01
Scope and who is responsible
This notice applies to users of public or guest Wi-Fi networks and captive portals that Fatti 365 (Pty) Ltd ("Fatti", "we", "us") operates or supports. It supplements the general Fatti privacy notice.
The venue operator identified on the captive portal will commonly decide why visitor information is used for its venue and may be a responsible party under the Protection of Personal Information Act, 2013 (POPIA). Fatti may process information for that operator and may also be responsible for processing undertaken for network operation, security, service improvement or Fatti's own stated purposes. Venue-specific wording shown on the portal takes precedence where it gives more specific information.
02
Information that may be involved
The exact fields and technologies vary by venue and will be reflected on the portal. They may include:
- Registration information, such as name, mobile number, email address, verification status, age confirmation, survey responses and communication preferences.
- Device and network information, such as IP address, device type, browser, operating system, device or network identifiers (including a MAC address or a protected derivative), access point, connection times, session duration, data volume and network or security events.
- Portal activity, such as login attempts, pages or buttons used, consents, terms accepted and the date, time and method of those choices.
- Venue analytics, such as approximate zone or access-point location, arrival, dwell, movement and return patterns associated with a device identifier.
Depending on the network configuration and your device settings, analytics may include signals from Wi-Fi-enabled devices even if their users do not register for free Wi-Fi. We use controls intended to protect device identifiers and report venue insights in aggregated or de-identified form. We do not use Wi-Fi analytics to read the contents of your device, your passwords, private messages or the contents of encrypted communications.
03
How and why information is used
| Purpose | Typical basis |
|---|---|
| Register, verify and authenticate users and provide internet access | Your request, the Wi-Fi service terms and legitimate interests in delivering the service |
| Operate, maintain, troubleshoot, secure and prevent abuse of the network | Legitimate interests and, where applicable, legal obligations |
| Measure visits, dwell, movement, return patterns, network performance and venue usage | Legitimate interests in aggregated venue and service analytics, subject to appropriate safeguards |
| Conduct surveys and improve the venue, portal, connectivity and related services | Legitimate interests, your request or consent where required |
| Maintain records of consents, terms and opt-outs | Legal obligations and legitimate interests in demonstrating compliance |
| Send marketing or share identifiable details for another party's marketing | Your consent or another basis expressly permitted by law |
| Respond to lawful requests and establish, exercise or defend legal claims | Legal obligations and legitimate interests |
Information marked as required on a portal is needed to provide the relevant login or Wi-Fi service. If you do not provide it, we may be unable to register or authenticate you. Optional survey or marketing information is not required unless the portal clearly says otherwise and identifies a lawful reason.
04
Marketing and lead-generation choices
A venue portal may offer you the choice to receive promotions or to have your contact details used for marketing or lead generation. Where identifiable information will be shared with another organisation for its own marketing, the portal should identify that organisation or the relevant category of recipients, explain the purpose and request any consent required by law.
You can refuse an optional marketing choice without withdrawing a separate request for Wi-Fi access, unless the portal clearly and lawfully explains otherwise. You may withdraw marketing consent or opt out at any time using the unsubscribe method in a message or by contacting us. Withdrawal does not affect processing that was lawful before it was withdrawn.
06
Retention and security
Retention periods depend on the venue, the type of record and why it is needed. Registration and service records are kept only as long as reasonably necessary to provide and administer the service, honour preferences, meet legal or contractual duties, resolve disputes or protect the network. Raw device or session information is deleted, aggregated or de-identified when it is no longer reasonably required for those purposes.
We use reasonable technical and organisational safeguards designed to protect the confidentiality and integrity of information. Public Wi-Fi is not inherently risk-free: use encrypted websites and services, keep your device updated and avoid transmitting sensitive information over an untrusted connection where possible.
07
Your rights
Subject to applicable law, you may ask to:
- confirm whether your personal information is held and obtain access to it;
- correct inaccurate or incomplete information;
- delete information that is no longer authorised to be retained;
- object to certain processing or withdraw consent where consent is the basis; and
- stop direct marketing.
We may need information that reasonably links you to a registration or device record and verifies your identity. Some rights are subject to lawful limitations. You can also lodge a complaint with South Africa's Information Regulator through its eServices portal or at POPIAComplaints@inforegulator.org.za.
08
Contact and changes
Start with the privacy contact shown on the venue portal where possible, because the venue-specific operator can identify the relevant network and records. You may also contact Fatti at engage@fatti.co.za or +27 12 340 0259. Please include the venue, approximate date of connection and “Wi-Fi privacy request” in your message, but do not email us a password or other sensitive information.
We may update this notice as services, technology or legal obligations change. The effective date above identifies the current version. A portal may display a shorter notice at the point of collection and link here for the full explanation.