Privacy notice
Last updated 10 November 2026 · How Rally Labs™ handles personal information under South Africa's Protection of Personal Information Act (POPIA).
Roles
Rally Labs processes personal information to run the platform (accounts, payments orchestration, tickets, check-in). For supporter data collected on an organisation's event, the organisation is typically the responsible party for how that data is used for the event; Rally acts as an operator processing it on their instructions and for platform security.
What we collect
- Staff accounts: name, email, password hash, role.
- Organisation registration: contact details, bank settlement details, proof-of-bank documents for approval.
- Supporters: name, email, optional phone, ticket/donation/pledge amounts, optional notes, seat or promo metadata.
- Payment records: amount, currency, status, gateway or offline reference, fee split. Card numbers are entered on Paystack and are not sent to Rally.
- Door operations: device ids, admission timestamps, offline sync records.
What we do not do
We do not sell attendee lists. We do not share one organisation's supporter records with another organisation. Organisers agree (in the organiser agreement) to use attendee contact details for that event's operational communication unless the buyer has opted into marketing.
Who else may receive data
Paystack (to take card payments). Email/SMS providers if the organisation enables receipts. Hosting and database providers that run Rally's infrastructure under contract. We require appropriate safeguards where processing involves service providers.
Your rights
You may request access to, correction of, or deletion of personal information we hold, subject to law and legitimate retention (for example payment and admission records). Contact the organisation that ran the event for supporter records they control, or Rally support for platform account issues. You can reset a staff password from the sign-in page.
Retention & security
We keep records as needed to operate the service, settle fees, handle disputes, and meet legal obligations, then delete or anonymise when no longer required. Access is tenant-scoped; staff see only their organisation's data.