Privacy notice

Draft for review by the owner before launch. Prepared with the Protection of Personal Information Act (POPIA) in mind. Last updated 18 September 2026.

Who is responsible

Each stokvel is the responsible party for its members' information. Xihlovo (the platform operator) is the operator processing that information on the stokvel's instructions, and the responsible party for platform accounts (your login details).

What we process

• Account details: name, email, phone, login credentials.
• Membership records the committee captures: join date, role, ID number, address and bank details (for payouts and settlements).
• Financial records: contributions, fines, payouts, statements and exit settlements.
• Technical data: IP address and timestamp when you sign a document electronically; server logs.

How we protect it

Each stokvel's data is kept in its own isolated database schema. ID numbers and bank account numbers are encrypted at rest. Access is restricted by role within the stokvel; Xihlovo staff access is logged. Data is hosted in Microsoft Azure.

Your rights

You may ask your stokvel's committee (or Xihlovo at privacy@xihlovo.co.za) to see, correct or delete your personal information, subject to the stokvel's record-keeping obligations. Financial ledger entries are retained for the stokvel's audit trail; personal identifiers can be anonymised on request once your membership has ended.

Emails

We send transactional emails (invitations, reminders, statements, exit updates) on the stokvel's behalf. Reminder emails can be switched off by the committee.

Complaints

You may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.