Privacy policy

Who we are and what this covers

Ikhaya is a service that lets a host build a digital programme for a funeral, unveiling, wedding, birthday, baby shower, party, imbizo, group or business event, and share it with guests by link, QR code or WhatsApp. This policy covers the Ikhaya website, the programme pages that guests open, the host tools, and the messages we send. It does not cover a third-party site you reach by following a link from a programme, and it does not cover the separate records that a funeral parlour, church or venue keeps about you in its own right.

We handle personal information in line with the Protection of Personal Information Act, 2013 (POPIA). Where a host collects information about their own guests through a programme, the host is the responsible party for that information and Ikhaya is the operator that processes it on the host's instructions. Our separate POPIA notice sets out that relationship in more detail. The responsible party for this site is Rovaya Group (Pty) Ltd, trading as Ikhaya Events & Legacy.

What we collect

When a host creates or edits a programme we collect the details the host chooses to publish: the name of the person or occasion being honoured, dates and times, the venue or livestream link, the programme of proceedings, a short message or tribute, photographs and video the host uploads, and the host's own contact details. If the host switches on contributions we also store the bank account details the host enters so that guests can pay their respects by transfer, together with the payment reference. These bank details are stored so that they can be shown to guests who ask for them, and they are never shown in the public listing of a programme unless the host has chosen to display them.

When a guest opens a programme we collect only what is needed to serve it: the anonymous analytics described below, and any information the guest deliberately submits, such as an RSVP, a tribute, a guestbook message or a ticket purchase. Guests can read a programme without submitting anything at all.

When a host uses the host tools we collect the information needed to sign them in and to keep their programme secure, including a one-time code sent to their phone or email. We do not ask for or store card numbers. If a host connects a payment provider, the card is entered on the provider's own secure page and Ikhaya never sees the full card number.

Why we collect it, and our lawful basis

We collect programme information because the host has asked us to publish it and because we need it to perform our agreement with the host. We collect sign-in codes and security logs because we have a legitimate interest in keeping accounts and programmes safe from abuse. We collect anonymous analytics only with your consent, and we collect information you submit as a guest because you chose to submit it. We keep information for the retention periods set out below and then delete or anonymise it.

Cookies and analytics

Ikhaya uses a small number of essential cookies and local-storage entries to remember your theme choice, your language and whether you have answered the cookie banner. These are necessary for the site to work and are set without consent. With your consent we also record anonymous page views so that a host can see roughly how many people opened their programme. These analytics contain no name, no email address, no precise location and no advertising identifier, and we do not build a profile of you across other sites. You can refuse analytics and still use every part of Ikhaya. Our cookie notice lists each item and how to change your choice.

Who we share it with

We share information only with the service providers that make Ikhaya work, and only as much as each one needs. Our programme pages are hosted on Cloudflare; our database and sign-in run on Supabase; photographs and video are stored on Cloudflare R2; and transactional email and messaging may be sent through a reputable provider. Each of these providers is bound by contract to protect the information and to use it only on our instructions. Some of them store data outside South Africa, and we rely on POPIA section 72 to transfer it because the providers are subject to comparable protection.

We share a host's programme information with the guests the host shares the link with, because that is the whole point of the service. We do not sell personal information, we do not rent it, and we do not hand it to advertisers or data brokers. We will disclose information to a court, regulator or the police only where the law compels us, and where we are allowed to we will tell the host first.

How long we keep it

A published programme stays available for as long as the host keeps it live and for a short grace period afterwards, so that a family can revisit a funeral or unveiling programme on the anniversary if they wish. When a host deletes a programme we remove the programme content, the uploaded photographs and video, and the guest submissions attached to it, and we remove the associated analytics within thirty days. Sign-in codes expire within minutes and are not retained. Security and rate-limit logs are kept for a short period to detect abuse and are then deleted. Backups roll off on a fixed schedule and are never used to resurrect deleted content.

How we protect it

Bank account details and payment-provider credentials are kept in columns that the public database role cannot read, and they are reached only through a narrowly scoped server function. Payment secrets are encrypted at rest. Every table that holds personal information is protected by row-level security so that one host cannot read another host's data. We pin the search path on privileged database functions, limit how often sign-in can be attempted, and send security headers that block the page from being framed or from loading scripts we did not approve. No system is perfect, and we will notify you and the Information Regulator without undue delay if a breach puts your information at risk.

Your choices and rights

You may ask us to confirm what personal information we hold about you, to give you a copy of it, to correct anything that is wrong, to delete information we no longer need, or to stop using it for a particular purpose. You may object to processing based on our legitimate interests and you may withdraw analytics consent at any time by clearing your choice in the cookie banner. To exercise any of these rights, email our information officer at [email protected]. We will respond within a reasonable time and, where POPIA sets a deadline, within it. If you are unhappy with our answer you may complain to the Information Regulator of South Africa.

If you are a guest and you want a tribute, RSVP or guestbook entry removed, you can ask the host, who controls that programme, or ask us and we will pass the request on and help where we can.

Children

Ikhaya is not intended for children to use on their own. A host may include a child's name in a programme, but we do not knowingly collect information directly from a child under eighteen without the consent of a parent or guardian. If you believe a child's information has been collected without consent, contact us and we will remove it.

Changes to this policy

We will update this policy when our practices change and will change the date at the top. If a change materially affects how we use your information we will make that clear on the site or by message before it takes effect.

Contact

Ikhaya is a product of Rovaya Group (Pty) Ltd, a company registered in the Republic of South Africa that trades as Ikhaya Events & Legacy. Rovaya Group (Pty) Ltd is the responsible operator of this site and the party that handles your personal information. You can reach us at [email protected], on WhatsApp at +27 71 553 1005, or by phone on +27 71 122 7954. Our information officer can be reached at the same address and is responsible for how we handle personal information.

Rovaya Group (Pty) Ltd · trading as Ikhaya Events & Legacy · registered in South Africa. Company registration number and registered address are available on request from the information officer.