POPIA Statement

This statement explains how Gather complies with South Africa's Protection of Personal Information Act, 2013 (POPIA). It should be read with our Privacy Policy.

• For staff accounts and platform operations, Liquid Mash is the responsible party.
• For event content and guest personal information, the event's organisation/organiser is the responsible party and Liquid Mash acts as operator, processing on their documented instructions (creating galleries, delivering invitations, storing and serving media to authorised viewers).

We process personal information lawfully and minimally: to perform the contract with the organisation, with the data subject's consent where required (for example when a guest joins an event and uploads photos), to comply with law, and to protect legitimate interests such as platform security.

Our Information Officer can be reached at privacy@liquidmash.io. Requests under POPIA and PAIA (access, correction, deletion, objection) may be sent to that address; we may request proof of identity and, for guest data, confirmation from the responsible organiser.

• Encryption in transit (TLS) and at rest (database, object storage).
• Private media storage with public access blocked and short-lived signed URLs.
• Database row-level tenant isolation and least-privilege application roles.
• Multi-factor authentication for staff; revocable sessions.
• Audit logging of security-relevant actions.
• Operator due-diligence on sub-processors (AWS af-south-1, Resend).

Primary data hosting is in the AWS Cape Town (af-south-1) region. Email delivery metadata transits our email provider's infrastructure; any transfer is made under appropriate safeguards consistent with s72.

You may request confirmation of, access to, correction of, or deletion of personal information, and object to processing. Guests may also use in-event controls (withdraw contribution, leave event, report media) or contact the organiser who controls their event's data.

If unresolved, you may complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@inforegulator.org.za.