PRIVACY NOTICE | xp2.co.za

XP Squared Privacy Policy Notice

last update December 01, 2025

1. Introduction

XP Squared (Pty) Ltd (“XP Squared”, “we”, “us”, “our”) respects your privacy and is committed to protecting personal information in accordance with applicable data protection laws, including the Protection of Personal Information Act, 2013 (POPIA) and, where applicable, the General Data Protection Regulation (GDPR). This Privacy Policy Notice explains how we collect, use, store, share, and protect personal information obtained through our business operations, activations, digital platforms, and engagements.

2. Scope

This notice applies to:

Clients and client representatives
Consumers participating in brand activations, promotions, competitions, or surveys
Promoters, staff, contractors, and suppliers
Website visitors and digital platform users

3. Personal Information We Collect

We may collect the following categories of personal information:

Identification information (name, surname)
Contact information (email address, mobile number)
Demographic information (age range, gender, where relevant)
Digital information (IP address, device data, cookies)
Campaign data (competition entries, survey responses, images or videos with consent)
Employment-related information
Business and contractual information

4. How We Collect Personal Information

Personal information may be collected:

Directly from you (forms, QR codes, competitions, surveys, WhatsApp campaigns)
Through client briefs and authorised data sharing
Via our website, digital tools, or social media platforms
During in-store, mall, event, or experiential activations

5. Purpose of Processing

We process personal information for:

Delivering experiential marketing campaigns and activations
Managing competitions, promotions, and prize fulfilment
Communicating with participants, clients, and suppliers
Campaign reporting, insights, and performance measurement
Process job applications and assess candidates for employment
Training, staffing, and operational management
Legal and regulatory compliance

6. Legal Basis for Processing

Processing is based on:

Consent
Performance of a contract
Legal obligations
Legitimate business interests

7. Sharing of Personal Information

From time to time we may share personal information with:

Clients (authorised or aggregated formats)
Regulatory or legal authorities where required
Professional Advisors, such as lawyers, auditors, or consultants, where disclosure is necessary for legitimate business interests.
Third parties in connection with business mergers, acquisitions, transfer or sale.
Other third parties Service Providers, including but not limited to:
- Website hosting and technical support providers;
- Email and productivity platforms such as Microsoft 365 and Connecteam used for communication, document storage, and collaboration;
- Analytics and tag management services such as Wix and Google Analytics, to assess website performance and visitor trends;
- Advertising and social media partners for targeted marketing and audience analysis.

8. Cross-Border Transfers

Where personal information is transferred outside South Africa, appropriate safeguards are implemented in line with POPIA and GDPR.

9. Data Retention

Personal information is retained only for as long as necessary to fulfil its purpose or as required by law, after which it is securely deleted or anonymised.

10. Information Security

XP Squared implements appropriate technical and organisational measures to protect personal information against loss, unauthorised access, misuse, or disclosure.

11. Your Rights

You have the right to: