Up Bookings — Privacy Notice

Effective date: 29 October 2026 · Version: 1.1

Up Bookings is an app for booking and paying for sports courts, such as pickleball courts, at clubs that use it. This notice explains what personal information Up Bookings uses, why, who receives it, where it is kept, for how long, and your rights.

1. Who is responsible for your information

Up Bookings is run by BZ Tracking Solution (Pty) Ltd (registration number 2014/231948/07), a South African company, referred to here as "we" or "us".

• Your Up Bookings account: your profile, date of birth, friends, Play together, notifications, and a parent's or guardian's approval for players under 18. We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA).
• Your bookings and payments at a club, and the club's records of you as its customer: each club is the responsible party for its own records. We keep them for the club as its operator, only on its instructions. The same applies to people a club books by phone, to cancellation requests and the club's decisions, to the booking emails a club receives, and to booking tickets a club chooses to send by WhatsApp.
• Clubs as our customers: the owner's contact details, the club's plan and billing, and referrals. We are the responsible party.

2. What we collect

When you create an account: your name, email address, mobile number and date of birth. If you choose: a title, gender, profile photo and a short description. We record when you accepted the Terms of Use.

When you book and pay: the club, court, date and time; payment amounts and status; and the PayFast payment reference, with the payer's name and email as PayFast reports them. Card and bank details go to PayFast and never reach us.

Airbucks (offered only at one club): your Airbucks balance and every top-up, spend and refund. Top-ups are being switched off; existing balances can still be spent at that club.

Friends and games (optional): - your friends list, friend requests and anyone you block; - your friend code; - shares of a court's cost you are invited to pay; - if you switch on Play together: your confirmation that you are 18 or older, the clubs you want to hear about, the games you post or join, any note you add (phone numbers and email addresses are removed from notes), and reports you make.

Cancellation requests: your request, any reason you choose to give, and the club's decision. A short reason is enough; you don't need to give medical details.

Club events: when you join a club event, we record your entry: the event (including weekly series), how many places you took, the first names of any friends or team members you add (or your team's name), what you paid and the payment reference, your ticket code and when you checked in. Club staff can also add people at the door by first name. We don't ask for the contact details or ages of the people you add.

Notifications: the notifications in your app's inbox, and the identifier your phone uses to receive them.

Your location: with your permission, your phone's location is used on your phone to show how far clubs are. If you use "use my location", the coordinates are sent once to find your street area. We do not store your location.

If you are under 18: your parent's or guardian's first name and WhatsApp number or email address, which you give us, and the record of their decision (see section 7).

3. Why we use it

We use it to: - run your account; - let you book and pay, and tell the club about your booking; - keep your Airbucks balance; - let you find friends and games and share costs; - send you notifications about your bookings, friends and games; - get a parent's approval for players under 18; - keep the service safe (reports, blocking, abuse limits); - meet our legal and accounting duties.

We do not sell your information or use it for advertising, and we do not send marketing messages. The banners on the home screen are the same for everyone and use none of your information. If you tap one, you leave Up Bookings; the advertiser's website has its own privacy policy.

4. Who sees your information

• Clubs where you book keep a copy of your name, email address, mobile number and profile photo, so that they can contact you about your bookings. Only that club's owners and staff can see it. It is removed automatically 24 months after your last booking at that club. A club's owners and staff can see each other's contact details while they hold that role.
• Other players see only your first name. Your profile photo is shown to your friends, to people you share a court's cost with, and, unless you switch it off, to players in the same Play together game. If you are under 18, your photo is never shown to other players, only to the clubs where you book. Blocked players never see each other's photo.
• Your friends see the court-cost shares you invite them to, with the amount, club and time.
• Players who paid a share of your court can see the booking's ticket once the court is fully paid, until a day after it starts. The ticket shows the QR code, reference, club, court, time, their own amount and your first name, and nothing about the other players.
• WhatsApp booking tickets: when a club books a court for you by phone or at its desk, it can send your booking ticket to your mobile number by WhatsApp. The message comes from Up Bookings on the club's behalf. It contains your first name, the booker's or club's name, the date and time, and a link to the ticket page.
• Club events: the club running the event, and you, can see your entry and the names you added. The club uses this to run the event. Event entries are deleted 12 months after the event.
• Contact about your bookings: staff at a club where you book can see your contact details for that club, and may call, WhatsApp or email you about your bookings. A club may move your booking to another court or time, or cancel it, and can cancel an event. If it does, we tell you in the app and by email, with the club's reason.
• Event WhatsApp groups: if a club shares a WhatsApp group for an event, the link is shown only to players who joined. Joining the group happens in WhatsApp, and is between you and the club. Members of a WhatsApp group can see each other's phone numbers.
• Event reminders: we send a reminder in the app the day before an event you've joined.
• A booking's ticket link opens a page showing only the club, court, time, status and QR code, with no names. Search engines are told not to index it.

Our service providers (operators) process information for us under their data processing terms:

We may also disclose information where the law requires it.

5. Information sent outside South Africa

Most of the providers above store or process information outside South Africa: in the European Union, the United States and on global infrastructure. We rely on section 72 of POPIA: each provider is bound by data processing terms that give a level of protection we consider adequate. Information held in the European Union is also protected by the EU General Data Protection Regulation.

6. How long we keep it

• Your account and profile: while your account exists.
• Bookings, payments, cancellation requests and the payment log: as part of each club's records, for as long as the club uses Up Bookings and accounting law requires. When you delete your account, your name, phone number and email address are removed from them.
• A club's copy of your contact details: 24 months after your last booking at that club.
• Notifications in your inbox: 90 days.
• Club event entries: 12 months after the event.
• Payment notification logs: 12 months.
• Game posts: 30 days after the game.
• Unanswered friend requests: 30 days.
• A parent's approval record: while the child's account exists, and for three years after it is deleted. When the account is deleted, the parent's name and number are removed. What remains is the version of the wording, the date, and a coded check value that can confirm, but does not reveal, which number approved.
• Unanswered or expired requests to a parent: 30 days.

7. Children

You must be at least 13 to use Up Bookings. Players aged 13 to 17 can use it with the approval of a parent or guardian.

When a player under 18 signs up, they give us a parent's or guardian's first name and WhatsApp number or email address. We send that person a message with a link to a page that explains this section. They can approve or decline there. Until they approve, the child can't book, pay or add friends.

A parent can withdraw approval at any time, with the same link, until the child turns 18. Bookings already made stay valid.

Play together, and showing a profile photo to other players, are only for players aged 18 or older.

We keep a record of each decision: which wording the parent saw, by version, how the message reached them, and when they decided. This is our proof of their approval.

8. Security

• Your information is encrypted in transit and at rest.
• Access is limited by rules enforced on our servers, not only in the app.
• In the current app, profile photos are shown only through links that expire within an hour, issued only to the people listed in section 4.
• Privileged actions affecting money or roles are recorded in an audit log.

A limitation we are closing. Older versions of the app (before 1.0.5) read some records directly. To keep them working, other signed-in users of the app can, until 7 December 2026, technically read some account details of other players (name, email address, mobile number, date of birth and gender) and booking and payment records. Older versions also use permanent photo links. On 7 December 2026 older versions stop working, these records become readable only by the people listed in section 4, and the old photo links stop working. Please update to the latest version of the app.

9. Your rights

Under POPIA you may: - ask what information we hold about you, and get a copy; - ask us to correct or delete it; - object to how we use it; - withdraw any consent you have given; - complain to the Information Regulator: https://inforegulator.org.za.

To delete your account, go to Profile → Delete my account in the app, or visit https://upbookings.web.app/delete-account. Deletion is immediate. Your bookings and payments stay with the clubs for their records, with your name, phone number and email address removed. We can't delete an account while it has an unspent Airbucks balance, owns a club, or has upcoming paid bookings or shares you owe; the app tells you which, and what to do.

For your bookings at a club, you can also contact the club.

10. Changes to this notice

If we change how we use your information, we will update this notice and tell you in the app before the change applies. This version will be updated on 7 December 2026 to remove the limitation in section 8.

11. Contact

• Information Officer: Gustaff Pain, gustaff@biztrack.co.za, 021 832 0861
• Support: support@biztrack.co.za
• Address: BZ Tracking Solution (Pty) Ltd, 18 Ingrid Jonker Street, Langenhovenpark, Bloemfontein, Free State, 9301, South Africa

Our PAIA manual, which describes all the personal information we process across our products, is at https://biztrack.church/paia-manual.html.