🔒 Privacy & Data Protection Policy

1. Overview

Eswatini Stokvels ("the Platform") is a record-keeping and governance tool operated by Ekukhuleni Labs ("we", "us", "our"). We are committed to protecting the personal information of our users in accordance with the Eswatini Data Protection Act No. 41 of 2022 ("the Act").

The Eswatini Communications Commission (ESCCOM) serves as the National Data Protection Authority under the Act. This policy explains what data we collect, why, how we protect it, and what rights you have.

2. What Data We Collect

We collect only the minimum personal information necessary to provide the service (data minimisation principle):

We collect national ID numbers solely for member identification and governance purposes within your stokvel. ID numbers are stored securely and never shared with third parties. We do not collect: bank account details, mobile money account details, biometric data, or any other sensitive personal information as defined in the Act.

3. How We Use Your Data

Your personal data is used solely to:

• Provide the stokvel management service (member tracking, contribution recording, reports)
• Authenticate your identity when you log in
• Send SMS notifications about stokvel activity (contributions recorded, approvals)
• Generate weekly reports for your stokvel administrators
• Improve the platform through anonymised usage analytics

We will never use your data for marketing, sell it to third parties, or share it with anyone outside your stokvel without your consent.

4. Who Can See Your Data

Stokvel admins cannot see data from other stokvels. Platform administrators access data only for technical support and system maintenance.

We do not share personal data with any third parties except:

• SMS providers — phone numbers are shared with our SMS gateway solely to deliver notifications
• Law enforcement — only when required by law or court order

5. Where Your Data Is Stored

Your data is stored on Amazon Web Services (AWS) infrastructure in the Africa (Cape Town) region, South Africa. This keeps your data within the Southern African region.

Data security safeguards include:

• AWS maintains internationally recognised security certifications (ISO 27001, SOC 2)
• Data is encrypted in transit (TLS/HTTPS) and at rest (AES-256)
• Access is restricted to authorised personnel only

6. How We Protect Your Data

• Encryption: All data transmitted between your device and our servers is encrypted using HTTPS/TLS
• PIN security: Your PIN is hashed before storage — we cannot see your PIN
• Brute force protection: Accounts are temporarily locked after multiple failed login attempts
• Access control: Role-based access ensures members only see their own data, admins only see their stokvel
• No passwords stored in plain text

7. Your Rights Under the Data Protection Act

As a data subject under the Act, you have the right to:

• Access — Request a copy of all personal data we hold about you. You can view your data anytime by logging into the member portal. Weekly reports also provide a full export of your records.
• Correction — Request correction of inaccurate personal data. Contact your stokvel admin or us directly.
• Deletion — Request deletion of your personal data. If you leave a stokvel, you may request that your records be removed. Note: contribution records may be retained for the stokvel's financial records with your name anonymised.
• Data portability — Receive your data in a commonly used format. Our weekly Excel reports provide this automatically.
• Object — Object to processing of your data. You may opt out of SMS notifications by contacting your stokvel admin.
• Withdraw consent — Where processing is based on consent (e.g. optional email), you may withdraw consent at any time.

To exercise any of these rights, contact us at info@ekukhulenilabs.com. We will respond within 30 days.

8. Data Retention

• Active members: Data is retained for as long as you are an active member of a stokvel on the platform
• Inactive members: If a stokvel becomes inactive, data is retained for 12 months then deleted unless the stokvel admin requests otherwise
• Deleted accounts: Upon request, personal data is deleted within 30 days. Anonymised contribution records may be retained for the stokvel's financial integrity
• Analytics data: Anonymised usage data is retained indefinitely as it cannot be linked to individuals

9. Children's Data

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

10. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights, we will:

• Notify the Eswatini Data Protection Authority (ESCCOM) as required by the Act
• Notify affected users within 72 hours of becoming aware of the breach
• Take immediate steps to contain and remediate the breach
• Document the breach and actions taken

11. Cookies & Local Storage

The Platform uses browser sessionStorage to maintain your login session. This data is stored only on your device and is automatically cleared when you close your browser. We do not use tracking cookies or third-party analytics tools.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the Platform and/or SMS notification. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact & Complaints

If you have questions about this policy or wish to exercise your data protection rights:

If you are not satisfied with our response, you have the right to lodge a complaint with the Eswatini Data Protection Authority:

14. Legal Framework

This policy is governed by and construed in accordance with:

• The Data Protection Act No. 41 of 2022, Kingdom of Eswatini
• The Electronic Communications Act, 2013
• The Electronic Communications Transactions Act, 2014