Version 2026-10 (draft 1)
1. Who is responsible
Masakhane Empowerment Group (“MEG”, “we”) is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). Contact: 0635006660 · info@masakaneempowermentgroup.co.za.
Information Officer: To be appointed by the committee · info@masakhaneempowermentgroup.co.za · 0635006660.
2. What we collect, and why
| Information | Why we need it |
|---|---|
| Full name, South African ID number (and the date of birth, age and gender that the number contains), cell phone, e-mail, address, household size | To know who our members are, prevent duplicate or fake registrations, contact you and run the housing and savings programme fairly. |
| Copy of your ID, proof of address, optional supporting document | To verify the information you gave and that you live in the community we serve. |
| Selfie (a photograph of your face) | To confirm that the person registering is the person on the ID, so no one can join in your name. See section 3. |
| Contributions, payment references, proof of payment | To record your savings, match them to the bank statement and keep the accounting records we are required to keep. |
| Housing applications, assessment scores and decisions | To assess need fairly and keep a record of why each decision was made. |
| Messages, complaints and reviews you send us | To reply to you, handle complaints and (only if you agree) publish your testimonial. |
| Technical data: your IP address in security logs, a login cookie | To keep accounts secure, limit repeated failed logins and investigate abuse. |
We collect only what is needed for these purposes. We do not sell your information or use it for advertising.
3. Your selfie is special personal information
A photograph of your face used to identify you is biometric information, a kind of special personal information that POPIA protects more strongly. We only process it with your explicit consent, which we ask for separately when you register, and only to verify your identity. It is never published, never shared outside the committee members who verify applications, and is not used for any automatic face-matching: a person compares it with your ID. You can withdraw your consent at any time by asking for your information to be erased (section 7).
4. Who can see your information
- Only named committee members with a personal login, and only the parts their role needs (for example the Treasurer sees payments, the Secretary sees registrations).
- Every time a staff member opens your documents it is written to an audit log.
- Service providers that help us run the site (operators): our web host, our e-mail provider and the banks that receive your payments. They may use your information only to provide that service. The organisation must have a written agreement with each of them.
- Pages load fonts from Google Fonts, so Google can see your IP address when you visit. No analytics or advertising trackers are used.
- We disclose information to authorities only when the law requires it.
5. How we protect it
The site uses HTTPS, passwords are stored only as irreversible hashes, uploaded documents are kept outside the public part of the website and are served only to you and to authorised staff, logins are rate-limited, and backups are kept in restricted storage. No system is perfectly secure; if we discover a breach that puts your information at risk we will tell the Information Regulator and the people affected, as POPIA requires.
6. How long we keep it
- Declined applications: the ID copy, address proof, selfie and personal details are erased about 90 days after the decision.
- Members: for as long as you are a member, so we can serve you.
- Financial records (contributions, payments and expenses) are kept for as long as accounting and tax law require, and are anonymised if you ask us to erase your information.
- Information you ask us to erase is deleted, together with your uploaded files, unless the law obliges us to keep it.
7. Your rights
You may, free of charge: see what we hold (signed-in members can download it under Privacy & my data), ask us to correct it, ask us to delete it, object to how we use it, and withdraw consent. Make a request there or e-mail the Information Officer. We aim to respond within 30 days.
If you believe we have not handled your information properly you may complain to the Information Regulator (South Africa): inforegulator.org.za. Please give us the chance to put things right first.
8. Cookies
We use one essential cookie to keep you signed in and protect forms from forgery. It is deleted when your session ends. We use no tracking or advertising cookies.
9. Who may register
Members must be 18 or older. A parent or guardian registers the household and speaks for the children living in it.
10. Changes
If we change this policy in a way that matters, we will update the version and date above and tell members.