Privacy Notice

1. About this notice

This notice explains, in plain language, what personal information Savvyly (Pty) Ltd collects, why, what we do with it, who we share it with, how long we keep it, how we protect it, and what rights you have. It is the notification that section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA") requires us to give you. Where we say "we", "us" or "Savvyly", we mean Savvyly (Pty) Ltd. Where we say "you", we mean the person the information is about.

We have written it for the people it describes rather than for lawyers. Where the law uses a particular term — "responsible party", "operator", "special personal information" — we use it and explain it, because those terms decide who is answerable to you.

1.1 Who we are

1.2 The two capacities in which we hold personal information

Savvyly runs two platforms, and the law treats the personal information on them differently. It is important to know which applies to you, because it decides who you should ask about your information.

2. Whose information this notice covers

This notice applies to the following people. If you fall into more than one group — a member of a cooperative institution who also holds a KASI COIN wallet, for instance — each part applies to the information collected in that capacity.

Children. KASI COIN is available only to people aged 18 or older, and our website is not directed at children. We do not knowingly collect personal information about a child. If you believe a child has given us personal information, please tell the Information Officer and we will deal with it.

3. What we collect, and where it comes from

3.1 The categories of information

3.2 Special personal information

Two kinds of information we process are "special personal information" under section 26 of POPIA, which may be processed only on the grounds the Act allows.

• Biometric information — the face image and liveness check used to verify your identity. We process it because the Financial Intelligence Centre Act requires us to establish and verify the identity of every client, which is a ground section 27(1)(b) recognises, and with your consent given in the app at the point of verification. Our platform does not create or keep a biometric template (a mathematical model of your face). The images themselves are kept only as long as the law requires (section 8).
• Information about alleged offences — a sanctions designation, or information about criminal proceedings that surfaces in screening or in a pre-employment check. We process it because the Financial Intelligence Centre Act and the fit-and-proper requirements for financial-services staff require it, as sections 27 and 33 of POPIA permit.

3.3 What you must give us, and what happens if you do not

Your identity, contact and verification information is mandatory for a KASI COIN wallet: the Financial Intelligence Centre Act requires us to identify and verify every client before we do business with them, and without that information we cannot open or keep your wallet open. Information for pre-employment and fit-and-proper checks is likewise mandatory for a role that requires those checks. Your marketing preferences, and any information you volunteer in a message or a form, are voluntary: you may decline, and nothing about your account changes if you do.

3.4 Information we receive about you from someone else

Some information reaches us from somebody other than you: a KASI COIN user who refers you to us gives us your name and contact details; the Department of Home Affairs and our identity verification provider confirm your identity; a court-records supplier returns search results; referees confirm employment history; a service provider tells us who of its people will work on our systems. Where that happens we tell you, at the first reasonable opportunity, what we received and from whom — for a referral, when we first contact you.

4. Why we use it, and on what lawful basis

Section 11 of POPIA allows personal information to be processed only on a recognised ground. The table sets out each purpose, the ground we rely on, and the information involved. We do not use your information for a purpose that is not compatible with the one for which it was collected (sections 13 and 15).

Where we rely on your consent you may withdraw it at any time (section 11(2)(b)). Withdrawal does not affect processing already done, and it does not stop processing that rests on another ground — we cannot, for example, stop keeping records that the Financial Intelligence Centre Act requires us to keep.

5. Decisions made automatically

Section 71 of POPIA gives you protection against a decision that has legal consequences for you, or affects you substantially, and that is based solely on automated processing. Some decisions on the KASI COIN platform are taken automatically, by rules we have written. None of them is taken by an artificial-intelligence model: no AI system makes or influences any decision about a client at Savvyly. The automatic decisions are these:

What you may do. If a decision about you was made automatically, you may ask us to tell you that it was, and to explain the main factors the rules took into account, and you may make representations about it. Write to support@savvyly.tech (or to complaints@savvyly.tech if you wish to complain). A member of staff who was not involved in the decision will consider what you say, and will tell you the outcome. A freeze that follows a sanctions match is always reviewed by a person, and a match that turns out to be somebody else is released.

One limit the law imposes. The Financial Intelligence Centre Act prohibits us from telling anyone that a report has been, or may be, made to the Financial Intelligence Centre. Where a decision is connected with such a report we may be unable to explain it, and that is the only reason we will ever decline to.

6. Who we share it with

We share personal information only with those who need it for one of the purposes in section 4, and only as much as they need. We do not sell personal information, and we do not share it with anybody for their own marketing.

6.1 Our operators

An "operator" is somebody who processes personal information on our behalf. Every operator that handles personal information for us does so under a written contract that requires it to process the information only on our instructions, to keep it confidential and secure, to notify us immediately of any security compromise, and not to pass it on without our consent, as sections 20 and 21 of POPIA require. The categories are:

6.2 Other recipients

• The bank and payment gateway that process your deposits and cash-outs receive what they need to move the money — your name, the amount, and the bank account for a cash-out. They act under their own licences and their own privacy notices.
• Your cooperative institution, where you use KASI COIN through one and cash out through it, receives what it needs to settle your cash-outs.
• Regulators and authorities — the Financial Intelligence Centre, the Financial Sector Conduct Authority, the Information Regulator, the South African Revenue Service, the courts and law-enforcement agencies — receive information where the law requires or permits it, for example a report under the Financial Intelligence Centre Act, or in answer to a subpoena or a lawful request.
• The public, only in the limited sense described under "The public blockchain" in section 3.
• A buyer or successor of our business, if there is one, under a duty to use the information only as this notice allows.

6.3 Artificial intelligence

We use commercially available artificial-intelligence services as productivity tools for software development and for drafting internal documents. No artificial-intelligence provider receives personal information about our clients, the members of the institutions we serve, our staff or anyone else: the material those services are given is limited by design to the company's own text and figures. No artificial-intelligence system makes or influences a decision about you.

7. Transfers outside South Africa

The platform and its database are hosted in South Africa. Some of our operators are, or process information, outside South Africa — including in the European Union, the United States and India — for example the identity verification provider, the SMS, email and push-notification services, the IP-intelligence service, and outsourced support and engineering personnel. Backup copies may be kept in a second hosting region.

Section 72 of POPIA allows personal information to be transferred to a person in a foreign country only on a recognised ground. We transfer information only where the recipient is bound by a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA's conditions, and that restricts onward transfer in the same way; or where the transfer is necessary to perform our agreement with you or another ground in section 72 applies. We record the ground for each transfer before it begins, and a service provider outside South Africa may not start work on personal information until that record exists.

8. How long we keep it

We keep personal information only for as long as we need it for the purpose it was collected for, or for as long as a law requires (section 14 of POPIA). When a period ends we delete or destroy the information, or de-identify it so that it can no longer be linked to you. The periods below run from the date shown, which matters: a period that runs from the end of a relationship protects long-standing clients whose records are still needed.

9. How we protect it

Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information by appropriate and reasonable technical and organisational measures. Our information security programme is approved by our directors, aligned to the ISO/IEC 27001 standard, and reviewed at least annually. Among other things it requires that:

• information is encrypted in transit and when stored, and the platform is hosted in South Africa;
• your KASI COIN private key never leaves your device, and the company's own signing keys are held in a managed key service rather than on anybody's computer;
• staff access is granted by role and to what the role needs; staff sign in with a password and a second factor; and access ends when the role ends;
• restricted information such as identity numbers and bank account numbers is masked on staff screens, and revealing one requires a stated reason and is recorded;
• every time a member of staff opens a client record, the access is recorded in an audit trail;
• no production client data is placed on a developer's computer, software changes reach the platform only after review, and the platform is tested for vulnerabilities;
• people who work on our systems are screened, bound by confidentiality, and trained; and
• operators are bound by the contract terms described in section 6.1.

If something goes wrong. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires, and tell you what we know, what we are doing, and what you can do to protect yourself.

10. Your rights

Section 5 of POPIA gives you the following rights. You may exercise any of them by writing to the Information Officer at admin@savvyly.tech.

How we handle a request. We will ask you to confirm your identity before we act, so that we never give your information to somebody else. We respond within 30 days, and if we need longer we will tell you why. A request for your own personal information costs nothing to make; if providing a copy involves a fee allowed by law, we tell you the amount before we incur it. If we refuse a request, in whole or part, we give you the reasons and tell you what you can do next.

Closing your wallet and deleting your account. You may ask us to close your KASI COIN wallet and delete your account at any time, by email to admin@savvyly.tech with the subject line "Account Deletion Request" from the mobile number or email address registered to the account. We first return any balance to your nominated bank account. We then delete what we are permitted to delete, and keep only what the law requires us to keep, for the periods in section 8; you will be told which records are kept and why. We confirm the closure within 30 days.

11. Members of cooperative institutions that use the core-banking platform

The Savvyly core-banking platform is software that financial institutions — starting with cooperative financial institutions (co-operative banks, financial co-operatives and savings groups), and in time commercial and mutual banks — use to run their own business: members, deposits, loans, repayments, tellers and accounting. The software is a service we provide to the institution under a contract; it is not a financial service we provide to you. Your institution decides what information about you is collected and why, and it is the responsible party. Your institution's own privacy notice governs your information, and requests about it — access, correction, deletion, objection — should go to your institution.

As the institution's operator (sections 20 and 21 of POPIA), we commit to the following:

• we process your information only on the institution's documented instructions and only to provide the software service to it;
• we do not use it for any purpose of our own — not for KASI COIN, not for marketing, not for analysis — and we do not sell it or share it with anybody the institution has not authorised;
• we keep it secure under the same information security programme described in section 9, and we host it with sub-operators bound by the same terms;
• we notify the institution immediately if we have reasonable grounds to believe your information has been compromised, so that it can notify you and the Information Regulator;
• at the end of our contract with the institution, we return the information to it or destroy it as it directs, unless a law requires us to keep it.

The information we process for an institution typically includes its members' identity and contact details, membership records, deposit and loan accounts, repayments and transactions, documents the institution uploads, and the user accounts of the institution's own staff. If you write to us about information we hold for an institution, we will refer your request to that institution without delay and tell you that we have done so. Where an institution allows its members to use KASI COIN as well, information moves between the two platforms only on the institution's instruction or with your consent, and the movement is recorded; your KASI COIN information is then governed by the rest of this notice.

12. Our website

No cookies, analytics or advertising trackers. Savvyly.tech does not set cookies, and does not use analytics, advertising or social-media tracking tools. If that changes, we will update this notice and ask for your consent before any non-essential cookie is set.

What is recorded when you visit. Our hosting and content-delivery providers record standard server logs — your IP address, the page requested, the time and your browser type — which are used only to operate and secure the website. The website loads its typefaces from Google Fonts, so your browser's request for them, including your IP address, reaches Google.

The contact form. If you use the contact form, your name, email address and message are passed through a form-forwarding service to our mailbox, and we use them only to reply to you. The correspondence is kept for the period in section 8.

13. Contacting us, and complaining to the Information Regulator

The Information Officer is responsible for our compliance with POPIA and for dealing with requests under it. The Deputy Information Officer acts in the Information Officer's absence.

Please contact the Information Officer first, so that we have the chance to put things right. If you are not satisfied with our response — or at any time — you may lodge a complaint with the Information Regulator (South Africa), which enforces POPIA and the Promotion of Access to Information Act. Its website is https://inforegulator.org.za; please see the website for its current contact details and complaint forms.

14. Changes to this notice

We review this notice at least once a year, and whenever what we collect, why, who we share it with or where it goes changes. The current version is always on our website with its date. If a change materially affects how we use information we already hold about you, we will tell you before it takes effect — in the app for KASI COIN users, and by email or in writing for others.