POPIA notice

Who is responsible for your information

POPIA draws a line between a responsible party, who decides why and how personal information is processed, and an operator, who processes it on the responsible party's instructions. When a host uses Ikhaya to publish a programme and collects information about their guests, the host is the responsible party for that information and Ikhaya is the operator. When Ikhaya collects information for its own purposes, such as a host's account details, security logs and anonymous analytics, Ikhaya is the responsible party. In both cases we apply the same security and the same respect for your rights.

The responsible party is Rovaya Group (Pty) Ltd, trading as Ikhaya Events & Legacy, a company registered in the Republic of South Africa.

What we process and why

We process the programme content a host chooses to publish, the contact and sign-in details a host needs to manage a programme, the guest submissions a guest chooses to make, and anonymous analytics recorded with consent. We process this information to publish and share a programme, to keep accounts and programmes secure, to send the messages a host asks us to send, to detect and stop abuse, and to improve the service. We do not process personal information for advertising, we do not sell it, and we do not use it to make automated decisions that have a legal effect on you.

Special personal information

A programme may reveal information that POPIA treats as special, such as religious belief, health or a person's death. We process this kind of information only because the host has chosen to publish it for a genuine family or community purpose, and we ask hosts to include only what is appropriate and to get the family's agreement before publishing sensitive details about someone else.

Cross-border transfer

Our hosting, database and media providers may store information outside South Africa. POPIA section 72 allows this where the recipient is subject to a law or binding agreement that gives a comparable level of protection. We rely on the data-protection terms of those providers, which impose comparable obligations, and we keep the list of providers in our privacy policy up to date.

Security safeguards

We keep bank account details and payment credentials in columns the public database role cannot read, and reach them only through a narrowly scoped server function. Payment secrets are encrypted at rest. Every table that holds personal information is protected by row-level security, so that one host cannot read another host's data. We pin the search path on privileged database functions, limit how often sign-in and portal codes can be attempted, and send security headers that stop the page being framed or loading unapproved scripts. We keep only the logs we need, for only as long as we need them.

Breach notification

If we become aware of a breach that puts your personal information at risk, we will notify the Information Regulator and the affected people as soon as reasonably possible, and we will tell you what happened, what we are doing about it, and what you can do to protect yourself.

Your rights under POPIA

You have the right to be told when your information is collected and why. You have the right to ask whether we hold information about you and to receive a copy of it. You have the right to ask us to correct or delete information that is wrong, out of date, or that we no longer have a reason to keep. You have the right to object to processing that is based on our legitimate interests, and to withdraw analytics consent at any time. You have the right to ask us not to use your information for direct marketing, and we will stop unless you later agree to it. You have the right to complain to the Information Regulator. To exercise any of these rights, email our information officer at [email protected]. We may ask you to prove who you are so that we do not give your information to someone else, and we will not charge you a fee for a reasonable request.

Information officer

Our information officer is responsible for encouraging compliance with POPIA, for handling requests and complaints, and for working with the Information Regulator. You can reach the information officer using the contact details below.

Contact

Ikhaya is a product of Rovaya Group (Pty) Ltd, a company registered in the Republic of South Africa that trades as Ikhaya Events & Legacy. Rovaya Group (Pty) Ltd is the responsible operator of this site and the party that handles your personal information. You can reach us at [email protected], on WhatsApp at +27 71 553 1005, or by phone on +27 71 122 7954. Our information officer can be reached at the same address and is responsible for how we handle personal information.

Rovaya Group (Pty) Ltd · trading as Ikhaya Events & Legacy · registered in South Africa. Company registration number and registered address are available on request from the information officer.