description

Privacy Policy

Last updated: 28 April 2026

This Privacy Policy explains how Evogames CC, trading as Evopoints ("Evopoints", "we", "us", "our") collects, uses, shares and protects your personal information when you use www.evopoints.co.za. It is issued in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the Electronic Communications and Transactions Act 25 of 2002 ("ECTA").

1. Who we are

The responsible party for the processing of your personal information is:

Evogames CC (trading as Evopoints)
CIPC Registration: 2010/172327/23
VAT Number: 4200259994

Aspen Business Park, 1 Madison Avenue
Aspen Lakes Ext 13, Aspen Lakes
Johannesburg South, 2059, Gauteng, South Africa

Email: info@evopoints.co.za
Phone: +27 11 455 7006
WhatsApp: +27 79 147 3863

Our Information Officer for POPIA purposes is contactable at the email address above.

2. What personal information we collect

We collect the following types of personal information:

  • Identifying data — your name and surname.
  • Contact data — email address, mobile number, and (optionally) WhatsApp number.
  • Account data — your account password (stored only in hashed form), country of residence, and your order history.
  • Payment data — truncated card details (card BIN, last 4 digits, issuing bank country) and payment status. We never see or store your full card number, expiry or CVV.
  • Bank account details — only if you pay by bank transfer and email us proof of payment.
  • Gift recipient details — the name, email, and optional WhatsApp number of any person you choose to send a gift to, along with any personal message you write.
  • Technical data collected automatically: IP address, browser, device, operating system, approximate geographic location (city level, derived from IP), and the actions you take on the site.

3. Why we collect it

We process your personal information for the following purposes, on the lawful bases set out in section 11 of POPIA:

  • To fulfil your order — processing your purchase, delivering codes, sending order confirmations. (Necessary for performance of contract.)
  • To manage your account — creating, maintaining and securing your Evopoints account. (Necessary for performance of contract.)
  • Fraud prevention — verifying your identity and screening orders for fraud risk. (Legitimate interest of both us and you.)
  • Customer service — responding to your queries, troubleshooting, processing refunds. (Necessary for performance of contract.)
  • Marketing — sending you offers and promotions, only if you have opted in. (Consent — you can withdraw at any time.)
  • Legal compliance — tax records, dispute resolution, complying with court orders or regulator requests. (Compliance with legal obligation.)

You are not required to provide personal information to us, but if you choose not to provide essentials like your email address we will not be able to deliver your order.

4. Who we share your information with

We share your personal information only with categories of recipients listed below, and only where necessary for the purposes set out above. We do not sell, rent or trade your personal information.

  • Payment service providers — to process your card or EFT payment. They handle your payment details on their own platform; we never see your full card number, expiry or CVV.
  • Fraud-prevention service — to score each order for fraud risk and protect customers and us against card misuse.
  • Communication providers — to deliver SMS one-time-passwords and (where you have opted in) marketing emails, and to send WhatsApp messages about your orders.
  • Hosting and security providers — including a content-delivery / DDoS-protection layer that handles every visitor request.
  • Analytics and authentication providers — including Google Analytics (only with your cookie consent), reCAPTCHA, and Sign in with Google or Apple if you choose to use them.
  • Legal and regulatory bodies — where required by law, such as in response to a court order, subpoena, or request from the South African Revenue Service or South African Police Service.

5. Cross-border transfers

Some of the providers above operate outside South Africa. POPIA permits cross-border transfers where the recipient is bound by privacy laws or principles substantially similar to POPIA, or where the transfer is necessary for the performance of the contract you have requested. We use providers that meet at least one of these conditions, and the amount of personal information transferred is the minimum necessary.

6. How long we keep your information

We keep your personal information only for as long as is necessary for the purposes for which it was collected, or as required by law:

  • Account, order and payment records — up to 7 years, in line with the Income Tax Act and Companies Act record-keeping requirements.
  • Marketing preferences — until you withdraw consent.
  • Fraud-prevention records (suspended accounts, blocked IPs) — up to 7 years.
  • Customer service correspondence — 3 years from your last interaction.
  • Cookies and analytics data — per the cookie banner, typically 13 months for analytics.

After these retention periods we either delete or anonymise your personal information.

7. Security

We have implemented appropriate technical and organisational measures to protect your personal information against accidental or unlawful loss, access or destruction:

  • TLS encryption on all traffic to and from our website.
  • Encryption at rest for sensitive data, including your delivered PIN codes.
  • PCI-DSS-compliant payment gateways handle all card data; we never store full card numbers or CVVs on our systems.
  • Access controls — only authorised staff can access customer data, and access is logged.
  • Regular security reviews of our infrastructure and application code.
  • POPIA-mandated breach notification — if a breach materially affects you, we will notify you and the Information Regulator as required by section 22 of POPIA.

If you suspect that your account has been compromised, please contact us immediately at info@evopoints.co.za.

8. Your rights

You have the following rights in respect of your personal information, as set out in section 5 and section 23 of POPIA:

  • Access — ask us to confirm whether we hold information about you, and request a copy.
  • Correction — ask us to correct inaccurate or incomplete information.
  • Deletion — ask us to delete information we no longer need (subject to legal retention requirements).
  • Object to processing on the basis of legitimate interest, and to direct marketing.
  • Withdraw consent at any time where we rely on consent (e.g. marketing emails).
  • Data portability — receive your information in a structured, commonly used format.
  • Not be subject to a decision based solely on automated processing — our fraud-prevention checks use automated risk scoring, but every hold-or-release decision on a flagged order is reviewed by a human staff member before action is taken.

To exercise any of these rights, email info@evopoints.co.za with the subject "POPIA request". We will respond within 30 days, as required by POPIA.

You may also have rights under the Promotion of Access to Information Act 2 of 2000 (PAIA); our PAIA manual is available on request.

9. Marketing

We send marketing emails only to customers who have opted in. Every marketing email includes an unsubscribe link. You can also withdraw consent at any time by emailing info@evopoints.co.za or by toggling the preference in your account settings.

We do not send marketing SMS or WhatsApp messages without your consent. Order-related WhatsApp messages are necessary for performance of the contract.

10. Children's privacy

Our service is not directed at children under the age of 18. We do not knowingly collect personal information from children under 18 without verifiable parental or guardian consent. If you become aware that we have collected such information, please contact us and we will delete it promptly.

11. Cookies

We use cookies and similar technologies on www.evopoints.co.za. The detailed list and your control panel are accessible via the cookie banner on your first visit and via the "Manage cookies" link in the footer.

We classify cookies into essential (always active — needed for the cart, session and security), analytics (only with your consent), and marketing (only with your consent). Our cookie consent system uses Google Consent Mode v2, which means non-essential cookies are blocked by default until you accept them.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top tells you when it was last changed. If we make material changes that affect your rights, we will notify you by email or by a prominent notice on the site before the changes take effect.

13. Complaints

If you have a privacy-related complaint, please contact us first at info@evopoints.co.za with the subject "Privacy complaint". We will acknowledge within 7 days and provide a substantive response within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator (South Africa):

14. Questions

If anything in this policy isn't clear, please reach out at info@evopoints.co.za or via the Contact page.