Privacy Policy

Effective date: 28 May 2025

Updated date: 17 June 2025

This Privacy Policy explains how Lit Influence (Pty) Ltd ("Lit Influence", "we", "us", "our") collects, uses, discloses and protects your Personal Information when you visit https://lit.africa (the "Platform") or use any of our products, services, mobile applications or communication channels (together the "Services").

We are based in South Africa and primarily regulated by the Protection of Personal Information Act 4 of 2013 (POPIA). If you are in the European Economic Area ("EEA") or the United Kingdom, the General Data Protection Regulation (GDpr) and UK GDPR may also apply.

By accessing or using the Services you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Services.

Contents

• Quick Summary
• Definitions
• 1. Information we collect
• 2. How & why we use it
• 3. Sharing & disclosure
• 4. Cross-border transfers
• 5. Security safeguards
• 6. Retention
• 7. Your rights
• 8. Cookies
• 9. Updates
• 10. Contact us

Quick summary (‘At a Glance’)

What we collect — information you give us when you create or manage an account, run or join a campaign, request support, sign-up to newsletters, browse our site or interact with us on social media.

Why — to operate our influencer marketplace, pay influencers, bill brands, comply with law, improve the Platform and send you communications you request or that we are allowed to send.

How long — no longer than necessary for the purpose collected, typically 5 years after the end of the tax year in which the record was created, unless the law requires longer.

Your rights — access, correct, delete/destroy, object to or restrict processing, lodge a complaint with the Information Regulator.

Security — we follow industry-standard technical and organisational safeguards.

Contact — [email protected] | +27 (0)11 568 0101 | Eastlands Office Park, Bentel Avenue, 1st Floor, Regus building, Jansen Park, 1459.

Definitions

“Personal Information” has the meaning given in POPIA - information relating to an identifiable, living natural person, and, where applicable, an identifiable existing juristic person (e.g. company).

“Process/Processing” means anything done with Personal Information, including collection, recording, storage, use, transmission or deletion.

1. The information we collect

Children: Our Services are not intended for persons under 18. We do not knowingly process children’s Personal Information without verified guardian consent.

2. How & why we use your information

3. Sharing & disclosure

We share Personal Information only when necessary:

• With payment processors & banks - to collect fees and pay influencers (e.g. Stripe, PayFast, local banks).
• With eWallet providers - to issue payments to influencers who are unbanked or approved for alternative payouts.
• With service providers who host our servers, Live Chat, e-mail or analytics, under confidentiality agreements.
• With brands or influencers engaged in the same campaign - limited to what is required for that campaign.
• With regulators, courts or law-enforcement where the law compels us or to protect our rights.
• During a business transaction (merger, acquisition) - subject to confidentiality and only to the extent permitted by law.

We never allow third-party marketing on our database.

4. Cross-border transfers

We host data in South Africa and occasionally in the EEA/UK or United States (e.g. cloud e-mail service). Where we transfer Personal Information outside South Africa we rely on:

• An adequacy determination by the Information Regulator; or
• A binding contract that requires the foreign recipient to protect the information to a standard comparable with POPIA or GDPR.

5. Security safeguards

We use administrative, technical and physical measures such as:

• TLS encryption in transit
• AES-256 encryption at rest for databases & backups
• Role-based access & multi-factor authentication for staff
• Routine vulnerability scans & penetration testing
• Written information-security & incident-response policies

Payout-related documents such as IDs, bank letters, and declarations are stored securely with limited access.

If we discover a data breach that poses a real risk of harm we will notify affected data subjects and the Information Regulator within 72 hours as required by POPIA §22.

6. Retention

We keep Personal Information only as long as:

• We have an ongoing relationship with you; and
• The information is necessary to fulfil the purposes described; and/or
• The law requires (e.g. tax/accounting documents for 5 years after the end of the tax year).

Payout verification data is retained as long as necessary to process payments, resolve disputes, or comply with legal and financial regulations. When retention is no longer justified we securely delete or anonymise the data.

7. Your rights

Under POPIA (and GDPR where applicable) you may:

• Access the Personal Information we hold about you.
• Correct inaccurate, out-of-date or incomplete information.
• Delete or destroy (where allowed) or request us to de-identify information.
• Object to certain processing or withdraw consent at any time.
• Request data portability (GDPR).
• Lodge a complaint with the Information Regulator ([email protected] | JD House, 27 Stiemens St, Braamfontein).

To exercise any right please e-mail [email protected] or use the "GDPR / POPIA Actions" page in your account dashboard. We will respond within 1 month (or 15 business days for POPIA requests).

8. Cookies & similar technologies

We use strictly-necessary cookies for security and session management. Analytical cookies (e.g. Google Analytics) are only set with your consent via our cookie banner. You can withdraw consent or change settings at any time.

9. Updates to this Policy

We may amend this Policy from time to time. We will post the revised version with an updated "Effective date" and, where significant, notify you by e-mail or in-app notice. Continued use of the Services after changes means you accept the updated Policy.

10. Contact us