Privacy Policy

1. Introduction

Zeturi Platform (Pty) Ltd (“Zeturi”, “we”, “us”, “our”) is committed to protecting personal information. This policy explains what we collect, why we use it, who may receive it, how long we keep it and the choices available to you when you use the Zeturi Platform, our public website or our free tools (together, the “Service”). We process personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African law.

2. POPIA Roles and Responsibility

For personal information that a scheme enters and manages for its members, dependants and beneficiaries, the scheme is generally the Responsible Party and Zeturi acts as its Operator. We process that information to provide the Service, secure it, support authorised users and carry out the scheme’s documented instructions.

Zeturi is the Responsible Party when we decide why and how to process information for account administration, subscriptions and billing, enquiries and support, platform security, fraud prevention, service analytics, legal compliance and product improvement. The applicable role depends on the purpose of the processing, not merely where the information is stored.

3. Information We Collect

Personal and Member Information

• Names, contact details, identity numbers (where required by scheme rules or law)
• Dates of birth, addresses, account credentials, authentication details and member identifiers
• Bank details for contributions and distributions (if captured by the scheme)
• Dependants’ and beneficiaries’ details for burial-society membership and claims
• Enquiries, support requests, feedback and communication preferences

Financial and Scheme Records

• Contributions, distributions, loans and repayments
• Unit holdings, valuations and statements
• Claims and supporting documents
• Governance proposals, voting activity and audit logs
• Plan, subscription, invoice and optional payment-integration records
• Information entered into free tools, including constitution-generator answers and the email address used to deliver a document

Technical Data

• IP address, device and browser information
• Sign-in, security, notification-delivery, usage, session and event logs
• Cookies or similar technologies (see Cookies and Analytics)

4. How We Use Information

• Provide, secure and maintain the Service
• Record contributions, distributions, claims and statements on a scheme’s instructions
• Operate governance, audit trails and notifications
• Administer trials, subscriptions, invoices, support and requested communications
• Comply with legal and regulatory requirements
• Prevent fraud and misuse; investigate incidents
• Measure and improve functionality and user experience where consent is required and obtained
• Create aggregated or de-identified insights that do not identify a person or scheme

5. Justification Grounds for Processing

We process personal information on one or more of these POPIA grounds:

• Consent for a specified purpose, including non-essential analytics where applicable
• Contractual necessity to provide the Service or take requested steps before entering a contract
• Legal obligations, including applicable tax, accounting and FICA duties
• Legitimate interests of the scheme, Zeturi or a third party, where those interests do not unjustifiably interfere with the data subject’s privacy
• Protection of a legitimate interest of the data subject

6. Sharing and Operators

Within Your Scheme

Visibility is controlled by scheme roles. Members may see their own records and scheme-level views configured by administrators. Administrators and treasurers may access additional information necessary to manage the scheme. A scheme is responsible for assigning appropriate roles and responding to its members’ requests about scheme-controlled information.

Operators (Service Providers)

We use service providers only where needed to operate the Service. These currently include Supabase and Vercel for hosting and databases; Upstash for rate limiting and caching; Resend for email; Bird for SMS; Sentry for error diagnostics; PostHog, Google Analytics and Vercel Analytics for consent-gated analytics; and Paystack for Zeturi subscriptions and expressly optional payment integrations. A provider receives only the information needed for its role and is subject to contractual and security requirements appropriate to the processing.

PostHog and Sentry session replay run only after analytics consent. Our configuration masks text and inputs, blocks media, and excludes network request and response bodies. Error and security monitoring may operate without analytics consent where necessary to secure and maintain the Service, with personal-information capture disabled or scrubbed.

Legal and Compliance

We may disclose information where required by law, regulation, court order or lawful request by a competent authority.

7. Security and Incidents

• Encryption in transit (TLS) and at rest for sensitive data
• Role-based access controls and row-level policies
• Multi-factor authentication for privileged access
• Activity logs and monitoring
• Regular security reviews and vendor assessments

If a compromise affects information for which a scheme is the Responsible Party, Zeturi will notify the scheme as soon as reasonably possible after discovery so that the scheme can meet its duties to the Information Regulator and affected data subjects. If Zeturi is the Responsible Party, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful delay requested by an investigating authority.

8. Cross-border Transfers

Personal information may be processed in South Africa or other countries where we or our operators maintain facilities, including where our cloud, communications, analytics and support providers operate. We transfer information outside South Africa only where a ground permitted by POPIA section 72 applies, such as adequate protection under law or contract, contractual necessity, or the data subject’s consent. We assess providers and apply contractual safeguards appropriate to the information and destination.

9. Retention and Deletion

We keep personal information only while it is needed for the purpose collected, to operate and secure the Service, to resolve disputes, or to meet a specific legal obligation. Retention depends on the record rather than one period for the entire account.

• Account and support information: while the account is active and for a limited period afterwards where needed for security, disputes or legal compliance
• Financial, governance, accounting and tax records: for the period required by applicable law or the scheme’s lawful record-keeping duties, which may be up to 7 years
• FICA records: where FICA actually applies, for the applicable statutory period
• Analytics information: according to the configured retention period of the relevant consent-gated provider
• Security, audit and delivery logs: according to their operational or legally required retention schedule

An account-deletion request removes access and triggers deletion, anonymisation or restriction of personal information where legally permissible. It does not erase append-only financial or governance history that a scheme or Zeturi must lawfully preserve. Backups and security logs are isolated from ordinary use and expire under their applicable operational schedules.

10. Your POPIA and PAIA Rights

You may exercise these rights, subject to lawful limitations:

• Access to your personal information
• Correction or updating of inaccurate information
• Deletion where legally permissible
• Objection to processing on grounds recognised by POPIA
• Export of available account and scheme information in a commonly usable format
• Withdraw consent for consent-based processing

Submit requests to privacy@zeturi.com. Requests may require identity verification. A PAIA request may require the prescribed Form 2 and a fee where the law permits it.

11. Cookies and Analytics

We use necessary cookies and similar storage to operate and secure the Service. Google Analytics, PostHog, Vercel Analytics, Vercel Speed Insights and session replay are disabled until you consent to analytics. Withdrawing consent stops future optional collection but does not automatically delete information already retained by a provider under its applicable retention schedule. See our Cookies Policy for full details.

12. Children and Special Personal Information

Children may not open or administer a Zeturi account. A scheme may record a child as a dependant or beneficiary only through an authorised adult and where the scheme has the consent of a competent person or another authorisation permitted by POPIA. Health, disability, identity and death-related records may be special personal information. The scheme must establish and document the applicable POPIA authorisation before collecting it; Zeturi processes it only to provide the scheme-controlled Service.

13. Changes to this Policy

We may update this policy from time to time. Material changes will be notified by email or through the Service. Where consent or another action is required, we will request it before the relevant new processing begins. The “Last updated” date reflects the effective date of the current version.

14. Information Officer and Complaints

Contact our Information Officer for questions or to exercise your rights:

• Email: privacy@zeturi.com

If you are not satisfied with our response, you may complain to the Information Regulator (South Africa):