Privacy Policy

This Privacy Policy explains how [Konviva’s registered legal entity name — e.g. Ludere Group (Pty) Ltd, trading as Konviva — confirm] (“Konviva”, “we”, “us”) collects, uses, shares, and protects personal information when you use konviva.africa, the Konviva mobile apps, or interact with us as an Attendee, Host, or Vendor, including by WhatsApp. We are the responsible party for this processing under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Our registered address is [registered physical/postal address — confirm], and our Information Officer can be reached at [Information Officer name and email — confirm; this person must also be registered with the Information Regulator].

We collect the following categories of personal information, depending on how you use the Platform:

Passwords are handled by our authentication provider and are never visible to us in plain text. Card and bank login details are entered directly on our payment processor’s own secure page and never touch our servers.

We process personal information to:

• create and manage your account, and deliver Tickets you buy (performance of a contract with you);
• process payments and payouts, prevent fraud, and keep financial records (performance of a contract, and our legal obligations under tax and financial-record-keeping law);
• operate the door check-in system and enforce a single-use-per-ticket policy (performance of a contract, and our legitimate interest in preventing fraud);
• respond to support requests and resolve disputes between Attendees and Hosts (performance of a contract, and our legitimate interest in running a trustworthy platform);
• send you Ticket confirmations, receipts, and essential service updates (performance of a contract);
• answer questions you send our WhatsApp number, and hand them to our support team when the automated assistant can’t help (our legitimate interest in answering you quickly, and performance of a contract where you hold a Ticket);
• send you event updates and reminders on WhatsApp, where you have opted in (your consent, which you can withdraw at any time by replying STOP);
• send you marketing or event recommendations, where you have opted in (your consent, which you can withdraw at any time); and
• understand how the Platform is used so we can improve it (our legitimate interest, balanced against your privacy).

Our WhatsApp assistant uses AI. When you message the Konviva WhatsApp number, an automated assistant answers from information published by Konviva and by the Event’s Host. It uses an AI model provided by DeepSeek. We send DeepSeek the text of your message together with that published information. We do not send it your phone number, your name or your account details. The assistant does not make decisions about you: it cannot change a booking, take a payment, or approve a refund or transfer, and it passes anything it can’t answer to a person on our team. Please don’t send ID numbers, banking details or passwords by WhatsApp.

We use strictly necessary cookies to keep you signed in and to remember your session. We do not currently use analytics or advertising cookies. If we add them in future, we will update this policy and ask for your consent where the law requires it.

We share personal information only where necessary, with the following categories of operators, each bound by a contract requiring them to protect it and use it only for the purpose we specify:

• Supabase — our database, authentication, and file storage provider;
• Payment processors (currently [confirm active provider(s) — e.g. Ozow and/or Paystack]) — to process your payment and, for a Host, your payout;
• Resend — to deliver transactional emails such as ticket confirmations, receipts and event reminders, and to forward WhatsApp support requests to our team;
• Netlify — to host the Platform and run its server code;
• Meta Platforms (the WhatsApp Business Platform) — to carry WhatsApp messages between you and Konviva. WhatsApp’s own terms and privacy policy also apply to your use of WhatsApp;
• DeepSeek — the AI model behind our WhatsApp assistant, which receives the text of your WhatsApp questions as described in section 3; and
• a Host, but only the ticket-holder details needed for their own Event’s check-in and attendee list — a Host never sees another Host’s attendees.

We do not sell your personal information. We may disclose it where required by law, to enforce our Terms, or to protect the rights, safety, or property of Konviva, our users, or the public.

Some of our operators (listed above) process data on servers outside South Africa:

• Supabase — our database, in the European Union (Ireland);
• Netlify — our hosting and server code, in the United States;
• Resend — email delivery, in the United States;
• Meta — WhatsApp messages, in the United States and other countries;
• DeepSeek — the text of WhatsApp questions, in the People’s Republic of China.

Where that happens, we require the operator to protect your information to a standard that is at least equivalent to POPIA’s, whether through contractual safeguards or the operator’s own certifications. [Confirm and document the section 72 justification for each transfer, in particular DeepSeek in China, and check DeepSeek’s current API terms on how long it keeps inputs and whether it uses them to train models].

We restrict access to personal information using role-based, deny-by-default database rules, so a user can only see their own data (or, for a Host, the attendee data for their own Events). Ticket QR codes carry a signed, random reference rather than personal data. We keep security under ongoing review, but no system is completely secure, and we cannot guarantee absolute security of information transmitted over the internet.

We keep personal information only as long as we need it for the purpose it was collected, or as required by law. As a starting point:

• financial and payment records are kept for 5 years, in line with South African financial record-keeping requirements;
• check-in records are kept for 12 months after the Event, then the attendee’s name and email are removed from them;
• WhatsApp message records, assistant answers and support hand-off requests are kept for 12 months;
• a WhatsApp opt-in is kept while you are opted in. If you reply STOP, we stop messaging you straight away and keep a record of the opt-out, so we don’t message you again by mistake;
• if you delete your account, your profile is deleted, but order and ticket records tied to a completed purchase are retained for financial record-keeping and may be anonymised rather than deleted outright.

[These are proposed defaults — confirm final retention periods with whoever is accountable for POPIA compliance before this goes live, and build the account-deletion flow to match].

Under POPIA, you have the right to:

• ask us to confirm what personal information we hold about you, and access a copy of it;
• ask us to correct or update information that is inaccurate, incomplete, or outdated;
• ask us to delete or de-identify information we no longer have a lawful basis to keep;
• object to our processing of your information on reasonable grounds, including for direct marketing at any time; and
• withdraw consent you previously gave, where our processing relies on your consent. For WhatsApp updates, reply STOP to the Konviva WhatsApp number at any time; for email reminders, use the unsubscribe link in the email.

To exercise any of these rights, contact us at hello@konviva.africa. We will respond within a reasonable time and may need to verify your identity first.

If you are unhappy with how we have handled your information, you can also lodge a complaint with South Africa’s Information Regulator: complaints.IR@justice.gov.za / enquiries@inforegulator.org.za.

The Platform is intended for use by people 18 and older. Where a Ticket is bought for a minor, only the purchasing adult’s account information is processed by us — a minor’s information is collected only to the extent a Host’s Event genuinely requires it (for example, an attendee’s first name for a door list), and with the consent of their parent or guardian.

We may update this Privacy Policy from time to time. Where a change is material, we will give reasonable notice (for example, by email or an in-app notice) before it takes effect.

Questions or requests about this policy can be sent to our Information Officer at [Information Officer email — confirm], or to hello@konviva.africa.