Iris by Media Matters Privacy Policy
Effective date: 26 September 2026
Version: 1.0
1. About this policy
This Privacy Policy explains how Media Matters (Pty) Ltd (registration number 2023/660038/07) processes personal information through Iris by Media Matters (“Iris”).
Iris is a channel-agnostic digital concierge currently made available through WhatsApp for participating shopping centres and landlords. The relevant shopping centre or landlord will be identified in the WhatsApp profile, conversation or related service information.
Media Matters operates the Iris platform as the technology and service provider for participating shopping centres and landlords, and is responsible for the operation, security and platform-level processing described in this policy. Depending on the arrangement, a participating shopping centre or landlord may determine the purposes of processing personal information through its own WhatsApp Business Account and communications, in which case Media Matters processes that information on its behalf. Each participating organisation remains responsible for its own processing and legal obligations. The specific roles are set out in the agreements between Media Matters and each participating organisation.
Media Matters contact details
- Registered address: 37 Kwadouw Drive, Longlands Estate, Stellenbosch, 7600, South Africa
- Information Officer: Liam McCreedy
- Privacy email: liam@mediamattersventures.com
- Telephone: +27 82 576 3013
2. Scope
This policy applies when you communicate with or use Iris, request assistance through Iris, consent to receive promotional communications through Iris, or contact Media Matters about Iris.
WhatsApp, a participating shopping centre or landlord, and other third-party services may have their own privacy notices. This policy does not replace those notices where those parties process personal information for their own purposes.
3. Personal information Iris processes
Depending on how you use Iris, Media Matters may process:
- your WhatsApp telephone number;
- the content of your messages and relevant conversation history;
- voice notes and transcripts of voice notes;
- message identifiers, dates and times, and delivery or read status made available through the messaging platform;
- menu, button and preference selections;
- the shopping centre you contacted, selected or asked about;
- structured information derived from your request, such as the requested category, service or brand, fulfilment preference, urgency, clarification requirements, matched centre tenant and resolution outcome;
- a pseudonymous shopper identifier generated from your telephone number and the relevant centre;
- marketing consent, withdrawal and opt-out records;
- support requests, complaints and privacy requests; and
- security, diagnostic and audit records.
Iris does not ordinarily collect your WhatsApp profile name, precise GPS location, images or documents. Please do not send unnecessary sensitive or confidential information. If you voluntarily include additional personal information in a message or voice note, that information may form part of the conversation long enough for Iris to respond and apply this policy.
Receipt images and reward-programme entries are not part of the current service. If those features are introduced, this policy and the relevant collection notice will be updated to cover them before any such information is collected.
4. Sources of personal information
Media Matters obtains personal information:
- directly from you when you communicate with Iris or make a request;
- from WhatsApp, Meta and Twilio as needed to send, receive and manage messages;
- from the participating shopping centre or landlord when it supplies centre, tenant, service or campaign information; and
- by generating structured classifications, pseudonymous identifiers and service records from your interaction.
5. Why personal information is processed
Media Matters processes personal information to:
- receive, understand and answer your requests;
- identify the relevant shopping centre and provide centre, tenant or service information;
- maintain appropriate conversational context;
- transcribe and respond to voice notes;
- route a specific request to an identified shopping centre or landlord when you permit this;
- operate, secure, troubleshoot and audit Iris;
- prevent misuse and investigate incidents or complaints;
- produce aggregated or de-identified operational reporting for the relevant landlord’s own centres and channels;
- keep evidence of marketing consent and honour opt-outs;
- respond to access, correction, objection and deletion requests; and
- comply with legal and regulatory obligations.
Providing personal information is generally voluntary. However, Iris needs your telephone number, message content and associated messaging metadata to communicate through WhatsApp. If you do not provide information needed to understand a request, Iris may be unable to answer it.
Media Matters relies on the lawful grounds available under the Protection of Personal Information Act, 2013 (“POPIA”), as applicable to a particular activity. These may include your consent, processing necessary to provide a service or take steps at your request, compliance with a legal obligation, and the legitimate interests of you, Media Matters or the participating organisation, provided those interests do not unjustifiably infringe your privacy.
6. Artificial intelligence
Iris uses Anthropic’s commercial application programming interface to interpret requests and generate responses. The current message and a limited amount of relevant preceding conversation context may be sent to Anthropic for this purpose.
Media Matters does not use shopper conversations to train Iris or other general-purpose artificial-intelligence models and does not opt customer conversations into Anthropic model training. Anthropic states that inputs and outputs from its commercial products and API are not used to train its models by default. Anthropic may retain API inputs and outputs for a limited period under its applicable commercial terms, subject to safety, legal and contractual exceptions.
Artificial-intelligence output can be incomplete or incorrect. You may ask Iris for clarification or request assistance from the identified shopping centre where appropriate. Do not rely on Iris as an emergency service.
7. Marketing communications
Using Iris for a service request does not, by itself, subscribe you to promotional messages.
A participating shopping centre or landlord may invite you, at the end of an interaction, to opt in to receive promotional communications. The invitation will identify the sender or relevant centre and will provide a clear choice. Consent is optional and declining marketing will not prevent you from using Iris for ordinary service requests.
If you opt in, Iris will record the consent and may send approved promotional messages on behalf of the identified shopping centre or landlord. You may withdraw consent or opt out at any time by replying STOP or UNSUBSCRIBE, or by emailing liam@mediamattersventures.com. Opt-out requests will be honoured for future promotional communications through Iris.
Service or transactional messages that you request may still be sent where permitted after you opt out of marketing.
8. Analytics and reporting
Media Matters may create aggregated or de-identified reporting for a participating landlord across centres within that landlord’s own portfolio. This may include demand categories, service trends, unresolved requests and operational performance.
Media Matters does not:
- provide cross-landlord shopper profiles or cross-landlord identifiable reporting;
- benchmark a landlord’s centres for disclosure outside that landlord’s own portfolio;
- share shopper reports with retailers or tenants;
- sell or license shopper information or shopper insights; or
- use conversation information to train general-purpose models.
An identifiable conversation may be disclosed to the relevant shopping centre or landlord only where this is necessary to resolve a specific request and you have permitted the disclosure.
Nothing in this policy authorises Media Matters or a participating organisation to share, sell, license or distribute WhatsApp Business Platform Data contrary to applicable Meta or WhatsApp terms.
The restrictions in this section apply to personal information and insights derived from your Iris conversations on the WhatsApp Business Platform. Where Media Matters separately and independently collects information through its own websites, search tools or other first-party channels, with its own notices and consent, that information is governed by the notice presented at the point of that collection and may be used, aggregated and de-identified in accordance with that notice and applicable law.
9. Parties that may receive or process information
Personal information may be processed by:
- the participating shopping centre or landlord where you authorise a specific referral or response;
- Meta and WhatsApp, which provide the messaging platform;
- Twilio, which provides WhatsApp messaging and telephone-number infrastructure;
- Anthropic, which provides the commercial artificial-intelligence service;
- DigitalOcean, including infrastructure located in Germany;
- Amazon Web Services, including infrastructure located in South Africa;
- professional advisers, security specialists and authorised contractors bound by appropriate confidentiality and data-protection obligations; and
- regulators, law-enforcement authorities or other recipients where disclosure is required or permitted by law.
Media Matters limits service-provider access to what is reasonably necessary for the relevant service and requires appropriate contractual, organisational and security safeguards.
10. International processing
Some personal information may be processed outside South Africa, including in Germany, because Iris uses international technology and infrastructure providers.
Where personal information is transferred outside South Africa, Media Matters will use measures contemplated by POPIA, including transferring information to recipients subject to applicable law, binding agreements or corporate rules that provide an adequate level of protection, or relying on another lawful basis for the transfer. Amazon Web Services infrastructure used for relevant processing is located in South Africa, but a provider’s support, security or affiliated operations may involve other jurisdictions under its applicable terms.
11. Retention
Media Matters retains personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal, security and dispute-resolution requirements. The intended operational periods are:
| Information | Retention period |
|---|---|
| Raw conversation text and voice-note transcripts | 90 days, then deleted or irreversibly de-identified |
| Original voice-note audio | 30 days after receipt or transcription |
| Telephone numbers and message or interaction metadata | 12 months after the last interaction |
| Structured pseudonymous intent and service records | 24 months, then deleted or irreversibly de-identified |
| Security and audit logs | 12 months |
| Support and complaint records | 3 years after closure |
| Privacy and deletion-request records | 3 years after completion |
| Marketing consent and opt-out evidence | 5 years after withdrawal or the last relevant marketing communication |
| Minimum suppression information needed to honour an opt-out | Until you validly opt in again or the record is no longer required |
| Backups | Overwritten or expired within 35 days under the backup cycle |
Aggregated information that has been irreversibly de-identified so that it no longer relates to an identifiable person may be retained for longer.
Information may be retained beyond these periods where required by law, reasonably needed to establish, exercise or defend legal claims, or necessary to investigate fraud, abuse or a security incident. Access to information retained for these limited purposes will be restricted.
12. Security
Media Matters uses reasonable and appropriate technical and organisational safeguards designed to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access. These include access controls, separation of raw conversation content from structured reporting information, pseudonymous shopper identifiers where appropriate, service-provider controls, logging and deletion procedures.
No electronic service can guarantee absolute security. If Media Matters becomes aware of a qualifying security compromise, it will take reasonable steps to contain and investigate it and will provide notifications required by applicable law.
13. Your rights
Subject to POPIA and other applicable law, you may ask Media Matters to:
- confirm whether it holds personal information about you;
- provide access to your personal information;
- correct or update inaccurate or incomplete information;
- delete or destroy information that Media Matters is no longer authorised to retain;
- object to particular processing where the law permits;
- withdraw consent for consent-based processing; and
- stop sending promotional communications.
Media Matters may need to verify that you control the relevant telephone number before acting on a request. It will not ordinarily request more identity information than reasonably necessary. Some requests may be limited where retention or processing remains authorised or required by law.
14. Data deletion instructions
To request deletion of personal information associated with Iris:
- Email liam@mediamattersventures.com with the subject “Iris data deletion request.”
- Include the WhatsApp telephone number used with Iris in international format and identify the shopping centre or centres involved, if known.
- Media Matters will contact you through an appropriate channel to verify control of the telephone number where necessary.
- After verification, Media Matters will delete or irreversibly de-identify information it is no longer authorised or required to retain and will ask relevant service providers or participating organisations to act where appropriate.
- Media Matters will confirm completion or explain any information that must lawfully be retained and the reason for doing so.
Deletion from active systems does not always remove information immediately from encrypted backups. Residual backup copies will be isolated from ordinary use and will expire within the 35-day backup cycle unless longer retention is required by law or necessary for security or legal claims.
A request to delete personal information does not automatically remove minimum suppression information needed to ensure that promotional messages are not sent after you have opted out.
15. Children
Iris is intended for people aged 18 or older. Media Matters does not knowingly solicit personal information from children through Iris and does not independently verify the age of every WhatsApp user.
If Media Matters learns that a child’s personal information has been processed without appropriate authority, it will take reasonable steps to delete or restrict the information. A parent or competent person may contact the Information Officer using the details in this policy.
16. Complaints
Please first contact the Information Officer so that Media Matters can investigate and respond:
Liam McCreedy
Email: liam@mediamattersventures.com
Telephone: +27 82 576 3013
You may also lodge a complaint with South Africa’s Information Regulator:
- Website: https://inforegulator.org.za/
- Complaints information: https://inforegulator.org.za/complaints/
- General enquiries: enquiries@inforegulator.org.za
- Telephone: 010 023 5200
- Toll-free: 0800 017 160
17. Changes to this policy
Media Matters may update this policy when Iris, its service providers, legal requirements or processing practices change. The current version will be published at:
https://mediamattersventures.com/iris/privacy
Material changes will be communicated through an appropriate channel where required.