Water Wallet Privacy Policy

Last updated: 14 July 2026

This Privacy Policy explains how Water Wallet collects, uses, stores and shares personal information.

It applies to:

parents and guardians;
teachers and school staff;
students and children;
website visitors;
Water Wallet account holders;
users of Water Wallet tags, wristbands and refill machines; and
people who contact or purchase from Water Wallet.

Water Wallet processes personal information in accordance with the Protection of Personal Information Act 4 of 2013, commonly referred to as POPIA. POPIA establishes conditions for lawful processing and includes particular protections for children’s information.

1. Who is responsible for your information?

The responsible party is:

Legal entity: Water Wallet
Trading name: Water Wallet
Registration number:
Email: admin[at]waterwallet.co.za

Information Officer

Name: Geoffrey Crewe-Brown
Email: admin[at]waterwallet.co.za

The Information Officer is responsible for overseeing Water Wallet’s compliance with POPIA and responding to privacy requests.

2. Personal information we collect

Depending on how you use Water Wallet, we may collect the following information.

Adult account information

first name and surname;
email address;
mobile number;
password in securely protected form;
relationship to a registered child;
staff role;
selected school;
account and communication preferences; and
consent records.

Child or student information

first name and surname;
school;
grade;
class;
student number, where supplied;
linked parent or guardian account;
assigned Water Wallet user number;
access-device identifier;
refill activity; and
tag or wristband status.

We aim to collect only the child information reasonably required to provide and manage the Water Wallet service.

Staff information

name;
school;
staff role;
contact details;
assigned access device;
refill activity; and
account status.

Wallet and transaction information

family-wallet reference;
wallet balance;
credit purchases;
refill deductions;
date and time of refills;
machine used;
user associated with the transaction;
reversals, adjustments or refunds; and
transaction status.

Order and payment information

products ordered;
school branding selected;
order value;
payment status;
billing information;
collection point;
fulfilment status; and
payment-gateway references.

Complete payment-card details are ordinarily processed by the payment provider rather than stored directly by Water Wallet.

Technical information

We may also collect:

IP address;
browser and device information;
login and security logs;
website cookies;
error reports;
machine connection logs; and
records needed to prevent fraud or investigate faults.

3. Why we use personal information

We use personal information to:

create and administer Water Wallet accounts;
link children or staff members to the correct school;
create and manage family wallets;
program and assign RFID or NFC access devices;
identify the correct user at the refill machine;
deduct refill charges;
display refill and wallet history;
process payments and orders;
prepare school-branded products;
deliver orders to the correct collection point;
notify account holders when products are ready;
suspend lost or compromised tags;
provide replacements;
respond to enquiries and complaints;
maintain, secure and improve the service;
comply with legal and accounting obligations;
prevent fraud and misuse; and
send marketing communications where permitted.

4. Children’s personal information

Water Wallet’s service is intended for use in schools and therefore involves the processing of children’s personal information.

We process children’s information only where there is an appropriate lawful basis, including where:

a parent, guardian or competent person has provided the necessary authorisation;
processing is needed to provide the Water Wallet service requested by the parent or guardian;
processing is necessary to protect a legitimate interest of the child;
processing is required or permitted by law; or
another lawful justification under POPIA applies.

The account holder must confirm that they are authorised to create and manage the child profile.

We do not use children’s information to send direct marketing to children.

We do not intentionally collect more information about a child than is reasonably required to operate the refill service.

The Information Regulator publishes specific guidance for responsible parties processing children’s personal information.

5. Access devices and RFID/NFC information

Each Water Wallet tag or wristband contains a unique electronic identifier.

The device identifier is linked to the user’s profile in Water Wallet’s system.

The physical tag or wristband does not ordinarily contain:

the user’s wallet balance;
complete payment-card details;
the child’s detailed personal profile; or
the account holder’s password.

When the device is tapped, the system uses its identifier to locate the correct user and family wallet.

6. Lawful grounds for processing

Depending on the circumstances, Water Wallet may process information because:

it is necessary to perform an agreement with the account holder;
the account holder or competent person has consented;
processing is required by law;
processing protects a legitimate interest of the child or another person;
processing is necessary for Water Wallet’s legitimate operational interests; or
another lawful basis under POPIA applies.

Where we rely on consent, that consent may be withdrawn. Withdrawal does not make earlier lawful processing unlawful and may affect our ability to continue providing a service that depends on the information.

7. Information shared with schools

We may share limited information with the participating school where necessary to:

verify that a user attends or works at the school;
arrange collection;
deliver tags, wristbands, bottles and accessories;
resolve user-identification problems;
investigate misuse or safety concerns;
support machine operation; or
prepare agreed school reports.

Schools should receive only the information reasonably necessary for the relevant purpose.

A school does not automatically receive access to all wallet, payment or family information.

The exact relationship between Water Wallet and each school may be governed by a separate agreement defining the parties’ privacy responsibilities.

8. Information shared with service providers

We may use carefully selected service providers for:

website hosting;
cloud storage;
email delivery;
transactional messaging;
marketing communications;
payment processing;
WooCommerce services;
equipment monitoring;
technical support;
product manufacture and engraving;
delivery;
accounting; and
legal or compliance advice.

These providers may process information only for authorised purposes and subject to appropriate contractual, confidentiality and security requirements.

Examples may include WooCommerce, a payment gateway, hosting providers and Brevo if Brevo is connected for email delivery or marketing.

9. Cross-border processing

Some technology or email providers may store or process information outside South Africa.

Where personal information is transferred internationally, we will take reasonable steps to ensure that the transfer complies with POPIA, including by using appropriate contractual or legal safeguards where required.

10. Marketing communications

Marketing consent is optional and is separate from the processing required to operate the Water Wallet account.

Where you choose to receive marketing, we may send information about:

Water Wallet news;
new products;
school-related offers;
promotions;
refill programmes; and
service developments.

You may unsubscribe at any time through the link in an email or by contacting us.

Essential service communications will still be sent where necessary to manage the account, payment, order, access device or collection.

Electronic direct marketing is regulated under POPIA, and the Information Regulator has issued guidance dealing with consent and direct marketing communications.

11. Cookies

The Water Wallet website may use cookies and similar technologies to:

keep users logged in;
maintain the shopping cart;
remember preferences;
protect website security;
measure website performance; and
support checkout and payment functionality.

Some cookies are necessary for the website to function.

Where legally required, optional analytics or marketing cookies will only be used after an appropriate choice has been made.

12. Security

We use reasonable technical and organisational safeguards designed to protect personal information against:

loss;
unauthorised access;
misuse;
alteration;
destruction; and
unlawful disclosure.

Safeguards may include:

controlled user access;
password protection;
encryption where appropriate;
secure connections;
software updates;
logging and monitoring;
backups;
staff confidentiality;
supplier controls; and
incident-response procedures.

No internet or electronic system can be guaranteed to be completely secure.

13. Security incidents

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate and take the steps required by POPIA.

This may include notifying the Information Regulator and affected data subjects where required.

14. How long we keep information

We retain personal information only for as long as reasonably necessary for:

the purpose for which it was collected;
operating an active Water Wallet account;
processing transactions and orders;
resolving disputes;
preventing fraud;
meeting tax, accounting and legal obligations; and
establishing or defending legal claims.

Indicative retention periods may include:

active account information: while the account remains active;
refill transactions: [insert retention period];
payment and tax records: as required by applicable law;
uncompleted test registrations: [insert period];
marketing consent records: while relevant and for a reasonable evidentiary period afterward;
support records: [insert period]; and
closed accounts: [insert period], unless a longer period is legally required.

Information may be anonymised rather than deleted where it can no longer identify a person.

15. Your rights

Subject to POPIA and applicable limitations, you may ask us to:

confirm whether we hold your personal information;
provide access to it;
correct inaccurate information;
update incomplete information;
delete or destroy information that we are no longer authorised to retain;
object to certain processing;
withdraw consent;
stop direct marketing; or
explain a decision based solely on automated processing, where applicable.

For a child’s information, a verified parent, guardian or competent person may submit an appropriate request.

We may need to verify the identity and authority of the requester before acting.

16. Correcting school or child information

Account holders should keep names, school, grade, class and contact information accurate.

Corrections may be made through the Parent Portal where available or requested from:

Email: admin[at]waterwallet.co.za

We may retain an audit trail of changes where reasonably necessary for security, accountability or dispute resolution.

17. Closing an account

You may request closure of a Water Wallet account by contacting us.

Before closing an account, we may need to:

verify your identity;
settle or address outstanding orders;
suspend linked access devices;
deal with any remaining wallet credit;
preserve legally required records; and
confirm whether linked children need to be transferred to another authorised account.

Account closure does not necessarily result in immediate deletion of every record where retention is required by law or reasonably necessary.

18. Complaints

Privacy enquiries or complaints should first be sent to our Information Officer:

Name: Geoffrey Crewe-Brown
Email: admin[at]waterwallet.co.za

You also have the right to lodge a complaint with the South African Information Regulator.

19. Changes to this Privacy Policy

We may update this Privacy Policy as the service, technology or law changes.

The latest version will be published on the Water Wallet website with its effective date.

Where changes materially affect how existing user information is processed, we will take reasonable steps to notify affected account holders.

20. Contact us

For privacy questions or requests:

Water Wallet
Email: admin[at]waterwallet.co.za