Privacy Policy

1. Information Officer

Our Information Officer’s details:

• Name: to be published on completion of company registration
• Email: privacy@stok-vel.co.za
• Address: 17 Umgazi Rd, Menlo Park, Pretoria, 0081

You may contact the Information Officer with any question, request, or complaint relating to your personal information.

2. What personal information we collect

Information you provide to us:

• Identity and contact details: full name, mobile number, email address
• Account credentials and authentication data (including OAuth sign-in identifiers)
• Stokvel group details: group name, constitution details, member roles, contribution schedules
• Financial records you or your group capture on the Platform: contributions, payouts, balances, and transaction history recorded in your group’s ledger
• Documents and images uploaded by you or your group: proof-of-payment receipts, group constitutions, meeting records, and similar governance documents
• Subscription billing details processed via our payment provider (we do not store your full card number)
• Communications you send us, including support requests

Information collected automatically:

• Device and technical data: device type, operating system, browser type, IP address
• Usage data: pages viewed, features used, session times
• Cookies and similar technologies (see section 9)

3. Why we process your information (purpose and lawful basis)

We process personal information:

• To provide the Platform — creating and managing accounts, groups, ledgers, and payout records (performance of a contract)
• To bill platform subscriptions — processing subscription payments via Peach Payments (performance of a contract)
• To communicate with you — transactional emails such as confirmations, notifications, and security alerts, sent via Resend (performance of a contract; legitimate interest)
• To secure the Platform — fraud prevention, abuse detection, rate limiting, audit logging (legitimate interest; legal obligation)
• To improve the Platform — analytics and diagnostics (legitimate interest)
• To comply with law — record-keeping, responding to lawful requests (legal obligation)

We do not sell your personal information. We do not use your personal information for third-party advertising.

4. Important: your money and your group’s records

Stok-Vel is a software platform. We do not hold, control, or take custody of stokvel member funds. Member savings are held and managed by your stokvel and its members. Financial records on the Platform are records captured by and for your group.

Platform subscription fees are the only payments processed on our behalf, and these are handled by Peach Payments.

5. Who we share information with (operators and third parties)

We use the following service providers (“operators” under POPIA) to run the Platform:

We may also disclose information where required by law, court order, or a regulator, or to protect the rights and safety of Stok-Vel, our users, or the public.

6. Cross-border transfers

Some of our service providers process data outside South Africa. Where this happens, we ensure the transfer complies with section 72 of POPIA — the recipient is subject to laws, binding corporate rules, or contractual terms providing an adequate level of protection substantially similar to POPIA.

7. How long we keep your information

We retain personal information only as long as necessary for the purposes above:

• Account and group data: for the life of the account, plus a reasonable period after closure to resolve disputes
• Financial ledger records: retained in line with legal record-keeping requirements (generally 5 years)
• Billing records: as required by tax and financial legislation
• Support communications: up to 3 years

When retention periods expire, we delete or de-identify the information.

8. Security

We protect your information using measures including encryption in transit, row-level security isolating each group’s data, append-only financial ledgers, access controls, and audit logging. No system is completely secure; if a data breach occurs that poses a risk to you, we will notify you and the Information Regulator as required by section 22 of POPIA.

9. Cookies

We use cookies and similar technologies that are strictly necessary for the Platform to function (authentication and session management) and limited analytics to understand Platform usage. You can control cookies through your browser settings, but disabling essential cookies will prevent you from signing in.

10. Your rights under POPIA

You have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of your personal information
• Object to processing based on legitimate interest
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator

To exercise these rights, contact our Information Officer (section 1). We will respond within a reasonable time and may need to verify your identity first. See also our PAIA manual.

Information Regulator (South Africa)
Email: POPIAComplaints@inforegulator.org.za
Website: https://inforegulator.org.za

11. Children

The Platform is not intended for persons under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact the Information Officer and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified on the Platform or by email. The “Last updated” date at the top reflects the current version.