PRIVACY POLICY & POPIA NOTICE Kini( website and web application)
Effective Date: 01 June 2026
Last updated: 16 July 2026.


1. Introduction
This Privacy Policy explains how [KINIDATA] (“Kini”, “we”, “us” or “our”), registration number [2026 / 387810 / 07], collects, uses, discloses, retains and protects personal information of visitors to our website and users of our web application (together, the “Platform”), in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Kini helps families create and manage shared “care pools” so that a group of contributors can pool money each month toward the care needs of a family member. Because the Platform handles names, contact details and payment information for multiple people in a family group, we have set out below — in plain language — exactly what we collect and why.

By using the Platform, you agree to the collection and use of information in line with this Policy. If you do not agree, please do not use the Platform.

Kini is committed to processing personal information in accordance with the eight conditions for lawful processing set out in the Protection of Personal Information Act (POPIA), namely accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.


2. Definitions
• “Personal Information” means information relating to an identifiable, living natural person, and where applicable, an identifiable, existing juristic person, as defined in POPIA.
• “Processing” means any operation performed on personal information, including collection, storage, use, sharing, and deletion.
• “Responsible Party” means Kini, who determines the purpose and means of processing personal information collected through the Platform.
• “Operator” means a third party that processes personal information on our behalf (for example, our hosting provider or payment processor).
• “Data Subject” means the person to whom personal information relates — including Pool Organisers, Family Contributors and anyone invited to join a care pool.
• "Care Pool" means a shared funding arrangement created through the Kini Platform that allows one or more contributors to provide financial support towards the care needs of a nominated care recipient.
• "Care Recipient" means the person for whom a Care Pool has been created and whose care needs are supported through the Platform. A Care Recipient may also be referred to as the beneficiary.
• "Regulator" means the Information Regulator of South Africa.


3. Who We Are (Responsible Party)
Entity name: KINIDA; TA
Registration number 2026 / 387810 / 07
Physical address: 13 Fredman Drive, Sandton, Gauteng, 2195
Information Officer: Adv Rory Voller
Information Officer contact number: 086 100 2472
General enquiries: 086 100 2472
Website: www.kini-app.co.za

Our Information Officer is responsible for ensuring compliance with POPIA and is the first point of contact for any privacy-related questions, requests or complaints.


4. Personal Information We Collect
We collect different information depending on your role on the Platform (Pool Organiser, Family Contributor, or care recipient):


4.1 Account and identity information
• Full name and, where provided, the name of the person you are caring for
• Mobile/WhatsApp number
• Email address (where provided)
• One-time verification / OTP codes used to confirm your identity when logging in
• Your role in a care pool (Pool Organiser or Family Contributor) and your relationship to the care recipient


4.2 Care pool and financial information
• Care goal categories selected (for example, groceries, medication) and the monthly amount allocated to each
• Monthly contribution amounts, payment history, voucher allocations, voucher redemption status, payout method selected (where applicable), and fulfilment history.
• The unique Family/Kini Pool code used to join or manage a pool
•Status information such as whether an invited contributor is “pending” or has “joined” the pool

We do not store full card numbers ourselves; card and bank payment details are processed and stored by our payment processor — see section 7.


4.3 Communications
• Invitation messages sent via WhatsApp to invite family members to a pool (including the recipient's name and mobile number, which are embedded in the invitation link)
• Any support queries you send us and our responses


4.4 Technical and usage information
• IP address, device and browser type, operating system
• Log-in timestamps and session activity on the web application
• Cookies and similar technologies — see section 11


4.5 Information About Care Recipients
As part of providing the Platform, a Pool Organiser may provide personal information relating to the care recipient (beneficiary). This may include their full name, mobile number (where applicable), relationship to the Pool Organiser, care categories, voucher redemption information and other information reasonably required to create, manage and fulfil the Care Pool.

The Pool Organiser confirms that they are authorised to provide this information to Kini for the purposes of creating and managing the Care Pool and providing the requested services.


4.6 Special Personal Information
Kini does not intentionally collect or process Special Personal Information unless it is reasonably necessary to provide the services requested through the Platform.

Where health-related information (such as medication requirements, prescription information, healthcare voucher information or other care-related details) is provided by or on behalf of a care recipient, Kini processes that information only where permitted under the Protection of Personal Information Act (POPIA) and only to the extent necessary to provide the requested services.

We apply appropriate technical and organisational safeguards to protect Special Personal Information and restrict access to authorised personnel and trusted service providers who require it to perform their services.


5. How We Collect Personal Information
• Directly from you, when you sign up, set up or join a care pool, or contact usFrom a Pool Organiser, when they add or invite a Family Contributor or provide the name of the care recipient
• Automatically, through cookies and similar tracking technology when you use the PlatformFrom our payment processor, confirming that a contribution has been successfully made


6. Why We Process Your Personal Information 
We only collect personal information that is adequate, relevant and limited to what is necessary for the purposes below:
• To create and administer your account and verify your identity (for example, via OTP)
• To set up, run and display the status of a family care pool, including tracking contributions against care goals
• To send WhatsApp invitations on your behalf to people you ask us to invite to a pool
• To process monthly contributions through our payment partners
• To communicate with you about your account, a pool you belong to, or a support request
• To maintain the security of the Platform and prevent fraud or misuseTo improve the Platform's features and user experience
• To comply with our legal and regulatory obligationsWe collect only the personal information that is reasonably necessary to provide and improve the Platform.

We collect only the personal information that is reasonably necessary to provide and improve the Platform. We do not intentionally collect excessive, irrelevant or unnecessary personal information.

Kini takes reasonable steps to ensure that personal information is accurate, complete, not misleading and kept up to date. Users are encouraged to review and update their personal information whenever it changes.


7. Legal Basis for Processing
Under POPIA, we process your personal information on one or more of the following grounds:
• Consent — for example, when you agree to this Policy or opt in to receive marketing communications
• Performance of a contract — to provide the care pool and payment functionality you have signed up to use
• Legitimate interest — for example, to keep the Platform secure and to improve our services
• Legal obligation — where we are required to retain or disclose information under South African law


8. Sharing of Personal Information
We do not sell your personal information. We may share it with:
• Payment processors / payment gateway providers, to process monthly contributions (e.g. Paystack, Peach Payments, Ozow, PayFast, Stitch)
• WhatsApp / Meta Platforms, to deliver invitation and notification messages you ask us to send
• Cloud hosting and infrastructure providers, to store and run the Platform (e.g. EliteHost])
• Other members of your care pool, who will see the name and contribution status of contributors within that same pool (not their private contact details, beyond what is needed to identify them in the pool)
• Professional advisors, regulators or law enforcement, where required or permitted by law
• A prospective buyer or successor, in the event of a merger, acquisition or sale of all or part of our business

Any Operator that processes personal information on our behalf does so under a written agreement requiring them to keep it confidential and secure, and to use it only for the purpose we specify.

A current list of our principal Operators and service providers is available upon request and may be updated from time to time as our Platform evolves.


9. Cross-Border Transfers
Some of our trusted service providers (such as cloud hosting, authentication, messaging, analytics and payment processing providers) may store or process personal information outside of South Africa.

Where personal information is transferred outside South Africa, Kini will take reasonable steps to ensure that such transfers comply with section 72 of the Protection of Personal Information Act (POPIA). This means we will only transfer personal information where:
• the recipient is subject to a law, binding corporate rules or contractual obligations that provide an adequate level of protection substantially similar to POPIA;
• the transfer is necessary for the performance of a contract between you and Kini, or for implementing pre-contractual measures at your request;
• the transfer is necessary for the conclusion or performance of a contract concluded in your interest; or
• you have consented to the transfer where required by law.

All third-party Operators processing personal information on our behalf are contractually required to implement appropriate technical and organisational security measures, maintain the confidentiality of personal information, and process it only for the purposes authorised by Kini.

A current list of our key Operators and sub-processors is available upon request and may be updated from time to time as our Platform and service providers evolve.


10. Data Retention
We keep personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by law (for example, financial record-keeping obligations under South African tax and financial legislation). As a general rule:
• Account and care pool information is retained for as long as your account is active, plus [Account information is retained while your account is active, plus five (5) years thereafter.] thereafter
• Payment and contribution records are retained for [Payment records are retained for five (5) years] to meet financial and tax record-keeping requirementsOTP/verification codes are discarded once used or expired

When personal information is no longer needed, we securely delete, destroy or de-identify it.


11. Cookies and Similar Technologies
Our website and web application use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the Platform is used. You can control cookies through your browser settings; disabling certain cookies may affect the functionality of the Platform. For more detail, see our [Cookie Policy / add a cookie table here]. Where required by law, we will request your consent before placing non-essential cookies. Where required by law, we will request your consent before placing non-essential cookies or similar technologies on your device. You may withdraw or change your cookie preferences at any time through your browser settings or our cookie preference centre, where available.


12. Security Measures
We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access, alteration, or disclosure, including:
• Encryption of data in transit (HTTPS/TLS)
• Access controls limiting who within our organisation can view personal information
• Not storing full payment card details on our own systems
• Regular review of our security practices and those of our Operators

No method of transmitting or storing personal information electronically is completely secure. While Kini implements appropriate technical and organisational measures to protect personal information, we cannot guarantee absolute security.
If we become aware of a security compromise involving personal information that is likely to result in harm to a data subject, we will notify affected individuals and the Information Regulator as soon as reasonably practicable, in accordance with section 22 of the Protection of Personal Information Act (POPIA).

Where appropriate, our notification will include the nature of the security compromise, the categories of personal information affected, the steps Kini has taken to contain and investigate the incident, and any actions that affected individuals should take to protect themselves.

We continually review and improve our security controls, systems and processes to help protect the confidentiality, integrity and availability of the personal information entrusted to us.


13. Your Rights as a Data Subject
Subject to POPIA, you have the right to:
• Be notified that personal information about you is being collected
• Access the personal information we hold about you
• Request correction, updating or deletion of your personal informationObject to the processing of your personal information, on reasonable grounds
• Withdraw consent, where processing is based on consent (this will not affect processing carried out before you withdrew consent)
• Not be subject to a decision based solely on automated processing that affects you legally, without an opportunity to make representations
• Lodge a complaint with the Information Regulator

To exercise any of these rights, please contact our Information Officer using the contact details provided in this Policy.

To protect your privacy and the security of your personal information, we may request sufficient information to verify your identity before processing your request. Where permitted by law, we may decline or limit a request if we are unable to verify your identity or where an exemption under POPIA applies.

We will acknowledge receipt of your request and respond within a reasonable period in accordance with the Protection of Personal Information Act (POPIA). If we are unable to fulfil your request, we will explain the reasons and advise you of any further rights or remedies available to you.


14. Direct Marketing
We will only send you direct marketing communications (such as newsletters or product updates) if you have consented, or as otherwise permitted under section 69 of POPIA. You may opt out at any time by using the “unsubscribe” link in any marketing message or by contacting us directly.


14A. User-Requested Invitations
When you request Kini to send an invitation to another person, you confirm that you are authorised to provide their contact information for this purpose.


15. Children's Information
The Platform is not intended for use by children under the age of 18 without the involvement of a parent or guardian. Where a care recipient referenced within a pool is a minor, the Pool Organiser confirms they are authorised to act on behalf of, and provide information about, that minor. If you believe a child has provided us with personal information without appropriate consent, please contact us so we can remove it.


16. Automated Decision-Making
We do not currently use your personal information to make decisions about you based solely on automated processing that would significantly affect you.


16A. Third-Party Websites and Services
Kini may contain links to third-party websites or services. We are not responsible for their privacy practices or content, and encourage you to review their privacy policies before sharing any personal information.


17. Changes to this Policy
We may update this Policy from time to time to reflect changes to the Platform or applicable law. The “Last updated” date at the top of this Policy shows when it was last revised. Material changes will be communicated to you via the Platform or by email.


18. Complaints
If you believe we have not complied with POPIA in relation to your personal information, please first contact our Information Officer at enquiries@inforegulator.org.zaso we can try to resolve the matter. You may also lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa)

Website: https://www.inforegulator.org.za
POPIA Complaints Email: POPIAComplaints@inforegulator.org.za
General Enquiries: enquiries@inforegulator.org.za
Telephone: +27 (0)10 023 5200
Toll-Free: 0800 017 160
Physical Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191


19. Contact Us
For any questions about this Policy or how we handle your personal information, please contact:
Information Officer: Sisi Nxumalo
Email: information.officer@kini-app.co.za
Address: 13 Fredman Drive, Sandton, Gauteng, 2195