This notice is issued in terms of the Protection of Personal Information Act 4 of 2013 (POPIA) and should be read with the privacy policy.
Roles
For staff accounts and billing, KhumoHub is the responsible party. For the customer records, sales and credit information captured inside a store, the store owner is the responsible party and KhumoHub acts as an operator processing that data only on the store's documented instructions.
Information officer
Information Officer, KhumoHub — privacy@khumohub.co.za. General enquiries: info@khumohub.com or 070 533 5451. The Information Officer is registered with the Information Regulator (South Africa) in terms of section 55 of POPIA, and a Deputy Information Officer is designated to handle requests in the officer's absence.
PAIA manual
Our manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 is available free of charge from privacy@khumohub.co.za. It sets out the records we hold, how to request access using Form 2, the applicable fees and the grounds on which a request may be refused. Access requests are decided within 30 days, extendable once by a further 30 days with written notice.
Lawful basis
- Performance of the contract between you and KhumoHub (operating your till and stock).
- Compliance with legal obligations (tax and financial record keeping).
- Legitimate interests (security, fraud prevention, service improvement).
- Consent, where you enable optional features such as marketing messages.
Operator safeguards
- Row-level security isolates every store's data from every other store.
- Role-based access with manager approval for overrides, voids and offline trading.
- Encryption in transit and at rest; audited transactional journal for every movement.
- Sub-operators are bound by written processing terms.
Cross-border transfers
Where data is processed outside South Africa by a hosting provider, the transfer is made under section 72 of POPIA on the basis of contractual safeguards providing an adequate level of protection.
Retention schedule
- Sales, tax and financial records — 5 years, as required by the Tax Administration Act.
- Staff account and access logs — 3 years after the account is closed.
- Customer credit records — 3 years after the account is settled and closed.
- Diagnostic and device logs — 12 months.
- Marketing consent records — for as long as the consent stands, plus 12 months after withdrawal as proof of the withdrawal.
When a period lapses the information is deleted or de-identified. Deleting a store account removes the operational data within 30 days, except records we must keep by law.
Direct marketing
In line with section 69 of POPIA we send electronic marketing only to customers who have opted in, or to our own customers about similar products where we obtained the contact details during a sale. Every message carries a free opt-out and we honour it immediately. Transactional messages such as receipts, order confirmations and security alerts are not marketing and continue while your account is active.
Children's information
KhumoHub is a business tool and is not offered to children. We do not knowingly process the personal information of a child under 18 without the consent of a competent person, and we delete any such information as soon as we become aware of it.
Automated decision-making
Suggested orders, credit-limit warnings and reorder points are decision support only. No decision with a legal or similarly significant effect on a person is made solely by automated means; a manager always reviews and approves.
Security compromise notification
If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the affected data subjects as soon as reasonably possible in terms of section 22, describing the compromise, the likely consequences and the steps we are taking.
Your rights as a data subject
- Access the personal information we hold about you (Form 2).
- Request correction or deletion of inaccurate or excessive information (Form 2).
- Object to processing based on legitimate interests or direct marketing (Form 1).
- Withdraw consent at any time, without affecting processing already carried out.
- Request the identity of third parties who have had access to your information.
- Complain to the Information Regulator: complaints.IR@inforegulator.org.za.
Send requests to privacy@khumohub.co.za. We acknowledge within 5 business days and answer within 30 days. Requests are free; a prescribed PAIA fee may apply to bulk record copies. Use the account deletion page for deletion requests.