2Klip App Addendum

Part A — Privacy additions

These additions extend the master Privacy Policy for the mobile app. Section references (e.g. “master policy s9”) point at the corresponding section of the Privacy Policy.

A1. The app is a processing channel

The 2Klip mobile app is a processing channel alongside WhatsApp and field missions. Personal information processed through the app is handled on the same lawful grounds and for the same purposes set out in the master Privacy Policy (ss5–6), as extended below.

A2. Analytics

We use PostHog for product analytics inside the app. This processes device and other identifiers, IP address, and app activity and in-app interactions (screens viewed, buttons tapped, and similar events) so we can understand how the app is used, fix problems, and improve it. When you are signed in, the app also sends PostHog your 2Klip account number, name and email address. (The website sends the account number but not your name or email — see Privacy Policy section 17.)

A3. Session recording

Session recording is disabled in the mobile app. Session replay is off in the mobile app and stays off until the app asks for, and you give, consent to recording, and shows you when a recording is being made. Ordinary event analytics (A2) is unaffected.

The website is different. The 2Klip website and web app do use session replay, with everything you type masked. That is described in Privacy Policy section 18.

A4. App permissions

The app requests these device permissions, each for a stated purpose:

• Location (precise and approximate) — when-in-use only, never in the background. Used when you choose to add a place, and to drop a delivery pin on your exact spot when you place or fulfil an order. The app does not track location in the background.
• Camera and microphone — Add a place only. If you choose to add a place, the app asks for camera access to record a private selfie video and take a separate place photo, and microphone access for that short video. The contribution also records the precise location at each capture so the team can privately verify it. Nothing is posted publicly by default, and you can deny permission or cancel the flow. The app does not request photo-library access.
• Notifications. Used to send the app notifications described in A5 (applies once push notifications are enabled in a released build).

A5. Push notifications

This section applies once push notifications are enabled in a released build. When push is live, the app registers a device push token and we process it to deliver notifications (for example, that a new daily game is live, or an update to an order you placed). Push tokens are delivered through Expo’s push relay and the platform push service (see A6). Notifications that carry value — such as vouchers, one-time codes, or payout confirmations — are sent by SMS, not push. You can turn notifications off at any time in your device settings.

On the website, game and prize updates are optional. If you press Turn on updates and allow your browser, OneSignal registers this browser’s push subscription and delivers those alerts through its push service and the browser platform. We do not send your name, email address, or phone number to OneSignal for this web feature. You can turn updates off in web Settings or your browser settings. Prize alerts announce opportunities; they do not confirm eligibility or a win.

A6. Named service providers and third parties

This section extends master policy s9 (cross-border transfers) by naming the services that power the app, the information they receive, and where they may process it. Some act only on our instructions as operators; others provide a service under their own terms.

• Supabase — database, authentication, and file storage. Processes in the EU (Ireland, aws eu-west-1) — outside South Africa.
• Vercel — website, app and API hosting. Our server functions run in the United States — outside South Africa.
• Paystack — card payments in the 2Klip market. Card details are entered with Paystack and never reach 2Klip. Paystack receives your email address and the amount, and may process payment data outside South Africa.
• PostHog — product analytics on the website and mobile app, plus masked session replay on the website only. Session replay is disabled in the mobile app, as explained in A3. PostHog processes on US Cloud (us.i.posthog.com) in the United States — outside South Africa.
• Expo (Expo Application Services) — push notification delivery, once push is live. Expo is based in the United States and may process push tokens outside South Africa.
• OneSignal — optional browser notification delivery on the website. It receives a browser push subscription and related device and delivery data, which may be processed outside South Africa.
• Brevo — sends our marketing email and the confirmation that your account is deleted. When you delete your account or opt out, we keep your email address on Brevo’s block list so no campaign can reach you again.
• SIMcloud — the only provider used for one-time SMS codes, and a provider for airtime or data top-ups, for supported South African numbers. Receives your phone number and the code or top-up. Account updates and reward codes stay in your signed-in Inbox.
• Google Maps Platform — address autocomplete, place details and reverse geocoding in the mobile app. When you use the delivery-address picker, Google receives the address text you type, a location used to bias the search, a selected place ID, or the coordinates you choose or obtain from your device. Google does not receive your 2Klip account details in these requests and processes the request under its own terms and privacy policy.
• Maps, fonts and pictures — CARTO and OpenStreetMap (map styles and tiles), Google Fonts (fonts) and Wikimedia Commons (pictures). Your browser or mobile app fetches these directly, so each receives your IP address and device or browser details when a page or map uses them, and may process them outside South Africa. None receives your 2Klip account details.
• Crisp — support chat, loaded only when you open it. Crisp is based in France (European Union) and processes your chat outside South Africa.

When you choose to sign in with Google or Facebook, Google and Meta act under their own terms and privacy policies. What they send us, and what we do with it, is in Privacy Policy section 17.

Where an operator processes information outside South Africa, we take the steps required by applicable law to ensure adequate protection and appropriate contractual safeguards, as described in master policy s9.

A7. Rewards data

When you earn or spend the app’s reward currency (buk2s), we process your buk2s ledger and balance, your redemption records, and the details needed to fulfil an airtime or data redemption (such as the mobile number you are topping up).

A8. 2Klip market

When you buy through the 2Klip market, we process your delivery address, your order history, and the Paystack transaction reference for each order (we do not receive or store your card details — see A6).

A9. Account deletion

You can request deletion of your account and personal information from inside the app (Settings → Delete my account) or, without installing the app, at www.2klip.com/account/delete. We action deletion within 30 days. This extends master policy s12 (data-subject rights).

Records we are required to keep for tax and financial record-keeping obligations — in particular the append-only rewards/financial ledger — are kept de-identified (your name and contact details removed, leaving an internal account number) for the period the law requires, rather than deleted. What is kept, and for how long, is listed on the deletion page.

Part B — Supplemental app terms

The unified Terms of Use govern the whole Service. These provisions add app-specific detail and must be read with them.

B1. Scope — the app and its in-app games

The Terms of Use apply to the 2Klip mobile app and its in-app digital games. By using the app you accept those Terms and the app-specific detail in this Addendum.

B2. Buk2s (the reward currency)

Buk2s are the app’s in-app reward currency. 10 buk2s = R1 for the purpose of the redemptions we make available. Buk2s:

• have no cash value outside the redemption paths we publish in the app (for example airtime or data), and cannot be exchanged for cash directly;
• are personal and non-transferable — they cannot be sold, gifted, or moved between accounts;
• do not currently expire. If we introduce an expiry rule in future, we will give reasonable notice through the app or another operational channel, consistent with the Terms.

As described in the Terms, the Company may correct obvious errors in buk2s balances and reverse buk2s awarded in breach of these Terms or a campaign’s rules.

B3. Buying physical goods through the 2Klip market

The 2Klip market lets you buy physical goods that are sold by the Company (or by sellers through the Company) and paid for via Paystack. The following apply to those purchases, in addition to the unified Terms, and are intended to be read consistently with the South African Consumer Protection Act (CPA) — where these terms conflict with a right you have under the CPA, the CPA prevails.

Order formation. Displaying a product in the app is an invitation to deal, not an offer. Your order is an offer to buy at the price shown. A contract of sale forms only when we confirm the order after successful payment; until then we may decline or cancel the order (for example if the item is out of stock or the price was shown in error), in which case any amount paid is refunded.

Pricing and availability. Prices are shown in South African rand and include VAT where applicable. Stock and promotional (flash) prices are limited and can change or sell out; the price that applies to your order is the price confirmed at checkout. We correct obvious pricing errors as above.

Payment. Payment is processed by Paystack. Card details are entered with Paystack and do not reach 2Klip. We keep only the transaction reference for your order.

Delivery / collection. Delivery or collection arrangements and any timeframes are shown at checkout or in your order details. Timeframes are estimates and are not guaranteed. Risk in the goods passes to you on delivery or collection.

Cancellation. You may cancel an order before it is dispatched or handed over for collection by contacting support; we refund amounts paid for a cancelled order. Once goods are dispatched, cancellation is handled as a return.

Returns and refunds. You may return goods and receive a refund, replacement, or repair in line with your rights under the CPA — including goods that are defective, unsafe, or not as described, and the CPA cooling-off right where it applies to the sale. To start a return, contact support@timbuk2.ai. Refunds are made to the original payment method. Nothing in this section limits any right you have under the CPA.

B4. App accounts

You may hold one account per person. You must give accurate account details and keep them current. You can delete your account as described in A9. We may suspend or remove an account on the grounds in the Terms — including suspected fraud, safety or data-protection breaches, misconduct, or breach of these Terms — and for the app-specific breaches in B5.

B5. Acceptable use of the app and its games

The fair-play rules in the Terms of Use apply to the app’s games. You must not:

• use bots, scripts, emulators, or any automated means to play the games or interact with the app;
• create or use multiple accounts, or play through another person’s account, to gain extra rewards;
• farm, collude on, or otherwise manipulate answers or game outcomes, or exploit a bug to obtain buk2s or rewards you would not otherwise earn.

As described in the Terms, we may reject, hold, or reverse rewards, and suspend accounts, for activity that breaches this section.

B6. How rewards are determined

As set out in the Terms, any points, rewards, or bonuses in the app are governed by the campaign rules published for the applicable activation. Currently, buk2s earned from an in-app game are determined by your play and the rules shown for that game at the time you play; the amount credited to your balance is the amount recorded by the Company’s systems. We may correct obvious errors and reverse rewards obtained in breach of B5.