Privacy Policy
Last updated: September 30, 2026
This Privacy Policy explains how KEZUMA ("we", "us") collects, uses, and protects your personal information. We comply with the Protection of Personal Information Act (POPIA) of South Africa.
1. Who we are
KEZUMA is the responsible party (data controller) for the personal information described in this policy. Contact us at privacy@kezuma.co.za for any privacy-related matters.
2. What we collect
We collect the following categories of personal information:
- Account information: first name, last name, email address, phone number, password (hashed)
- Identification information: ID number (encrypted, only if you choose to provide it for verification)
- Group activity: contributions, rotations, payouts, security entries, meeting records, audit events
- Payment details: your group's banking information (which you enter manually and is stored on your behalf)
- Technical information: IP address, browser user agent, session cookies, and timestamps of activity
3. Why we collect it
We collect your information to:
- Operate the Service and provide the features you use
- Authenticate you and keep your account secure
- Record group contributions, rotations, and payouts accurately
- Prevent fraud, abuse, and unauthorised access
- Comply with our legal obligations
- Communicate with you about your account (invitations, password resets, billing)
We never sell your personal information to third parties.
4. Legal basis
Under POPIA, we process your information on these bases:
- Contract: to provide the Service you've signed up for
- Legitimate interest: to prevent fraud and secure the platform
- Legal obligation: to comply with tax, anti-money-laundering, and other laws
- Consent: where required for specific processing (e.g. marketing)
5. Who we share it with
We share your information only with:
- Your group: members of your savings group can see your name, contact details, role, and contribution history within the group
- Service providers: email delivery (Resend), hosting, and database services — all under strict contractual obligations
- Law enforcement: only when legally required, in response to a valid subpoena or court order
We do not sell or rent personal information.
6. Where we store it
Data is stored in South Africa and/or the European Union on servers operated by our hosting partners. Where data is transferred outside South Africa, we ensure appropriate safeguards are in place as required by POPIA.
7. How long we keep it
- Account data: while your account is active, plus 90 days after deletion
- Group activity records: 5 years (tax and audit requirements)
- Audit logs: 5 years
- Password reset tokens: 1 hour
- Rate limit data: 24 hours
8. Your rights (POPIA)
You have the right to:
- Access the personal information we hold about you
- Correct any inaccurate information
- Delete your information (subject to legal retention requirements)
- Object to certain processing
- Withdraw consent where processing is based on consent
- Complain to the Information Regulator of South Africa
To exercise any of these rights, email privacy@kezuma.co.za. We'll respond within 30 days.
9. Security
We protect your information with:
- HTTPS encryption for all traffic
- Argon2id password hashing (never stored in plain text)
- Encrypted storage of ID numbers
- CSRF protection on all state-changing requests
- Rate limiting on login and registration
- Full audit logging of material actions
No system is completely secure. If you suspect a security issue, contact security@kezuma.co.za.
10. Cookies
We use one cookie: a session cookie required to keep you signed in. We do not use tracking or advertising cookies.
11. Children
The Service is not intended for anyone under 18. We do not knowingly collect information from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email at least 14 days before they take effect.
13. Complaints
If you have a concern about how we handle your information, contact us first at privacy@kezuma.co.za. If you're not satisfied, you can complain to the Information Regulator:
The Information Regulator (South Africa)
Website: inforeg.org.za
Email: complaints.IR@justice.gov.za
14. Contact
privacy@kezuma.co.za