1
Who we are
iKhetha is operated by K2026012823 (SOUTH AFRICA) (Pty) Ltd, Johannesburg, South Africa. We are the responsible party under the Protection of Personal Information Act (POPIA).
2
What we collect
From voters and ticket buyers: email (required), phone and name (optional), the vote pack or ticket type bought, and the transaction reference. We do not ask you to create an account.
From organisers: name, email, phone, business name, and bank details.
From contestants: photo, biography, social handles, and voting metadata. This is uploaded by the organiser on the contestant's behalf.
From everyone who transacts: the IP address and browser user agent at the time of the transaction. We use these solely to investigate fraud and to resolve payment disputes, and retain them only as long as needed for that purpose and our standard transaction records.
From organisers: name, email, phone, business name, and bank details.
From contestants: photo, biography, social handles, and voting metadata. This is uploaded by the organiser on the contestant's behalf.
From everyone who transacts: the IP address and browser user agent at the time of the transaction. We use these solely to investigate fraud and to resolve payment disputes, and retain them only as long as needed for that purpose and our standard transaction records.
3
Payments
Card details are handled by our payment provider and are never stored on iKhetha systems. We retain transaction references only.
4
Why we collect it
To send you a receipt for votes or a QR coded ticket; to verify tickets at the door; to pay organisers for their events; to investigate suspicious voting; and to comply with our obligations under South African law.
5
Who we share it with
We share only what is necessary, and only with operators bound by appropriate data processing terms:
Our payment provider for payment processing. Card details are entered into a hosted page and are never stored on iKhetha systems.
Resend for delivering transactional email (vote receipts, tickets, password resets, sign-in alerts, account notifications).
Meta (WhatsApp Cloud API) for delivering tickets by WhatsApp, when a buyer chooses to provide a phone number at checkout. Without a phone number, no WhatsApp sharing happens.
Supabase for hosting organiser, contestant and event images.
The organiser of an event you take part in, limited to the data needed to run their event.
The South African Revenue Service or other authorities when required by law.
Our payment provider for payment processing. Card details are entered into a hosted page and are never stored on iKhetha systems.
Resend for delivering transactional email (vote receipts, tickets, password resets, sign-in alerts, account notifications).
Meta (WhatsApp Cloud API) for delivering tickets by WhatsApp, when a buyer chooses to provide a phone number at checkout. Without a phone number, no WhatsApp sharing happens.
Supabase for hosting organiser, contestant and event images.
The organiser of an event you take part in, limited to the data needed to run their event.
The South African Revenue Service or other authorities when required by law.
6
How long we keep it
Transaction records are kept for at least five years, satisfying SARS tax rules and payment-industry record-keeping requirements. Contestant photos and bios remain up while the event is live; closed events are archived and their content can be fully deleted on request (transaction records are retained regardless, to meet the retention period above).
7
Your rights under POPIA
You may ask us for a copy of the personal information we hold about you, correct it, or ask us to delete it. Email privacy@ikhetha.com. We respond within 30 days. If you're unhappy with our response, you may lodge a complaint with the Information Regulator of South Africa.
8
Cookies & analytics
We use strictly necessary cookies to keep organiser sessions secure, run the door ticket scanner, and remember your filter selections. These are always on. With your consent we also use product analytics (to understand how the site is used) and heavily masked session replay (to diagnose errors), provided by external operators bound by data processing terms. Both stay off until you accept the banner, and you can reject them with no loss of functionality. We run no advertising cookies.
9
Changes
We may update this policy. Material changes will be posted here and, for organisers, emailed in advance.