2Klip Privacy Policy

1. Who we are

Timba2 (Pty) Ltd (registration 2023/542365/07), trading as Timbuk2, is the responsible party for personal information processed for the 2Klip programme, unless a separate notice states otherwise.

Registered address: 155 West Street, Sandown, Sandton 2031, South Africa

Information Officer: Matimba Nkuna (mjnkuna@timbuk2.ai)

2. Scope of this policy

This policy applies to personal information processed in connection with 2Klip recruitment, screening, onboarding, messaging, missions, submissions, payments, support, analytics, reporting, and compliance.

It covers information received directly from participants, through recruitment partners, from forms and communication channels, and from mission outputs submitted to the Company.

3. Information we may collect

Identity and contact details, including name, phone number, email address, age bracket, area/subplace, and ID or other verification details where needed for lawful identification or payment.

Recruitment and onboarding information, including area suitability, availability, smartphone capability, GPS/camera capability, bank or wallet details, and screening responses.

Submission and mission information, including worker ID, mission ID, timestamps, GPS coordinates, photos, notes, category labels, quality/duplicate flags, payout records, and audit artefacts.

Optional third-party business information supplied in the field, such as business names, visible contact numbers, owner names, operating notes, and proof of location where this is relevant to the task.

Technical and usage information from the channels we use, such as WhatsApp messages, exported chat records, form data, device metadata embedded in submissions, meeting attendance, and support interactions.

4. How we collect information

Directly from data subjects during applications, onboarding, Google Meet sessions, forms, messaging, or field submissions.

From recruitment or ecosystem partners where candidates have been sourced or referred through a lawful process.

From operators and service providers that help us host, store, transmit, analyse, or secure programme data.

From public-facing business observations captured lawfully in the field and from quality-assurance checks against existing datasets or maps.

5. Why we process personal information

To recruit, assess, onboard, allocate, manage, and support participants.

To verify submissions, calculate points or rewards, prevent fraud, manage duplicates, and administer payouts.

To create, improve, and commercialise 2Klip datasets, reports, truth packs, analytics, models, and client deliverables. Information we receive from Google or Facebook sign-in is never used for this (see section 17).

To maintain audit trails, quality assurance, operational reporting, funding or impact reporting, and legal/compliance records.

To protect the security, integrity, and lawful operation of the programme.

6. Lawful grounds for processing

The Company may process personal information where:

• the data subject has consented;
• processing is necessary to take steps at the request of the data subject or to perform a contract;
• processing complies with a legal obligation;
• processing protects a legitimate interest of the data subject;
• processing is necessary for pursuing the Company’s legitimate interests or those of a third party, where appropriate and lawful.

Where consent is relied on, the data subject may withdraw it prospectively, subject to any processing that remains lawful on another basis or that is required for recordkeeping, dispute management, or legal compliance.

7. Important notice for field-collected third-party information

Participants must minimise collection of third-party personal information and should avoid capturing unnecessary faces or other personal details.

Where owner or contact information is requested as part of a mission, participants must only provide information lawfully obtained, relevant to the mission, and not excessive. The Company may delete or redact unnecessary personal information.

8. Sharing and disclosure

We may share personal information with operators or service providers that host or support communications, cloud storage, analytics, identity checks, security, or payment processes.

We may share limited information with clients, partners, auditors, funders, or regulators where required for the agreed service, lawful reporting, or impact verification, but we aim to limit personal information and favour aggregate or pseudonymised outputs where feasible.

We may disclose information where required by law, court order, regulator request, or to protect lawful rights and safety.

9. Cross-border transfers

Some operators or cloud environments may process or store information outside South Africa. Where that happens, the Company will take steps reasonably required by applicable law to ensure adequate protection and appropriate contractual safeguards.

The specific processors used by the app and this website, and which of them process data outside South Africa, are named in the App Addendum (A6).

10. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law, contract, audit needs, dispute resolution, research safeguards, or legitimate operational recordkeeping.

Audit, payout, and proof records may need to be retained after a campaign ends to support verification, complaints, client deliverables, and funding or compliance reporting. How long each kind of account record is kept is set out on the deletion page.

11. Security

The Company uses reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, access, or unlawful processing.

Because 2Klip uses messaging tools and field devices, absolute security cannot be guaranteed. Participants should also use secure devices, passcodes, and appropriate caution when sharing information.

12. Data-subject rights

Subject to applicable law, data subjects may request confirmation of whether we hold their personal information, request access, request correction or deletion, object to certain processing, withdraw consent where consent is the basis, and complain to the Information Regulator.

Access requests and some other requests may be handled through the Company’s PAIA Manual and associated request processes. Anyone with a 2Klip account can also request its deletion, with or without the app, at www.2klip.com/account/delete.

13. Information Officer and PAIA Manual

The Company must maintain Information Officer details and a PAIA Manual appropriate to its legal obligations. Requests for access to records or personal information should be directed to the Information Officer or other contact listed in the PAIA Manual.

14. Direct marketing

Operational onboarding, mission, safety, and payout communications are not the same as marketing communications.

If the Company wishes to send direct marketing by electronic means, this will be managed in accordance with applicable law and channel-specific opt-in requirements.

15. Children and special personal information

2Klip is for people aged 18 and over. The Company does not knowingly recruit minors into paid field missions, and if we learn that we hold a child’s personal information we delete it.

Some games are about alcohol. Before one starts, we ask for your date of birth and keep only the fact that you confirmed you are 18 or older, and when — never the date itself. We may ask again after a year.

The Company does not intend to collect special personal information unless a lawful exception applies and appropriate authorisation or safeguards are in place.

16. Complaints and updates

Questions or complaints should first be sent to support@timbuk2.ai or the Information Officer. Data subjects may also complain to the Information Regulator of South Africa.

This policy may be updated from time to time. The latest version should be made available in the onboarding pack, website, or other official 2Klip channel.

17. Signing in with Google or Facebook

You can create a 2Klip account, and sign in to it, with your Google or Facebook account instead of typing an email address. It is your choice: you can always use your email address instead, and nothing in 2Klip depends on which you pick.

Phone and WhatsApp contact

You may add a phone number after an official Pin shot. It is optional for play. Phone verification is required when you redeem a reward. We use SMS to verify a number you add so we can contact you about prizes and redemptions. You can also tell us which number you use on WhatsApp, or tell us you do not use WhatsApp. This contact preference is not WhatsApp account verification or consent to marketing messages.

What we receive

Google or Facebook first asks you to agree, then sends us only:

• your name;
• your email address (and, from Google, whether Google has verified it);
• a link to your profile picture;
• an identifier for your account, which is specific to 2Klip.

Your browser’s sign-in session also holds a short-lived Google or Facebook access token for a while after you sign in. We do not use it.

From Facebook we ask for two permissions only: public_profile and email. From Google we ask only for your basic profile and email address. We never see your Google or Facebook password, and we get no access to your posts, photos, friends, messages, contacts, pages or groups. We never post to Google or Facebook, or act for you there.

What we use it for

• to create your 2Klip account and sign you in;
• to put your name and email address on your account, and to recognise you when you come back;
• to keep accounts secure — for example, so one email address cannot open two accounts.

Before official Pin play or reward redemption, we ask for your mobile number and confirm it with a one-time SMS code. That number comes from you, not from Google or Facebook.

What we never do with it

We do not sell, rent, license or trade what Google or Facebook sends us. We do not use it for advertising or to build advertising profiles, and we do not put it in the datasets, reports or client deliverables described in section 5. We share it only with the operators that run 2Klip for us, named in the App Addendum A6 — for example, your email address goes to Paystack when you pay by card — or where the law requires.

On the website, our analytics provider (PostHog) receives your 2Klip account number and which way you signed in — for example “google” — so we can see where sign-in fails, but not your name or email address. The 2Klip mobile app does send PostHog your name and email address (App Addendum A2).

2Klip’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is kept, and for how long

With our authentication and database provider, Supabase, in Ireland (EU) — outside South Africa, on the terms in section 9. We keep it while your account is open and delete it with your account.

Disconnecting Google or Facebook

You can remove 2Klip’s access at any time:

• Facebook: Settings & privacy → Settings → Apps and websites, then remove 2Klip (open it on Facebook).
• Google: your Google Account → Security → Your connections to third-party apps & services, then choose 2Klip and delete the connection (open it on Google).

Removing access is not deleting your account. It stops Google or Facebook sharing anything new with us, but it does not delete what we already hold. To delete that, follow these steps.

What Google and Meta do with your information is governed by their own privacy policies.

18. The 2Klip website and web app

Remembering this browser

Before anyone signs up, we need to tell a returning browser from a new one. So when you visit www.2klip.com, 2Klip keeps random numbers in your browser: a cookie called 2k_did, a play ID in your browser’s local storage, and PostHog’s own ID (see below). None of them is worked out from your device’s characteristics (none is a fingerprint), and none is set by an advertiser. The cookie expires 180 days after it is set; the play ID stays until you clear your browser’s data or switch counting off. We keep these numbers with the play and analytics records of that browser. If you sign in, those records are linked to your account.

We rely on our legitimate interest (POPIA section 11(1)(f)) in knowing whether the game brings people back. We consider that this does not override your rights because the numbers are random, are used only by 2Klip and the operators that run it, and are never used to advertise to you, profile you or score you. The cookie’s 180 days is chosen to cover the returns we measure — after a day, a week and a month.

You can object at any time. On the home page, tap How to play, open Help, support and more, and under This device choose Stop counting this device. That deletes the cookie and the play ID from your browser at once, switches off analytics and session replay in this browser, and sets a marker (2k_did_off, kept for 400 days) so new ones are not made. Games you play while counting is off do not count towards the welcome reward.

Creating an account and staying signed in

When you create an account we record the IP address it came from, to detect fraud. When you sign in, your browser stores a sign-in session so you stay signed in; signing out removes it.

Analytics and session replay

The website and web app use PostHog to record page views, taps and errors, and to make session replays — a reconstruction of how a page was used — so we can find and fix problems. Anything you type into a form field is masked in your browser before it is sent; so are your name, email address and phone number on your account pages, and error messages shown on the screen. Other things on the screen, such as the games you play and the pages you open, can appear in a replay. PostHog also receives your IP address and reports of errors in the page. Session replay is not used in the mobile app.

Maps, fonts and pictures

Some pages load map tiles from CARTO, OpenFreeMap and OpenStreetMap, fonts from Google Fonts, and pictures from Wikimedia Commons. Your browser fetches these directly, so each of those services receives your IP address and browser details when a page uses them. They do not receive your account details.

Support chat

Support chat is provided by Crisp and is loaded only when you open it. Crisp receives what you write, the topic you chose, your 2Klip account ID if you are signed in, a reward reference if your question is about a reward, and the technical details any website receives, such as your browser type.