickets and, with consent, marketing.
  • Our WhatsApp Business platform provider (Sonar): only if you opt in to WhatsApp messages (section 4).
  • The National Lotteries Commission: entry and winner records where required under our registered scheme and the Lotteries Act.
  • Hout Bay United Football Community: aggregate sales reporting as scheme beneficiary; winner details only as needed for prize fulfilment and scheme reporting.
  • Professional advisers, auditors, and authorities: where the law, a court order, or a regulator requires it.
  • Couriers: name and delivery address only, where a physical prize is shipped to you.

Service providers process your information only on our instructions and under written agreements as required by POPIA sections 20 and 21.

6. International transfers

Some of our providers (including Shopify, Google and Microsoft) store or process information on servers outside South Africa. Where that happens, the transfer is protected as required by POPIA section 72: the recipient is bound by data processing agreements and privacy commitments that provide an adequate level of protection substantially similar to POPIA. You can read Shopify's commitments at the Shopify Privacy Portal.

7. How long we keep your information

  • Competition entry and financial records (name, contact details, ticket numbers, orders): five years, as required by the Lotteries Act and tax legislation.
  • Winner ID copies and bank verification details: retained only as long as needed to verify and pay the prize and complete our NLC post-draw return, then deleted, unless the Lotteries Act five-year record duty requires a specific document to be kept, in which case it is stored securely with restricted access and deleted at the end of that period.
  • Marketing contact details: until you unsubscribe or withdraw consent, or after 24 months of inactivity, whichever comes first.
  • Support correspondence: up to three years for dispute resolution.

After these periods, information is deleted or de-identified.

8. Cookies and analytics

The site uses cookies and similar technologies for the following purposes:

  • Essential: cart, checkout and security cookies set by Shopify. The site cannot function without these.
  • Analytics: Google Analytics 4 and Google Tag Manager measure visits and site usage; Shopify's own analytics pixels do the same.
  • Session analytics: Microsoft Clarity captures heatmaps and session replays of how visitors use the storefront (clicks, taps and scrolling) so we can find and fix usability problems. Text you type into forms is masked before it is sent to Clarity, and Clarity never sees your payment card details, which are entered only into Shopify’s secure payment fields.
  • Reviews: Trustpilot widgets to display and collect reviews.

We do not use advertising or remarketing cookies. If we introduce them, we will update this policy first and ask for consent where POPIA requires it. You can control or delete cookies through your browser settings; blocking essential cookies may prevent checkout from working.

9. Security

We protect your information with appropriate technical and organisational safeguards, including encrypted connections (HTTPS), Shopify's secured hosting and access controls, restricted staff access to entrant records, and separate secure handling of winner verification documents. Card payments are handled entirely by Shopify's PCI DSS compliant payment systems; we never see or store card numbers. No system is completely secure, but if we discover that your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as required by POPIA section 22.

10. Your rights under POPIA

You have the right to:

  • Access the personal information we hold about you, and request a copy;
  • Correct or update inaccurate or outdated information;
  • Request deletion or destruction of information we are not legally required to keep;
  • Object to processing based on our legitimate interests;
  • Object at any time to direct marketing, and unsubscribe from any channel;
  • Withdraw consent you have previously given, without affecting processing that happened before withdrawal;
  • Not be subject to automated decision-making with legal effect, as provided in POPIA;
  • Complain to the Information Regulator if you are not satisfied with how we handle your information.

To exercise any of these rights, contact our Information Officer at [email protected]. We respond within a reasonable time and may ask you to verify your identity first.

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: [email protected]
General enquiries: [email protected]
Website: inforegulator.org.za

Complaints about the conduct of a competition itself (rather than personal information) can be directed to us first and, if unresolved, to the National Lotteries Commission.

11. Children

Our competitions are restricted to persons 18 years or older who are resident in South Africa. We do not knowingly collect personal information from anyone under 18, and POPIA prohibits processing children's information without a competent person's consent. If we become aware that we hold information about a person under 18, we will delete it and void any associated entries in line with our competition terms.

12. Changes to this policy

We may update this policy from time to time. We will change the Last Updated date above and, for material changes, post a notice on the site. The current version always applies.

13. Contact us

Step Up Competitions (Pty) Ltd (Information Officer)
Email: [email protected]
Address: The Dream Factory, 6 Riverside Terrace, Hout Bay, Western Cape, 7806, South Africa