Privacy Policy

Plug Central (Pty) Ltd (“Plug Central”, “we”, “us”, “our”) operates the creator-commerce platform accessible at plugcentral.co.za (the “Platform”). We are committed to protecting your personal information and processing it responsibly, lawfully, and transparently.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to it. This Policy applies to all users of the Platform, including Creators, Brands, and consumers.

This Policy is governed by the Protection of Personal Information Act 4 of 2013 (“POPIA”) and should be read together with our Terms of Service.

The Responsible Party is Plug Central (Pty) Ltd, a company registered in the Republic of South Africa.

We process your personal information only for the following lawful purposes:

• To create, manage, and operate your account on the Platform;
• To facilitate affiliate tracking, commission calculations, and payouts to Creators;
• To enable Brands to run and manage affiliate programmes;
• To personalise your experience on the Platform;
• To communicate with you about your account, transactions, and Platform updates;
• To send you marketing communications where you have consented, or where we have a legitimate interest to do so;
• To derive anonymised, aggregated audience and engagement insights from Creator content activity, which may be packaged and shared with retail brand partners for market research and campaign planning purposes (see Section 6.4);
• To detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service;
• To comply with our legal and regulatory obligations under South African law;
• To improve and develop the Platform through analytics and research;
• To provide, operate, monitor, and improve Messaging Services and automation functionality;


• To transmit, schedule, process, and manage communications initiated through connected Third-Party Platforms;


• To generate AI-assisted message suggestions, communication insights, and automation recommendations;


• To monitor platform integrity, detect spam or abusive behaviour, and enforce messaging-related restrictions and policies;


• To maintain logs, audit trails, and security records associated with Messaging Services;


• To comply with direct marketing, anti-spam, and platform compliance obligations;

We will not process your personal information for purposes incompatible with those listed above without your prior consent.

Under POPIA, we process your personal information on the following legal grounds:

• Contractual necessity: processing is required to perform our agreement with you (e.g. operating your account, processing payouts);
• Legitimate interests: processing is in our or a third party’s legitimate interests (e.g. fraud prevention, Platform security, analytics, and the derivation and commercialisation of anonymised audience insights, messaging infrastructure integrity, abuse prevention, automation monitoring, platform security, and service optimisation), where these are not overridden by your rights;
• Legal obligation: processing is required to comply with applicable law (e.g. tax reporting, regulatory requirements); and
• Consent: where we rely on your consent where required for direct marketing communications sent through Messaging Services (e.g. for marketing emails), you may withdraw that consent at any time.

Plug Central is a South African platform and primarily processes your information within South Africa. Where we use third-party service providers located outside South Africa (for example, cloud hosting services), we ensure that an adequate level of protection applies to your personal information, consistent with the requirements of POPIA section 72, either through contractual protections or by confirming the recipient country provides equivalent protection.

We retain your personal information for as long as necessary to fulfil the purposes set out in this Policy, or as required by law. Specifically:

• Account information is retained for the duration of your account and for up to 5 years after closure, for legal and compliance purposes;
• Transaction and commission records are retained for 7 years in line with South African tax and financial record-keeping requirements;
• Analytics data is retained in anonymised or aggregated form indefinitely;
• Marketing consent records are retained for the duration of your consent and for a reasonable period thereafter as evidence of consent;
• Messaging logs, communication metadata, campaign activity, and automation records may be retained for operational, security, compliance, dispute resolution, and audit purposes;

When personal information is no longer required, we securely delete or anonymise it.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL;
• Access controls limiting who within our organisation can access personal information;
• Regular security assessments of our Platform and infrastructure; and
• Secure payment processing through PCI-DSS compliant third-party processors;
• Security controls and monitoring relating to connected Third-Party Platform integrations and Messaging Services.

No method of transmission or storage is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA section 22.

As a data subject under POPIA, you have the following rights in relation to your personal information:

• Right of access: you may request a copy of the personal information we hold about you;
• Right to correction: you may request that we correct inaccurate or incomplete personal information;
• Right to deletion: you may request that we delete your personal information, subject to our legal retention obligations;
• Right to object: you may object to the processing of your personal information where we rely on legitimate interests;
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing; and
• Right to complain: you have the right to lodge a complaint with the Information Regulator of South Africa;
• Right to object to direct marketing: you may object at any time to the use of your personal information for direct marketing purposes;

To exercise any of these rights, please contact us at privacy@plugcentral.co.za. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

If you believe we have processed your personal information unlawfully or in breach of POPIA, and you are unsatisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

The Platform is not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at privacy@plugcentral.co.za.

We may send you marketing communications about new features, brand opportunities, promotions, campaigns, or Platform services where you have consented to receive such communications, where required by law, or where we are otherwise permitted to do so under applicable law.

Where users utilise Messaging Services or automation functionality through the Platform, they are solely responsible for ensuring that they have obtained any legally required consents before sending direct marketing communications to third parties.

Plug Central may process and transmit communications on behalf of users strictly for the purpose of providing Messaging Services and related Platform functionality.

You may opt out of receiving marketing communications from Plug Central at any time by:

• Clicking the “unsubscribe” link in any marketing email; or


• Contacting us at hello@plugcentral.co.za.

Opting out of marketing communications will not affect transactional or service-related communications related to your account.

The Platform contains links to third-party brand and brand websites. This Privacy Policy does not apply to those external sites. We encourage you to read the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices of third-party sites.

If you choose to connect third-party social media accounts (such as Instagram or TikTok) to your Plug Central profile, those platforms’ own privacy policies govern how they collect and use your information. If you connect Third-Party Platforms or communication channels to Plug Central, we may access and process certain account information, messaging functionality, engagement data, and communications strictly to provide the services you enable. Your interactions with Third-Party Platforms remain subject to those providers’ own terms, privacy policies, and platform rules.

Certain Platform features may utilise artificial intelligence, automation tools, or algorithmic systems to generate communication suggestions, messaging recommendations, campaign insights, engagement analytics, or workflow automation functionality.

These systems are intended to assist users and are not designed to make legally binding decisions about individuals without human involvement. Users remain responsible for reviewing and approving communications and actions generated through AI-assisted functionality.

We may process usage data, engagement metrics, prompts, and interaction patterns to improve Platform functionality, system performance, safety, and automation quality.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email or through a prominent notice on the Platform at least 14 days before the changes take effect. The updated Policy will be effective from the date indicated at the top of the document.

We encourage you to review this Policy periodically to stay informed about how we protect your personal information.

For any questions, requests, or concerns about this Privacy Policy or the handling of your personal information, please contact our Information Officer: