Privacy on Kgotla

Kgotla is run by a group of Eye of Africa owners (the organisers). For anything about your information, email privacy@getkgotla.co.za.

• Name, email and Erf number, from the members list or your request to join: to check you belong here and to send your invitation and sign-in codes.
• Your mobile number, which you give yourself (and, when texts are switched on, confirm with a code we text you): so admins can confirm it's really you (for example before approving a new phone), so you can get your sign-in code by SMS if email doesn't arrive (when texts are on), and to reach you about urgent estate matters. Only admins see it.
• That you support open governance of the estate: being a member shows this. We treat it as sensitive and never share it outside Kgotla. By joining you agree to Kgotla holding it.
• What you post, your votes, meeting replies, completed actions, questions and reports: to run the circles. Admins see vote totals, never how you voted.
• When you were last active, and a record of activity: to run the activity rings and check-ins explained on your Me page.
• Your devices: the type of device (phone, tablet or, for admins only, computer) and browser, when each was added and last used, whether you open Kgotla from its Home Screen icon or in a browser (so an admin can help you add the icon), and a passkey's public key. Your face or fingerprint never leaves your phone; Kgotla only receives a yes from it.
• Notifications, if you turn them on: the address your phone's notification service (Apple's or Google's, or Mozilla's or Microsoft's for those browsers) gives Kgotla to reach your phone, and whether you also want notifications for members' messages. A notification only says that something is waiting (for example “New messages in Late building levy”) and the number of unread items, never what anyone wrote. It is encrypted so that only your phone can read it. Turn them off any time on your Me page; signing out also stops them.
• When you opened a document or a sensitive update: for security, so a leak can be investigated. Documents and sensitive updates show your name and Erf across them on your own screen.
• The date you agreed to this notice: to record your consent.

A spouse or partner can be added by an owner, with the partner's agreement, using only their name and email. They give their own mobile number and their own consent when they join.

Before a post goes up, Kgotla checks it on our own server for insults, accusations against people, threats and other people's phone or ID numbers. Nothing is sent to an outside service. You see a short note and choose whether to change it. Posts sent anyway, possible threats and posts other members report are looked at by an admin.

• Other members see your name with your posts, and nothing else about you.
• Admins (a few members chosen by the organisers) see names, emails, Erf and mobile numbers, invitation status, and counts of activity. Never what you read, and never how you voted.
• Microsoft hosts Kgotla (Azure, South Africa) and delivers its emails (Azure Communication Services), under its data protection terms.
• Apple or Google (or Mozilla or Microsoft, for their browsers), only if you turn notifications on, pass the encrypted notification to your phone. They can't read it.
• SMSPortal (South Africa) delivers our text messages: it receives your mobile number and the code, and nothing else.
• Circle leads, community members who run one circle, see what members post in that circle and manage its polls, actions and meetings. They see no phone numbers or member details.
• Nobody else. We never sell your information or use it for marketing.

On Microsoft Azure in South Africa, with a continuous backup in the same region, encrypted at rest and in transit. Signing in needs a code sent to your email that works only on the phone that asked, and then your phone's Face ID, fingerprint or screen PIN. Each person uses Kgotla on one phone (admins may add one computer): a new phone must be approved by an admin, and the old one is then signed out. Accounts are personal and never shared. If a breach ever affects your information, we will tell you and the Information Regulator as POPIA requires.

Kgotla uses three small cookies, all needed to sign in safely: one keeps you signed in, one recognises this phone, and one holds a sign-in in progress. No advertising or tracking.

• Activity records: 13 months. Admin log: 2 years.
• Requests to join: deleted a week after being declined, 30 days after approval, or after 60 days if never decided.
• Email records: 30 days. Sensitive updates are erased when they expire.
• Everything else: while you are a member.
• When you delete your account, your profile, votes, meeting replies, completed actions, questions, private notices, reports you made, devices, notifications, requests and email records are deleted at once.
• What you posted stays. Your messages, updates, polls, actions and meetings stay in their circles, shown as “Former member” (or “Committee” for what you posted for the committee as an admin), with your full name, email and number taken out of the text. This keeps the record of what was said in each circle whole for everyone who took part, which the organisers need for accountable governance and for any dispute about the record.
• Who wrote them is sealed. Your name, email and Erf are kept with a list of those posts in a sealed record for two years after you delete your account, then deleted. It is never shown in Kgotla. An admin can open it only for one post that is in dispute, must give a reason, and every opening is written in the admin log.
• Entries in the admin log stay for two years, with your name and email removed. Backups roll over within 30 days.
• Exclusions. If the committee has decided that someone may not use Kgotla (for example a representative of the Developer), a short record of that decision (name, email and the reason) is kept for as long as the exclusion stands, so it can't be got around by asking to join again. It is deleted when the committee lifts the exclusion.

• See your information: download it from your Me page at any time (or email us if your access was removed).
• Correct it: change your number on your Me page, or ask the committee.
• Delete it: delete your account from your Me page. You can also do it before you finish setting up or accept a newer notice. If your access was removed, email us and we'll delete it for you (except the short exclusion record described above, while an exclusion stands). What you posted stays as described above; if a post of yours contains something private about you, email us and we'll look at removing it.
• Complain: email privacy@getkgotla.co.za, or contact the Information Regulator (inforegulator.org.za).

Being on Kgotla, or leaving it, never affects any petition or document you have signed.