Privacy Policy | On The Fly

1. Who we are

On The Fly is operated by Edrean Ernst, sole proprietor, based in South Africa. We are the responsible party under PoPIA: the party that decides why and how your personal information is processed.

Postal address: PO Box 91, Tzaneen, 0850, South Africa.

For any privacy question, request, or complaint, email info@onthefly.club. Edrean acts as the Information Officer for the business.

2. What information we collect, and from where

We collect five categories of personal information:

Account contact details: Name, email address, phone number, and (where relevant) the club or clubs you belong to. Provided by you when you register or are added by a club's committee.
Transaction history: The resources, dates, party composition, and amounts of bookings you make and club membership fees you pay. Generated by you when you use the platform.
Payment metadata: Payment references and confirmation status returned to us by our payment processor (Paystack). We do not store full card details. Card data lives with Paystack, never with us.
Catch and water-condition feedback: Post-booking reports you submit (catch counts, water conditions, notes). Provided voluntarily by you after a booking.
Audit log entries: A record of actions taken on club data (who made a change, and when), generated by the system as you and your club committee use the platform.

3. Why we collect it

Account contact details are used to identify you on the platform and to communicate with you about your transactions. Transaction history is used to operate the booking and membership flows and to power the features your committee uses to manage the club. Payment metadata is used to confirm that payment has gone through and to support refunds. Catch and feedback data is used by your club's committee to manage the waters. Audit log entries are used by your committee to oversee changes and, if needed, to investigate disputes.

We do not use your information for advertising. We do not sell or rent it. We do not share it with third parties beyond the operational recipients listed in section 7.

4. Is providing your information voluntary or mandatory?

Providing your information is voluntary. You are not required by law to give it to us. The consequence of not providing it is that you cannot use the parts of the platform that need it. For example, we cannot complete a booking for you without your contact details, and your committee cannot manage your membership without your name on the member list.

5. Lawful basis for collection

We process your information under PoPIA on the following lawful bases:

Consent (PoPIA Section 11(1)(a)). You provide your account contact details, booking input, and feedback to us knowingly when you register, book, and report.
Performance of a contract (PoPIA Section 11(1)(b)). Booking history and payment metadata are necessary to perform the booking and payment service you have asked us to perform.
Legitimate interest (PoPIA Section 11(1)(f)). Audit log entries are needed for the committee to oversee the integrity of club data; this is balanced against your right not to have your activity recorded without reason, and is limited to actions on club data rather than passive browsing.

For visitors from the European Union or the United Kingdom, the equivalent GDPR / UK GDPR bases apply (consent under Article 6(1)(a), contract under 6(1)(b), legitimate interest under 6(1)(f)).

6. International transfers

Your information is stored using Amazon Web Services (AWS) and is processed in AWS data centres that may be located outside South Africa. From a South African perspective, that is a cross-border transfer.

We rely on the cross-border transfer safeguard in PoPIA Section 72(1)(a). AWS publishes its own data-processing terms and operates under privacy regimes that, in our view, substantially correspond to PoPIA in the level of protection they provide.

Payment information passes through Paystack, whose own data-handling is governed by Paystack's privacy policy and the South African Reserve Bank's regulatory framework for payment processors.

7. Recipients of your information

The only parties who receive your information are:

Your club's committee. For the data that pertains to your membership of, and transactions with, that specific club. Other clubs do not see your data.
Paystack, our payment processor. Paystack receives the transaction amount and the information needed to complete the payment; we receive a payment reference and a status back from them.
Amazon Web Services, our hosting provider. AWS processes data on our behalf under its data-processing terms. It does not use your data for its own purposes.
On The Fly itself. Edrean, in his capacity as the operator of the platform and its Information Officer, has access when this is needed to operate or support the service.

We do not share your information with advertising networks, data brokers, or analytics platforms. There are no third-party tracking pixels on this website or in the product.

8. Your rights

Under PoPIA you have the right to:

Know what personal information we hold about you.
Ask us to correct it if it is wrong.
Ask us to delete it (subject to any retention obligations).
Object to how we are using it.
Lodge a complaint with the Information Regulator of South Africa, whose contact details are at inforegulator.org.za.

Visitors from the European Union or the United Kingdom have equivalent rights under the GDPR (access, rectification, erasure, restriction, portability, and objection, under Articles 15 to 22) and may lodge a complaint with their national data-protection authority.

To exercise any of these rights, email info@onthefly.club. We aim to respond within 30 days; PoPIA allows us up to a "reasonable time" and GDPR allows up to one month (extendable to three for complex requests).

9. No third-party trackers

On The Fly's marketing site and product use no third-party trackers, advertising pixels, or session-replay tools. We do not set non-essential cookies. We do not load fonts or scripts from third-party CDNs at runtime. This stance is consistent with our public Data Charter and is a deliberate product choice, not a deferral.

10. Retention

We keep your account contact details and booking history for as long as you are a member of a club using On The Fly. If your club leaves the platform, your data is deleted within 30 days of the club confirming the request, with written confirmation, as set out in promise 3 of our Data Charter. Audit log entries are kept for as long as the related club's account exists, so that committees can investigate historical issues if needed.

11. Changes to this policy

If we change this policy in a way that affects you, we will update the "Last updated" date at the top of this page and, where the change is material, email registered users a short notice. The version in force at any moment is the one on this page.