beActive Life beACTIVE-SCHOOLS

beActive Schools Programme — Privacy Notice

Last updated: 23 July 2026 · Version 1.1

This notice explains what personal information beActive Life collects when you use the beActive Schools programme at schools.beactivelife.com, why we collect it, and what rights you have. Please read it before you enter your phone number.

1. Who we are

beActive Life is the responsible party for the personal information described in this notice.

Registered name: Beactivelife.COM (Pty) Ltd
Registration number: 2019/025287/07
Address: 25 Stegman Road, Claremont, Cape Town, Western Cape
Information Officer: Damon Walmsley, COO

beActive Life operates be.UP Park, Rush Extreme and Playstation by Rush.

2. What we collect and why

  • Your mobile number — to find your family's existing park waiver record and to send you a one-time verification code. You provide it when you start the form.
  • A one-time verification code (OTP) sent to your phone — to confirm the phone number is really yours before we show you any information about a child. We generate it; you type it back in.
  • Your child's first name and age — shown back to you only, so you can confirm which child you are enrolling, and used (in aggregate only) to count visits for the school. It comes from your child's existing park waiver, which you or another parent already completed at the park.
  • The school you select — to tag your child's waiver so their park visits can be counted for that school. You choose it on the form.
  • Your consent choices (the guardian confirmation, and whether you opt out of marketing) — to record what you agreed to, and to respect your marketing preference.
  • The email address on your park waiver — after you verify your phone number, we show it back to you in a masked form so you can correct it if it is wrong or missing. We use it to confirm your enrolment and to send you programme updates about your school's participation. If you type a correction, we update the email address on your family's park waiver.
  • A record that you completed this process — your phone number in a hashed, non-reversible form, plus the last 4 digits, the time, which school and which children. We keep this as proof of what happened, in case a school's payout is ever disputed, and to help us detect abuse of the form.

If your phone number does not match a waiver on file: we store your phone number, the school you selected and your children's first names (as you typed them), so we can automatically check again once your waiver is on file and text you to finish.

If your school is not yet listed: we store the school name as you typed it, your phone number and the time, so we can text you as soon as that school joins the programme.

If you tell us something on the list is wrong: the form lets you flag a child who is not yours, the same child listed twice, or a first name spelt incorrectly. We store which waiver record you flagged, what kind of problem you reported, and — only where you are correcting a spelling — the first name you typed. A person at beActive checks it and makes any correction; the form itself never changes or removes a waiver record. We ask for a first name only, never a surname.

We do not collect your child's surname, date of birth, home address or any other detail beyond first name and age, and this form never asks for them.

3. Our legal basis for processing your information

South African privacy law (POPIA) requires us to have a lawful reason for everything we do with your information. Here is ours, for each purpose:

  • Verifying your phone number (OTP): this is a security measure to confirm you are who you say you are before we show any child's information, which is a legitimate interest we have in protecting your family's data and preventing abuse of the form.
  • Linking your child to a school: this is done on the basis of your consent, as your child's parent or legal guardian. South African law calls this "competent person" consent (POPIA section 35(1)(a)). You give this consent by ticking the guardian confirmation box, and you can withdraw it at any time (see section 6), which stops your child's data being used for this programme.
  • Sending you marketing messages: because you (or your family) are already a beActive customer, we may send you occasional news and offers about our own parks under POPIA's existing-customer rule (section 69(3)). You can opt out on the form itself, and every marketing message we send gives you a free way to opt out too. School recognition messages (the occasional "well done" message celebrating what your school community has achieved) are treated the same way when we send them: if you opt out, we will not send you those either. Messages your school chooses to share on its own channels (for example its newsletter or WhatsApp groups) are your school's own communications.
  • Keeping a record of your submission: we have a legitimate interest in being able to show what was agreed, in case of a dispute about a school's payout or a query about how your information was used.

4. Who we share information with

The school never receives your child's name, age or any other identifying detail. A school only ever receives a total count of qualifying visits and a total cashback amount for the whole school, never a list of children or families. This is a locked rule of the programme, not a preference.

We use a small number of service providers ("operators" under POPIA) to run this programme. They may only use your information to provide their service to us, under a written agreement, and never for their own purposes:

  • SMS verification provider — sends your one-time verification code. Processes in South Africa, with standard SMS network routing which may pass through other countries as part of normal delivery.
  • Cloud hosting provider (Google Cloud) — hosts the form, the database and the verification service. Processes in the European Union.
  • Bot-protection service (Google reCAPTCHA Enterprise) — checks that the form is being used by a real person, not automated abuse. Processes in the United States.
  • Customer relationship system (Salesforce) — stores your family's waiver and school tag, which we already use to run our parks. Processes in the United Kingdom and United States.

Some of this processing happens outside South Africa. Where that happens, we rely on contractual protections with our providers that require them to protect your information to a standard consistent with South African law, as required by POPIA section 72. We do not transfer your information outside South Africa for any other reason.

5. How we protect your information

We use a one-time SMS code to confirm it is really you before showing any child's information. Connections to the form are encrypted. Verification codes are never stored in a form that could be read back out. Only the first name and age of your child are ever displayed, both on the form and inside our internal systems, and access to fuller records is restricted to authorised staff. Your session on the form automatically expires after a short period.

6. Your rights

Under POPIA, you have the right to:

  • know what personal information we hold about you and your child, and to ask us for a copy
  • ask us to correct information that is wrong
  • ask us to delete information, or object to how we are using it, on reasonable grounds
  • object to marketing at any time, free of charge, with no need to give a reason
  • withdraw your consent to the school-tagging described in this notice at any time, which stops that use of your child's information going forward
  • complain to the Information Regulator if you are unhappy with how we have handled your information (see section 9)

To exercise any of these rights, contact us at schools@beactivelife.com, or our Information Officer, Damon Walmsley. We will respond as soon as reasonably possible, and in any event within 30 days.

7. Children's information

Some of the information in this programme relates to children. Under South African law, only a parent or legal guardian ("competent person") can consent to a child's information being processed. By ticking the guardian confirmation box on the form, you are confirming that you are the parent or legal guardian of the children you select, and consenting on their behalf to their first name and age being shown to you and their visits being counted (in aggregate only) for the school you choose.

We only ever display your own child's first name and age back to you, the parent who verified by phone. We never show one family's children to another family. The school, as explained in section 4, never sees any child's name, age or identifying detail at all — only a total for the whole school.

You can withdraw this consent at any time by contacting us at schools@beactivelife.com, which stops your child's information being used for this programme going forward.

8. Cookies

This form uses two small pieces of data stored in your browser:

  • A session cookie, which keeps you securely logged in to the form while you complete it. It is deleted when your session ends.
  • A reCAPTCHA cookie, set by Google's bot-protection service, which helps confirm you are a real person and not an automated attack.

We do not use analytics, advertising or tracking cookies of any kind on this form.

9. How to complain to the Information Regulator

If you are not satisfied with how we have handled your information, you have the right to complain to South Africa's Information Regulator:

  • Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
  • Email (POPIA complaints): POPIAComplaints@inforegulator.org.za
  • General enquiries: enquiries@inforegulator.org.za
  • Phone: 010 023 5200 · Toll-free: 0800 017 160
  • Online: via the eServices portal at eservices.inforegulator.org.za

10. Retention — how long we keep your information

We do not keep your personal information for longer than we need it. Our retention periods for this programme are:

  • A record of your enrolment (audit record) — 5 years. Your phone number in a hashed, non-reversible form plus the last 4 digits, the time, which children, which school, and your consent choices.
  • Pending enrolments (no waiver match yet) — 6 months, then deleted if never matched. Your phone number, the school you selected, your children's first names as you typed them.
  • Unlisted-school interest — 12 months. The school name as you typed it, your phone number, the time.
  • Corrections you flagged (manual review queue) — 12 months. Your phone number in hashed form plus the last 4 digits, which waiver record you flagged, the kind of problem, and — only for a spelling correction — the first name you typed.

After these periods, your information is deleted or made anonymous. Your family's park waiver itself is separate from this programme and is covered by the waiver terms you accepted at the park.

11. Changes to this notice

We may update this notice from time to time, for example if we start using a new service provider or add a new part to the programme. The date at the top of this page shows when it was last updated. We recommend checking this page each academic year, or whenever you receive a new enrolment link.