Privacy Policy

1.About this policy

HandShake (“HandShake”, “we”, “us”) is a business networking platform for conferences and trade events, run by Pactum Holdings (Pty) Ltd (registration number 2025/975930/07). Event organisers use it to help the people attending their events (“attendees”, “you”) find relevant people to meet, request meetings and network.

This policy explains what personal information HandShake handles, why, who it’s shared with, and your rights. It is written to meet the Protection of Personal Information Act, 2013 (POPIA). Where the General Data Protection Regulation (GDPR) applies to you, we honour it too and use its terms alongside POPIA’s.

It covers the HandShake app and platform, and our website (handshake-app.co.za). The website has no forms, analytics or tracking; our hosting provider records standard request data such as your IP address. This policy does not cover an organiser’s own website, registration system or communications. The organiser’s own privacy notice covers those.

2.Our roles: who is responsible for what

HandShake serves many organisations. Each runs events, and each event has its own attendees. We have two roles, split by function:

We are not joint responsible parties. Each party answers for its own processing. Our contract with organisers (the Organiser Terms and a Data Processing Agreement) sets out their duties. These include showing you a notice at registration and getting your agreement to take part in the event’s networking and meeting recommendations before adding you to HandShake.

WhatsApp. The organiser collects any WhatsApp opt-in at registration, using wording we provide that names HandShake as the sender. They pass it to us with evidence (source and time). Without it, you get email only until you opt in yourself in the app.

3.Who we are and how to contact us

• Legal entity: Pactum Holdings (Pty) Ltd, which runs the HandShake platform.
• Company registration number: 2025/975930/07
• Registered address: 4 Belmont Road, Rondebosch, Cape Town, South Africa.
• Information Officer (POPIA): the head of Pactum Holdings (Pty) Ltd, contactable at privacy@handshake-app.co.za.
• EU/UK representative: not appointed. We keep this under review as we host events with attendees in the EU or UK.
• Privacy contact: privacy@handshake-app.co.za

For any privacy question, or to use your rights (section 11), contact us. You can also contact your event’s organiser about the information they control.

4.What personal information we process

From you (sign-up, onboarding and profile edits):

• Identity and contact: first and last name, email address (your sign-in identity), country, phone / WhatsApp number, LinkedIn URL, profile photo.
• Professional profile: company name, job title, company industry, size and website, bio, role, and any custom fields the organiser defines.
• Networking intent: industries, what you’re “looking for” and “offering”, event goals, regions, and your availability.
• Documents you upload and their file details.

Created as you use HandShake:

• Your acceptance of our terms: which version, and when.
• Communication preferences: email opt-outs, WhatsApp opt-in (with evidence) and STOP requests.
• Networking activity: connections, messages, meeting requests, and post-meeting feedback (ratings and comments).
• Agenda bookmarks: your personal schedule.
• Assistant conversations (where the event assistant is on). These are saved so you can resume them, and you can delete them. If you pass a question to the event team, the conversation is copied into that support request.
• Support requests to the event team or HandShake.
• Safety records: reports and blocks you make or that involve you, and any conduct action an organiser or HandShake takes.
• Usage analytics: what you view and search in the app, used to improve matching. You can switch this off (section 11).
• Technical and security data: IP address and browser user-agent, recorded with sign-ins and activity.

Derived by HandShake:

• Matching data: what we derive from your profile to find relevant people for you.

AI service providers. To build matches, an AI service provider in the United States analyses your profile and bio text. Where the organiser has switched on the event assistant, an AI service provider in the United States receives your questions, the event’s information (agenda, FAQ, documents list), and the limited profile details of other attendees that you could already see in the app (name, title, company, role and why you were matched). It never receives anyone’s email address or phone number. Other attendees’ questions may bring your profile details to the assistant in the same way. Under our agreements with these providers, your data is not used to train their models. Section 7 names them.

Sensitive information. HandShake doesn’t ask for special personal information (POPIA) or special-category data (GDPR), such as health, religion or political views. Please don’t put it in your bio, messages or comments. If you choose to include it, you consent to us processing it with the rest of your profile. Organisers must not use custom fields to collect it.

Children. HandShake is for business professionals. You must be 18 or older.

What’s required. Your name, email and core profile fields are needed to create an account and be matched. Other fields are optional and marked as such.

5.Where the information comes from

• The event organiser who registers you: name, email, company and registration type (and anything else they choose to share), through Add User, CSV import or the Contacts API. This includes any WhatsApp opt-in and its evidence. The organiser must show you a notice and get your agreement to take part in the event’s networking and meeting recommendations first.
• You: sign-up, onboarding, profile edits, uploads and messages.
• Your device and use of the app: analytics, IP address and user-agent.

6.Why we process your information, and our lawful basis

For the information the organiser controls (section 2), the organiser establishes the lawful basis. For the processing HandShake is responsible for:

Before you accept our terms. Between the organiser adding you and your first sign-in, we have no contract with you. During that time we rely on legitimate interest to include your organiser-provided name, title and company in other attendees’ directory, matches and assistant answers. That interest is supported by the notice the organiser gave you and the agreement you gave them.

If you don’t accept. Matching and the processing above are how HandShake works, so they can’t be turned off while using the app. If you don’t accept the Terms of Use, or later want to stop, you can’t use the app. You can request erasure (section 11). The organiser keeps your registration for the event.

Automated processing. Matching ranks and suggests people. It doesn’t make any decision with legal or similarly significant effect on you. You always choose whether to connect or meet.

Direct marketing. We send electronic marketing only with your consent (POPIA section 69), or to existing users about similar services. You can object in every message.

7.Who we share your information with

Other attendees. Your profile is visible according to the event’s visibility settings (based on registration type) and your own share settings, such as whether connections can see your email or phone.

The organiser’s team. Their event and organisation admins can see their event’s attendee profiles, activity (for example logins, connection requests, meetings confirmed and attended, and the average rating you’ve given), support requests, erasure requests and safety reports.

Our service providers, under written agreements:

When the law requires it. We may disclose information to a regulator, court or law-enforcement body where the law requires us to, or where it’s needed to protect someone’s safety or our legal rights.

If HandShake changes hands. If Pactum Holdings or the HandShake business is merged, sold or restructured, personal information may pass to the new owner. It stays protected by this policy, and we’ll tell you before a different policy applies.

We do not sell your personal information.

8.International transfers

HandShake is based in South Africa. Our main database and error monitoring are hosted in the European Union. Our other providers operate in the United States or globally (section 7). Every transfer outside South Africa relies on POPIA section 72(1)(a): the recipient is bound by an agreement giving adequate protection, including Standard Contractual Clauses where the GDPR applies. Transfers needed to provide the service you signed up for, such as your profile text going to our AI service provider for matching, also rely on section 72(1)(c), because they are necessary to perform our contract with you. US providers also rely on the EU–US Data Privacy Framework where they are certified.

9.How long we keep your information

We keep information only while we need it for the purposes above. After that we delete it or anonymise it so it can no longer identify you.

You can ask for erasure sooner (section 11). We are rolling out automated deletion for the periods above.

10.How we protect your information

• Separation: each organisation’s and event’s data is kept separate from every other’s.
• Encryption: your information is encrypted in transit and at rest.
• Access control: access is based on role (attendee, organiser, HandShake staff), and staff access only what they need.
• Monitoring: we log sensitive actions, scan uploaded files for malware, and protect sign-in against bots.
• Providers: our infrastructure providers meet recognised security standards.

If a security breach affects your personal information, we notify the Information Regulator and affected people as POPIA section 22 requires. Where the GDPR applies, we notify the relevant authority within 72 hours. For information an organiser controls, we tell the organiser within 48 hours of confirming the breach, so they can meet their own duties.

11.Your rights and how to use them

Under POPIA (and the GDPR where it applies) you have these rights. Most are self-service in Profile → Your data & privacy:

• Access and portability: export a JSON file of your data for the event. It includes your profile, connections, messages, meetings, bookmarks, availability, assistant conversations, support requests, the meeting feedback you gave, your usage analytics, your sign-in history, and your communication preferences. You can also export your accepted connections (CSV or JSON), subject to their contact-sharing settings. Safety records aren’t in the export. Ask us if you need them.
• Correction: edit your profile at any time.
• Objection: switch off usage analytics in the app. For other processing based on legitimate interest, contact us.
• Erasure: request erasure in the app. The event’s organiser reviews it and must act within 14 days. They can only decline where the law requires the records to be kept or they relate to an open safety matter, and they must tell you why. If a request is declined for another reason, or not handled in time, contact privacy@handshake-app.co.za and we will erase the information HandShake is responsible for. When erasure is carried out:
  • your profile is anonymised, and personal data that only concerns you is permanently deleted;
  • if you have no other HandShake events, your login is removed as well;
  • messages you sent stay visible to the people you sent them to, because they’re part of their record too, but your name is removed;
  • safety records are kept (section 9).

  Erasure covers the event you request it for. If you attend several events on HandShake, request it in each one, or email us to erase everything.

• Withdraw consent: reply STOP to WhatsApp. Unsubscribe from non-essential email.
• Automated decisions: matching only suggests (section 6).

For anything that isn’t self-service, contact privacy@handshake-app.co.za. We aim to respond within 30 days. Formal access requests are handled under the Promotion of Access to Information Act (PAIA). Our PAIA manual will be published before launch. Requests are free unless they’re unfounded, repetitive or excessive, or PAIA sets a fee. You can also complain to a regulator (section 13).

12.Cookies and local storage

• HandShake sets no tracking or advertising cookies. Your sign-in session is stored in your browser’s local storage, which is strictly necessary. Our usage analytics go only to our own servers.
• Our bot-protection provider (Cloudflare) may set a strictly-necessary cookie to secure the public sign-in page.
• If we ever add non-essential cookies or third-party analytics, we’ll ask for your consent first.

13.Complaints

If you think your personal information has been mishandled, please tell us first so we can put it right. You can also complain to a regulator:

• South Africa: Information Regulator. enquiries@inforegulator.org.za (complaints through inforegulator.org.za).
• European Union / United Kingdom: your local data protection authority.

14.Changes to this policy

We may update this policy. We’ll change the “last updated” date. For a material change, we’ll show you a notice in the app and ask you to review it before you continue. We’ll also email active users.