iKhokha operates an electronics payment system compliant with Payments Council International Data Security Standard (PCI DSS) as well as Protection of Personal Information Act (POPI Act) – POPIA. This policy outlines the principles and practices governing the collection, storage, and usage of Personally Identifiable Information (PII) and sensitive data (including financial data) at Ikhokha (hereafter referred to as “the Company”). It applies to all employees, contractors, and third-party service providers who handle subject data in relation to Customer Relationship Management (CRM), marketing, sales history, and financial data.

- Personally Identifiable Information (PII): Any information that can be used to identify a specific individual, such as names, addresses, phone numbers, email addresses, social security numbers, etc.

- Sensitive Data: Data that includes financial information, credit history, payment card details, account numbers, and any other data that could cause harm or identity theft if disclosed.

- CRM Data: Customer Relationship Management data that includes PII used for customer support, engagement, and interaction.

- Marketing Data: Data collected for marketing purposes, including customer preferences, behaviour, and other insights gathered through analytics, surveys, and campaigns.

- Sales History: Transaction data including customer purchases, payment methods, and transaction history.

- Financial Data: Customer financial information, including bank account numbers, credit card information, credit history, loan details, and any data relevant to financial transactions.

- Subject: Any individual about whom the Company may collect PII or sensitive information, including, but not limited to: customers and potential customers, employees, website visitors, and vendors

[1] iKhokha PAAIA Manual (www.ikhokha.com)

[2] iKhokha Information Processing Agreement 

[3] POPI Act South Africa

- The Company will collect only the minimum amount of PII and sensitive data necessary to achieve legitimate business purposes.

- Subjects will be informed about the type of data being collected, the purpose of its collection, and how it will be used through clear privacy notices.

- Consent must be obtained from subjects prior to collecting any PII or sensitive data beyond subject input unless the collection is mandated by law.

- PII and sensitive data may only be used for the purposes stated at the time of collection, such as processing transactions, delivering services, marketing communications (with consent), and complying with legal requirements.

- Any secondary use of subject data, such as for analytics or product development, must ensure that data is anonymized where possible.

- Sensitive data, including financial data, shall only be used for purposes related to billing, payment processing, fraud prevention, or other directly related financial activities.

 

- PII and sensitive data will be retained only as long as necessary to fulfil the purpose for which it was collected as determined by the appropriate department, or as required by law.

- Data will be securely deleted, anonymized, or destroyed after the retention period.

- All subject data will be stored in secure databases protected by encryption (both in transit and at rest) and other industry-standard security practices.

- Access to databases containing PII and sensitive data will be restricted to authorized personnel with a legitimate need to access the information.

- Multi-factor authentication (MFA) and role-based access control (RBAC) will be implemented for employees and contractors accessing sensitive subject information.

- Regular backups of subject data will be maintained and stored securely in compliance with legal and regulatory standards.

- A disaster recovery plan will ensure the swift restoration of subject data in case of data loss due to accidental deletion, system failure, or cyber-attacks.

 

- CRM data will be securely stored in systems that support encryption and access control.

- CRM data must not be shared with unauthorized third parties or used for purposes outside of customer service, relationship management, and personalized communication (with subject notification).

- Marketing campaigns using CRM data must adhere to the consent given by the subject and ensure compliance with privacy laws (e.g., POPIA, PCI-DSS, GDPR, CCPA).

 

- Marketing data may only be collected and used with the explicit consent of the subject.

- Subjects must be provided with options to opt out of marketing communications at any time.

- Data collected through website cookies or tracking technologies must comply with applicable cookie laws and consent mechanisms.

- Only the minimum amount of PII needed to create marketing profiles should be collected.

- Marketing data will be anonymized or pseudonymized where possible to limit the identification of individual subjects.

- Third-party vendors providing marketing services or analytics must adhere to the Company’s data protection policies.

- Data sharing with third-party marketing vendors may require anonymization or encryption, and vendors must agree not to resell subject data.

 

- Sales history, including customer transactions and order details, will be securely stored and protected with encryption.

- Sales history data will be accessed only by authorized personnel in departments requiring access, such as finance, sales, or customer support.

- Sales history must not be shared with third parties without customer consent, except for purposes such as auditing, regulatory compliance, or legal obligations.

 

- Financial data, including credit card details, bank account numbers, and payment transaction records, will only be collected for the purposes of processing payments, handling refunds, or ensuring compliance with legal and tax regulations.

- Financial data shall not be used for marketing or profiling purposes without explicit consent.

- Financial data will be stored in PCI-DSS (Payment Card Industry Data Security Standard) compliant systems.

- Access to financial data will be strictly limited to authorized employees involved in payment processing, billing, or fraud detection.

- Financial data may only be shared with third-party payment processors, banks, or regulatory bodies as required by law or necessary for transaction fulfilment.

- Third-party vendors handling financial data must comply with all applicable data security and privacy regulations and sign a data processing agreement (DPA).

 

- In the event of a data breach involving PII or sensitive data, the Company will follow a structured incident response plan, which includes:

- Immediate containment of the breach to prevent further data exposure.

- Notification to affected individuals within the legally required timeframes.

- Reporting the breach to regulatory authorities as required by law.

- Remediation actions to prevent future breaches, such as patching security vulnerabilities and conducting a post-breach analysis.

 

The Company is committed to complying with all relevant privacy and data protection regulations, including but not limited to:

- General Data Protection Regulation (GDPR)

- California Consumer Privacy Act (CCPA) and other similar state legislation

- Payment Card Industry Data Security Standard (PCI-DSS)

- Gramm-Leach-Bliley Act (GLBA)

- Health Insurance Portability and Accountability Act (HIPAA), where applicable.

- Regular audits will be conducted to ensure compliance with these regulations and internal data protection policies.

 

- All employees and contractors handling PII or sensitive data will receive regular training on data privacy, security practices, and regulatory compliance.

- Employees will be required to acknowledge the current data privacy and protection policy at the culmination of any such training.

 

- Subjects have the right to:

- Access their data and request corrections or updates.

- Request the deletion of their data, subject to any legal retention requirements.

- Opt out of marketing communications and data processing that is not necessary for business operations.

- Receive transparency on how their data is used and shared.

 

-          This policy will be reviewed annually, or more frequently if necessary, to reflect changes in technology, regulatory requirements, and business practices.

 

-          Violations of this policy may result in disciplinary action, up to and including termination of employment or contract. Third-party vendors who violate this policy will be subject to contract termination and legal action where applicable.