Privacy Policy

1. Who we are

HopeOrigins is a South African platform where individuals and organisations can publish a Cause. A Cause can run a fundraiser that accepts donations in rand (ZAR), a petition that collects signatures, or both.

HopeOrigins is operated by Hoyozela (Pty) Ltd, whose registered address is [Registered physical address, South Africa]. In this policy, "we", "us" and "our" mean that company.

For the purposes of the Protection of Personal Information Act, 2013 (POPIA), we are the responsible party for the personal information described in this policy. Our Information Officer is [Information Officer full name], who can be contacted at privacy@hopeorigins.co.za.

2. What this policy covers

This policy applies to everyone who uses https://www.hopeorigins.co.za, whether you are simply browsing, donating, signing a petition, holding an account or organising a Cause.

It explains what personal information we collect, why we collect it, who can see it, how long we keep it and the rights you have over it. Our Cookie Policy explains the single cookie we use in more detail.

3. Information we receive when you visit

You can browse Causes without an account. When you do, your browser automatically sends our servers technical information such as your IP address and the type of browser you use. We use this to deliver pages, limit abusive traffic and keep security logs.

We do not use analytics, advertising or tracking cookies or scripts, and we do not build profiles of the people who visit our site.

4. Information we collect when you create an account

You need an account to publish a Cause, comment or request a payout. You don't need one to donate or to sign a petition.

When you create an account, we collect the following:

• Your first name and last name.
• Your email address. You must verify it before you can create a Cause, comment or request a payout.
• Your password. We store only a secure hash of it, never the password itself, so we cannot see or recover it.
• Your phone number, if you choose to add one. We verify it by sending a one-time code by SMS.
• A profile picture, if you choose to upload one.
• Sign-in and session records, such as when you signed in and which sessions are active, so you can use features like signing out on every device.

5. Information we collect when you donate

When you donate to a Cause, with or without an account, we collect:

• Your name and email address.
• The amount you donate and any optional tip you add for the platform.
• An optional message to the organiser, of up to 500 characters.
• Whether you chose to donate anonymously. If you do, your name is shown publicly as "Anonymous".
• The payment reference and status that our payment provider, Paystack, confirms to us.

6. Your card and payment details

You enter your card or other payment details directly on Paystack's secure checkout, and Paystack processes the payment. We never receive or store your full card number.

Paystack tells us whether a payment succeeded through a signed, verified notification, and we record the outcome against your donation. Paystack's own privacy policy governs how it handles the payment details you give it.

7. Information we collect when you sign a petition

When you sign a petition, with or without an account, we collect:

• Your name and email address.
• Whether you want your name shown publicly on the petition.
• An optional comment.
• Whether you want to receive email updates about the Cause.

8. How we verify signatures

Your signature only counts once you click the verification link we email to you. This helps keep petitions honest.

Each email address can sign a particular Cause only once. To check this without comparing plain email addresses, we also store a keyed hash of your email address.

9. Information we collect from organisers

Before we pay out any funds, every organiser must pass identity verification (sometimes called KYC, or "know your customer"). Our Finance team reviews each submission by hand and may approve it, reject it or ask you to resubmit.

If you organise a Cause as an individual, we collect your legal name, your South African ID number, a copy of your ID document and a proof of address.

If you organise a Cause on behalf of an organisation, we also collect the organisation's name, its registration number, its NPO and PBO numbers where it has them, and a copy of its registration certificate.

To pay out funds, we collect the bank account details you give us. A payout needs an approved identity verification and a verified bank account, the minimum payout is R100 and each Cause can have only one open payout request at a time. Our Finance team approves each payout and records the payment.

10. Content you publish and reports you make

When you publish a Cause, we collect and display the story, updates, cover image, gallery images and other content you add. When you comment on a Cause, we display your comment with your name.

Before we publish any image, we re-encode it and remove its hidden metadata, including EXIF data and location information, so that photos don't reveal where they were taken.

If you report a Cause, comment or other content to us, we keep the report and the details you give us so that our team can review it.

11. How we collect your information

We collect personal information in these ways:

• Directly from you, when you create an account, donate, sign a petition, organise a Cause, upload documents, publish content or contact us.
• From Paystack, which confirms the status of your payment.
• Automatically, from the technical information your browser sends when you use our site, and from the sign-in cookie described in our Cookie Policy.

12. Why we use your information and our lawful grounds

POPIA only allows us to process your personal information when we have a lawful reason to do so. We rely on the following grounds:

• To provide the service you asked for (performing our agreement with you): running your account, processing your donation, recording your signature, publishing your Cause and content, and paying out funds to organisers.
• To meet our legal obligations: verifying the identity of organisers before payouts, keeping financial and transaction records as South African law requires (for example, tax and anti-money-laundering record-keeping rules where they apply), and responding to lawful requests from authorities.
• For our legitimate interests, balanced against your rights: preventing fraud and abuse, securing accounts, limiting abusive traffic, moderating content, investigating reports and keeping our platform trustworthy for donors and signers.
• With your consent: sending you optional update emails about a Cause you signed, and verifying an optional phone number. You can withdraw your consent at any time.

13. Who can see your information

Some information is public because that is how fundraisers and petitions work. Other information stays private. Here is how it works:

• Public: Causes and their stories, updates and images; comments with the commenter's name; donor names and donation messages, unless the donor chose to donate anonymously; and signer names, only where the signer chose to show their name.
• Anonymous donations: shown publicly as "Anonymous". Only you and a limited number of our Finance team and senior administrators can see the name behind an anonymous donation.
• Never public: donors' and signers' email addresses, phone numbers, passwords, and all identity verification and bank details.
• Identity documents and proof of address: stored in private storage that only our Finance team and senior administrators can open, through links that expire after five minutes.
• Bank account numbers: encrypted and only ever displayed in masked form, for example ••••1234.

14. Service providers we share information with

We don't sell your personal information. We share it only with trusted service providers (called operators under POPIA) who help us run the platform. They may use it only to provide their services to us and must keep it secure and confidential.

• Paystack: processes donations and card payments.
• Resend: sends our transactional emails, such as verification links, sign-in codes and payment confirmations.
• SMS South Africa: sends SMS verification codes for phone numbers.
• Cloudflare R2: stores uploaded files, including public images and private identity documents.
• Railway: hosts our application and our database.

15. When we may disclose information for legal reasons

We may disclose personal information if the law requires it, for example in response to a court order, a lawful request from a regulator or law enforcement, or to report suspected fraud. Where the law allows, we will tell you before we do so.

16. Transfers outside South Africa

Some of our service providers may store or process personal information on servers outside South Africa.

Section 72 of POPIA only allows us to transfer your personal information outside South Africa if the recipient is bound by a law, binding corporate rules or an agreement that gives it a level of protection substantially similar to POPIA, or if another ground in that section applies. We only use providers who meet this standard, and we rely on their contractual data protection commitments.

17. How long we keep your information

We keep personal information only for as long as we need it for the purposes in this policy or as the law requires. When we no longer need it, we delete it or anonymise it so it can no longer identify you.

• Donation, tip, payout and other financial records: [5] years, as generally required by South African law.
• Identity verification documents and details: [5] years after your last payout or after your account closes, where the law requires us to keep them.
• Account information: for as long as your account is open, and then deleted or anonymised, except where we must keep it for the reasons above.
• Petition signatures: for as long as the Cause remains on the platform. Unverified signatures are deleted after [X] days.
• Sign-in sessions: until they expire after 30 days of inactivity, or until you sign out.
• Security logs: [X] months.
• Backups: copies in our backups are overwritten on a rolling basis within [X] days.

18. How we protect your information

We take reasonable technical and organisational steps to keep your personal information safe. These include:

• Encrypting sensitive fields at rest, including South African ID numbers (using AES-256-GCM) and bank account numbers.
• Storing passwords only as secure hashes.
• Keeping identity documents in private storage, reachable only through short-lived links.
• Requiring two-factor authentication for every administrator.
• Removing passwords, sign-in tokens, codes, ID numbers and account numbers from our system logs.
• Logging security events and limiting the rate of requests to protect against abuse.
• Taking regular database backups, including an encrypted nightly copy kept in private storage.

19. If something goes wrong

No system is perfectly secure. If we believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as POPIA requires, as soon as reasonably possible.

You can help protect your account by using a strong, unique password. If you think someone else has accessed your account, change your password, which signs out your other sessions, or use "sign out everywhere", and let us know.

20. Your rights

Under POPIA, you have the right to:

• Ask whether we hold personal information about you, and ask for a copy of it.
• Ask us to correct information that is inaccurate, out of date or incomplete.
• Ask us to delete or destroy your information, where we are not required to keep it.
• Object to us processing your information for our legitimate interests.
• Withdraw any consent you have given, such as for update emails.
• Object to direct marketing at any time.
• Lodge a complaint with the Information Regulator.

21. How to exercise your rights

To make a request, email our Information Officer at privacy@hopeorigins.co.za. We may need to confirm your identity before we act on it, so that we don't give your information to someone else.

We will respond within a reasonable time. If we can't do what you ask, for example because the law requires us to keep certain financial records, we will explain why.

Our PAIA manual, which explains how to request access to records under the Promotion of Access to Information Act, 2000, is available on request.

22. Emails and direct marketing

We send transactional emails that you need to use the platform, such as verification links, sign-in codes, payment confirmations and important notices about your account or Cause. These are not marketing.

If you sign a petition and choose to receive updates, we will email you updates about that Cause. Every update email includes an unsubscribe link, and you can use it at any time.

We will only send you direct marketing if you have agreed to receive it, and every marketing message will give you an easy way to opt out.

23. Children

You must be 18 or older to create an account, run a Cause or donate. People under 18 should not give us any personal information.

If you believe a child has given us personal information, please contact us at privacy@hopeorigins.co.za and we will delete it.

24. Changes to this policy

We may update this policy from time to time, for example when we add features or when the law changes. We will change the date at the top of this page when we do.

If we make an important change, we will tell you by email or with a notice on the platform before the change takes effect.

25. Contact us and complaints

For privacy questions or requests, contact our Information Officer, [Information Officer full name], at privacy@hopeorigins.co.za, or write to us at [Registered physical address, South Africa].

For general help, email support@hopeorigins.co.za. To report misuse of the platform, email trust@hopeorigins.co.za.

If you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right. You also have the right to complain to the Information Regulator (South Africa), which you can contact through its website at inforegulator.org.za.