Privacy Policy

This policy describes how the business operating as HAUS OF MELLO, The Beverage House, handles personal information through its website, enquiries, Collective introductions and private accounts. For these activities, HAUS OF MELLO acts as the responsible party under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA).

Privacy questions and requests can be submitted through our Contact page. Choose General Enquiries and identify your message as a privacy request. Public direct email and telephone details are being finalised; the contact form is the currently provided channel.

• Enquiries and bookings: your name, email, phone number, company where supplied, enquiry message, event date and location, guest numbers, service times, beverage preferences and requirements.
• Hosting and franchise requests: contact details, venue and location information, proposed trading arrangements, preferred format and investment-budget range.
• Collective introductions: contact details, city or province, expertise, experience, motivation, opportunities and optional social profiles, follower estimates or portfolio links, along with your privacy acknowledgement.
• Newsletter sign-ups: your email address.
• Accounts: name, email, account identifier, authentication information and account access records. Passwords are handled by the authentication service, not displayed to the team.
• Approved ambassador portals: event revenue, agreed percentages, earnings, wallet allocations, transfers, withdrawal requests and payment status. If you provide bank details, these include account holder, bank, account number, branch code and account type.
• Calendar and administration: event proposals, booking dates and details, portal notifications, private review notes and submission status.
• Technical information: hosting and measurement services may process information such as IP address, device/browser details, page requests, referring links or campaign tags, timestamps and diagnostic information.

Most information comes from you. Authorised team members also enter review outcomes, event figures and payment records. Optional fields can be left blank. Without required contact, account or payment information, we may be unable to handle the relevant request.

Please do not include identity numbers, banking information or sensitive personal documents in public enquiries or Collective applications. Bank details belong only in the approved, private ambassador portal. If you include another person’s information, ensure you are authorised to share it.

We use information to respond to enquiries, assess bookings and hosting or franchise opportunities, review Collective introductions, administer authorised accounts, coordinate event availability, calculate and record agreed ambassador earnings, review withdrawals and make payments.

We also use necessary information to maintain security, diagnose errors, understand website traffic, prevent fraud, maintain business records and comply with lawful obligations. Submitting an enquiry does not automatically subscribe you to marketing.

Depending on the activity, processing is based on your consent, steps toward or performance of an agreement, a legal obligation, or a legitimate interest such as responding to a genuine enquiry or protecting the service. Legitimate-interest processing must respect your rights. We will seek separate consent where the law requires it; this policy is not blanket consent to unrelated uses.

Enquiries and introductions are saved for review in protected team screens, rather than sent as enquiry email alerts. Authorised team members can review records, export them as PDFs and deliberately share them through WhatsApp for necessary business handling. Automatic WhatsApp submission alerts are not currently enabled.

Ambassadors can view their own earnings, wallet, bank and proposal records. Active ambassadors can also see shared booked-event information and receive calendar-update alerts, but do not have general access to private applications or another ambassador’s wallet or bank details. Avoid putting unnecessary personal information in shared calendar descriptions.

We use service providers for website hosting, Lovable Cloud data and authentication services, media delivery and related technical operations. Necessary information may be processed by these providers on our behalf. Account invitations, confirmations and password resets may be delivered by email; these are separate from enquiry alerts.

Information may also need to be disclosed to payment/banking service providers to fulfil an authorised withdrawal, professional advisers where necessary, or authorities where lawfully required. It must not be shared beyond what is necessary for the relevant purpose. External providers such as WhatsApp or a chosen social sign-in service may also process information under their own policies.

Sign-in uses browser storage and may use cookies to maintain a session. Hosting and security services may also use necessary storage or process request information to deliver and protect the website.

Visitor measurement can include pages visited, device type, approximate location derived from technical information, referral sources and campaign tags in links. We do not use those tags to request your private social-media account information. This policy does not claim that every measurement service is anonymous or cookie-free.

You can manage cookies and local storage in your browser. Blocking necessary storage may prevent sign-in from working. If non-essential cookies or similar technologies requiring consent are introduced, appropriate information and a choice must be provided before they are used; publication of this policy alone does not provide that consent.

Google Fonts and externally linked maps, social pages or media services can receive technical information when your browser connects to them. Their own privacy terms apply to their services.

The newsletter form collects an email address for requested Haus updates. Any electronic direct marketing must comply with POPIA, including obtaining consent where required and providing an effective way to opt out. Providing details for a booking, account or application is not permission for unrelated marketing.

You may withdraw marketing consent or request removal from the newsletter list through the Contact page. Where marketing is sent, an opt-out method should also be included in the message. Essential messages about an account, enquiry or agreed service are distinct from marketing.

Information should be retained only for as long as necessary for its purpose, an ongoing relationship, required business records, a lawful retention obligation or the resolution of a dispute. This policy does not promise a single fixed deletion period for all records.

The Collective application notice describes a starting approach of team review after 12 months, followed by deletion when an introduction is no longer needed. This is a manual review approach, not automatic expiry. Financial and transaction records may need to be kept longer where law requires.

Moving a submission into the team recycle bin hides it from normal lists but is not permanent deletion. Authorised team members can restore it or permanently delete it. Backups or legally required records may remain for their applicable retention period. A deletion request will be assessed against those obligations.

The site uses authenticated access and restricted permissions for private team and ambassador records. Appropriate technical and organisational safeguards are required to protect information. No online service can guarantee absolute security; please keep your account credentials safe and avoid sending sensitive documents through public forms.

Cloud and external service providers may process information outside South Africa. Where that occurs, transfers must meet POPIA section 72 requirements, such as adequate protection under applicable law or a binding agreement, or another lawful basis for the transfer. This policy does not assert that all information is hosted in South Africa.

If a security compromise requires notification under POPIA, we will notify the Information Regulator and affected people as required by law.

Subject to applicable law, you may request confirmation of whether we hold your information and access to it; ask for correction of inaccurate information; request deletion or destruction where appropriate; object to qualifying processing; and withdraw consent where processing relies on it. Withdrawing consent does not make earlier lawful processing unlawful.

Use the Contact page and describe the request and the relevant enquiry or account. We may ask for proportionate verification before disclosing or changing records. Do not send identity documents in the initial public message. Some requests may be limited by lawful retention obligations or another person’s rights; we should explain any applicable limitation.

You can complain directly to South Africa’s Information Regulator. Information about complaints and its eService process is available on the Information Regulator’s official complaints page. You do not need to wait for us to resolve a concern before exercising a legal right to complain.

The website’s commercial applications and private ambassador services are not intended to collect children’s personal information. If you are under 18, please involve a parent or legal guardian before submitting information. If a child’s information has been submitted without appropriate authority, contact us so we can assess and address it in accordance with POPIA.

We may update this policy when our services or information-handling practices change. The date at the top identifies the current version. Material changes should be brought to affected people’s attention where appropriate, and new consent will be requested where required by law.