Last updated: 21 October 2026 | Effective date: 28 October 2026

1. Introduction

CHALC Social Limited ("CHALC", "we", "us") respects your privacy and complies with the Protection of Personal Information Act 4 of 2013 (POPIA), UK GDPR, the Data Protection Act 2018, GDPR (EU), COPPA, CCPA/CPRA, and other applicable US state privacy laws where applicable.

This Policy explains how we collect, use, store, share and protect your personal information when you use the CHALC app and website (the "App").

2. Key Terms

  • Community: a group created in the App in which Challenges are run.
  • Community Owner: the person or organisation that creates and manages a Community and its Challenges (for example a brand, employer, school, club or charity).
  • Private Community: a Community whose membership is limited to a defined group chosen by the Community Owner, such as the employees of a company.
  • Corporate Community: a Community owned by a company or other organisation. A Corporate Community may be public or private.
  • Challenge: a video challenge created within a Community.

3. Information We Collect

  • Name, email, phone (optional), date of birthGuardian name/email (for users 13–17)
  • Username, Community memberships and, where a Community Owner requires it for eligibility, an employee or membership identifier
  • Videos, images and Challenge submissions
  • Challenge participation records, results, rankings and votes
  • Device type, IP address (anonymised), analyticsConsent records (timestamp, status)

3.1 Data Classification (for App Stores)

Data Type Collected Linked to Identity Purpose Shared With
Name Yes Yes Account; Challenge administration Amazon S3; Community Owner (see 6.3)
Email Yes Yes Login, alerts; Challenge administration Private/Corporate Community Owner (see 6.3); prize contact (see 6.4)
Phone Optional Yes 2FA None
Guardian Info Yes Yes Consent None
Videos/Images Yes Yes Hosting, moderation, Challenges Amazon S3; Community Owner
Challenge results Yes Yes Leaderboards, prizes, recognition Community Owner
Device IP Yes No Analytics Firebase
Crash Logs Yes No Safety & improvement Firebase

4. Children's Data & Consent

  • Users 13–17: verifiable guardian consent via email link.
  • Users under 13: prohibited. Accounts are deleted immediately.
  • Personal information collected from users under 16 is treated as sensitive personal information under CCPA/CPRA.
  • The contact details of users under 18 are shared with a Community Owner only where needed to deliver a prize, and only with guardian consent.
  • Guardians can withdraw consent or request deletion: [email protected]

5. How We Use Information

  • Operate the App
  • Verify age and consent
  • Host videos via Amazon S3
  • Moderate content
  • Run Challenges, including verifying eligibility, ranking entries and determining winners
  • Enable Community Owners to award prizes, rewards and recognition (see section 6)
  • Send safety alerts and service notices
  • Improve performance (anonymised)

6. Sharing of Information

We share personal information only as described in this section:

  • Amazon S3 (video hosting), under Amazon's terms
  • Firebase (analytics/crash reporting), anonymised
  • Community Owners, as set out in sections 6.2 to 6.4
  • Legal authorities, where required by law

We do not sell or share your personal information for cross-context behavioural advertising or any other purposes as defined under CCPA/CPRA. We do not use your information for advertising, and we never give your contact details to Community Owners for their own marketing.

6.1 Amazon S3 Disclosure

By uploading a video, you agree to Amazon S3's Terms (https://docs.aws.amazon.com/managedservices/latest/userguide/key-terms.html) and Privacy Policy. Amazon S3 may collect video metadata, IP and watch time. Upload requires explicit opt-in. There is no auto-upload.

6.2 Community Marketing Sharing

If you opt in when joining a Community, your uploaded content (videos, images, username) may be shared with the Community Owner for external promotional use. Your email address and phone number are not shared under this marketing permission. You can revoke this consent at any time.

6.3 Private and Corporate Communities

When you join a Private Community or a Corporate Community, the Community Owner decides the purpose and rules of its Challenges. For those Challenges, the Community Owner is the responsible party (or controller), and CHALC processes your information on its behalf as an operator (or processor).

Participation in these Communities is not anonymous. The Community Owner and its authorised administrators can see your name, username and submissions. To administer the Community and its Challenges, CHALC may provide the Community Owner with:

  • your name, username and email address;
  • any employee or membership identifier the Community Owner requires for eligibility;
  • your submissions, participation status, results and rankings.

The Community Owner may use this information only to run the Community and its Challenges, verify eligibility, and award prizes, rewards and recognition. The Community Owner is the organisation that invites you to join or that runs the Community, and it is responsible for telling its participants that it runs the Community and will receive this information. The Community Owner's own privacy notice also applies to its use of your information. Corporate Community Owners are bound by a written agreement with CHALC that requires them to keep your information secure and confidential and to use it only for these purposes.

6.4 Prizes in Public Communities

In public Communities (open to anyone), we share contact details only for prize winners, only with the Community Owner offering the prize, and only after the winner has agreed when claiming the prize. For users under 18, guardian consent is also required.

7. Data Retention & Deletion

  • Active account: retained as needed
  • Inactive: deleted after 12 months
  • Deletion request: in-app (Settings > Delete Account) or by email
  • Response: within 45 days (or as required by applicable law)
  • Confirmation sent via email
  • Information already provided to a Community Owner under section 6.3 or 6.4 is held by that Community Owner under its own retention policy. We will pass on deletion requests to the Community Owner where relevant.

8. Security

  • Encryption in transit (TLS) and at rest (AES-256)
  • Access controls, 2FA for staff
  • Data provided to Community Owners is sent through secure, access-controlled channels and limited to what is needed for the stated purpose
  • Written agreements with operators and Corporate Community Owners (POPIA sections 20 and 21)
  • Regular audits and breach response (POPIA section 22)

9. Your Rights

  • Access, correct, delete data
  • Withdraw consent
  • Object to processing
  • Lodge a complaint: Information Regulator (South Africa), the UK Information Commissioner's Office (ICO) for UK residents, or an EU data protection authority as applicable.

Additional rights for California residents (and residents of other US states with similar privacy laws) under CCPA/CPRA. In addition to the rights above, you have the right to:

  • Know what personal information we have collected about you (categories and specific pieces).
  • Delete your personal information.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of your personal information (we do not sell or share for targeted advertising).
  • Limit the use and disclosure of your sensitive personal information.
  • Not be discriminated against for exercising these rights.

To exercise any of these rights, contact us at [email protected]. We will verify your identity and respond within 45 days (or as extended by law where permitted).

10. Analytics & Cookies

  • Firebase Analytics & Crashlytics (anonymised)
  • No tracking cookies
  • No cross-app tracking

11. International Transfers

Data may be transferred to the US (Amazon S3, Firebase) under appropriate safeguards compliant with POPIA section 72, UK GDPR (including the UK International Data Transfer Agreement or UK Standard Contractual Clauses), GDPR Standard Contractual Clauses, or other approved mechanisms where required.

12. Updates

Changes are posted at https://chalc.world/privacy-policy/ with an in-app notice. Material changes are notified at least 7 days before they take effect.

13. Contact

Support: [email protected]

Information Officer: David Ryan, [email protected]

Address: 11 Erica Heath, Brackenridge, Plettenberg Bay, 6600