Privacy policy

Who is responsible

habitation and company, operating Entrivo in South Africa, is the data controller (responsible party under POPIA) for the personal information we collect through this website. For privacy questions or requests, contact habitation and company. Our payment reseller controls the information it collects directly under its own privacy notice.

Information, purposes and legal basis

Enquiries: we collect your name, email, enquiry type, message, optional organisation and event date, consent and submission time to respond to requests. We rely on your consent and steps requested before entering a contract; we do not add you to a marketing list.

Accounts: our sign-in service processes email, user identifier, name provided by your sign-in provider, session credentials and authentication records to create and secure your account. We rely on contract performance and legitimate interests in preventing fraud. We do not ask you to send passwords through the contact form.

Bookings, when online sales become available: name or account identifier, event, ticket type, quantity, booking reference, payment status and refund records are used to fulfil purchases, support buyers and comply with accounting obligations. The legal bases are contract performance and legal obligation.

AI design: the authorised organiser’s event details, prompts, generated concepts and request identifiers are processed to generate and save requested venue concepts. We rely on providing the requested service and legitimate interests in secure operations. Do not include sensitive personal information or attendee lists in prompts.

Technical data: hosting and sign-in providers may process IP addresses, device/browser information, session data, error logs and security records to operate and protect the website. We rely on legitimate interests in reliability and fraud prevention.

Payment processing and sharing

For orders processed through Paddle, we share the necessary order and account identifiers with Paddle, our Merchant of Record, for sales, payment processing, tax compliance, invoicing, refunds and transaction support. Card information is collected by the payment provider, not through our enquiry form. See Paddle’s Privacy Policy.

We use service providers for hosting, Lovable Cloud storage and authentication, and AI generation through Lovable AI Gateway and its model providers. Google or Lovable processes sign-in under its own terms. Necessary data may also be shared with professional legal/accounting advisers and authorities when required by law. We do not sell personal information.

Retention

We review enquiry records for deletion or anonymisation within 24 months after the last meaningful contact unless an active matter or legal obligation requires longer retention. Account information is retained while the account is active and reviewed for deletion after closure, subject to security and legal requirements. Booking and financial records, once sales are enabled, are generally retained for five years after the relevant transaction or longer when applicable law requires it. Technical logs are retained only as needed for troubleshooting, security investigations and provider obligations. Saved homepage concepts remain until replaced or removed; generation records and provider retention follow the applicable service terms. These are retention targets reviewed by habitation and company; deletion is not an automated promise.

Security and international processing

We use encrypted connections, restricted access, authenticated management tools and access controls separating public event details from private enquiry and account information. Providers may process information outside South Africa. We seek appropriate contractual and legal safeguards for transfers under POPIA. No system can guarantee absolute security; report suspected unauthorised access through our contact page.

Cookies and browser storage

Essential session and authentication storage keeps you signed in and remembers your requested destination. These are required for account functionality; disabling them may prevent sign-in. We have not installed optional marketing or analytics cookies in the application. Third-party sign-in and payment pages may use their own cookies and notices. You can manage cookies and local storage in browser settings and sign out to end a session.

Your rights and requests

Subject to applicable law, you may request access, correction or deletion, object to certain processing, withdraw consent where used, and ask how your information is handled. Withdrawal does not affect earlier lawful processing; legal records may need to be retained. We may verify your identity before responding. Send a privacy request without card details or sensitive documents. You can complain to South Africa’s Information Regulator. We will respond within the applicable legal timeframe.