Legal

Privacy Policy

Effective date: 1 January 2025 · Last updated: August 2026

Xkimi Xa Mali Foundation is a private, invite-only collective savings platform operated by KSDRILL-SA. This policy explains how we handle your personal information in accordance with the Protection of Personal Information Act (POPIA) and other applicable South African law.

See, correct, or delete your informationMake a POPIA data request — recorded immediately, answered within 30 days. No account needed.

01Information We Collect

We collect personal information that you voluntarily provide when you register for membership, including your full name, email address, South African ID number, phone number, and bank account details required for DebiCheck mandate registration. We also collect usage data such as login activity, contribution history, and in-app actions for audit and compliance purposes.

02How We Use Your Information

Your personal information is used exclusively to operate the Xkimi Xa Mali Foundation platform — specifically to process monthly contributions, send payment notifications, generate member statements, and maintain a complete financial audit trail. We do not sell, rent, or trade your personal information to any third party.

03Data Security

All data transmitted to and from this platform is encrypted via TLS. Passwords are hashed using industry-standard bcrypt. Bank account details are stored encrypted and accessed only for the purpose of mandate management via our authorised payment processor. Access to production data is restricted to authorised administrators only and all admin actions are logged.

04Data Retention

Member financial records, contribution histories, and audit logs are retained for a minimum of five years from the date of creation in accordance with applicable South African financial record-keeping requirements. Inactive member accounts are archived after 24 months of inactivity.

05Where Your Information Is Processed

Your payment information is processed in South Africa by Netcash, our authorised payment processor. Some of the services that run this platform — website hosting, email delivery, error monitoring, and security rate-limiting — are operated by providers located outside South Africa, which means some of your personal information is transferred and stored abroad. We only use providers that are bound by data protection obligations comparable to those required by POPIA, and we transfer only what those services need to function. By registering, you consent to this transfer. If you would like to know exactly which providers hold which information, ask the Information Officer.

06Your Rights (POPIA)

In accordance with the Protection of Personal Information Act (POPIA), you have the right to access the personal information we hold about you, request correction of inaccurate information, and request deletion of your data subject to our legal retention obligations. You may also object to processing, and withdraw consent where processing is based on it. To exercise any of these rights, use the data request form — your request is recorded the moment you submit it and we will respond within 30 days. You do not need an account to use it. If you are not satisfied with our response, you have the right to complain to the Information Regulator of South Africa.

07Information Officer

The Foundation has appointed an Information Officer who is responsible for ensuring our compliance with POPIA and for handling requests about your personal information. Requests relating to access, correction, or deletion should go through the data request form, and a complaint about how your information has been handled can be sent through the Support page. Either route reaches the Information Officer rather than an individual administrator, so that requests are properly recorded and answered within the time the Act requires.

08Cookies

This platform uses session cookies strictly necessary for authentication and security. We do not use tracking or advertising cookies. You can disable cookies in your browser settings, but doing so will prevent you from logging in.

09Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to members via email notification at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.