1. Who We Are
Khulisa Impact Outcomes is operated by Khulisa Social Solutions ("we", "us"). We act as a processor of personal information on behalf of the organisations that use the Platform (the "responsible parties" under POPIA). This policy explains how we collect, use and protect personal information.
2. Information We Collect
- Account information: name, email, phone, role, organisation, and authentication credentials.
- Customer Data: beneficiary, programme, financial, M&E and field data uploaded by your organisation.
- Usage data: log files, IP addresses, device type, browser, and interaction events used for security and analytics.
- Communications: support tickets, emails and feedback.
3. How We Use Information
- To provide, secure and improve the Platform;
- To authenticate users and enforce role-based access;
- To send transactional emails (invitations, reminders, receipts);
- To respond to support requests;
- To comply with legal obligations.
We do not sell personal information and we do not use it for advertising.
4. Legal Basis (POPIA & GDPR)
We process personal information based on (a) the contract with your organisation, (b) your consent where required, (c) our legitimate interests in operating a secure service, and (d) compliance with legal obligations.
5. Sharing & Sub-Processors
We share personal information only with vetted sub-processors who help us run the Platform, including:
- Cloud hosting and database (Supabase / AWS);
- Transactional email delivery (SMTP2GO);
- AI processing for analytics and report generation (OpenAI);
- Payment processing (PayFast).
We do not transfer personal information to other third parties unless required by law or with your organisation's instruction.
6. Data Security
- Strict multi-tenant isolation enforced through row-level security;
- Encryption in transit (TLS) and at rest;
- Signed URLs for private file access;
- Role-based permissions and audit logging of sensitive actions;
- Regular vulnerability scanning and security reviews.
7. Data Retention
We retain Customer Data for as long as your organisation maintains an active account. Soft-deleted records are retained for 60 days before permanent deletion. Audit logs and email logs are retained for compliance purposes for up to 7 years.
8. Your Rights
You have the right to:
- Access the personal information we hold about you;
- Request correction or deletion;
- Object to or restrict processing;
- Withdraw consent at any time;
- Lodge a complaint with the Information Regulator (South Africa).
Where Khulisa Impact Outcomes acts as a processor, please direct requests to your organisation administrator first.
9. Children's Data
The Platform is used by NGOs working with vulnerable groups, including minors. Organisations are responsible for obtaining valid parental or guardian consent before capturing data about minors, using the indemnity and consent templates provided.
10. International Transfers
Data is primarily hosted in South African or EU regions. Where transfers outside South Africa occur (for example AI processing), we rely on adequate-protection mechanisms permitted under POPIA and GDPR.
11. Cookies
We use only essential cookies required for authentication, session management and user preferences. We do not use third-party tracking or advertising cookies.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by email or in-app notice. The "Effective date" above indicates the latest revision.
13. Contact & Information Officer
For privacy questions, data subject requests or complaints, contact our Information Officer:
Email: shown@khulisa.org.za
Phone: (011) 788 8237
See also our Terms of Service.