Privacy Notice
IRIS Lab Public Voting Campaign, in collaboration with BSG & Technologies. This notice explains what personal information the campaign collects, why, how long it is kept, and your rights under South Africa's Protection of Personal Information Act (POPIA).
What we collect
When you dial in via USSD or register on this website, we collect your mobile number, name, and province. If you vote for a school, we record which school and when. If you bulk-vote (donate), we record the amount, payment reference, and payment status from our payment processor, PayFast. We also keep technical logs of your USSD session and website requests (timestamps, IP address, mobile network) for fraud prevention and support.
Why we process it
Recording your vote, processing your bulk vote, and keeping a tamper-evident log of these transactions is necessary to run the campaign and is processed under contract / legitimate interest — this does not depend on the marketing question below. Separately, we ask a one-time question about receiving marketing communications from BSG & Technologies; that is processed only on the basis of the consent you give (or withhold), and either answer lets you continue voting as normal.
How long we keep it
- Voter information (name, province, mobile number) is anonymized 12 months after the campaign's closing date — your mobile number is replaced with an irreversible cryptographic hash, and your name and province are cleared. Vote counts and school standings remain accurate after this happens.
- Bulk-vote payment records are kept for 5 years, in line with South African tax and financial record-keeping requirements, before being deleted.
- Our compliance audit log (which records actions like votes cast and payments processed, for fraud/dispute investigation) is retained for longer and is not anonymized, because it is cryptographically chained to detect tampering — redacting any entry would break that guarantee for every entry after it. This is a deliberate, narrow exception to the retention period above.
Your rights
Under POPIA, you may ask us what personal information we hold about you, ask us to correct it, or ask us to erase it ahead of the schedule above. To make a request, contact us at [support contact — pending]. Note that we cannot erase bulk-vote payment records that South African law requires us to keep for tax/audit purposes.
How we protect it
Access to voter and bulk-vote data is restricted to authorised staff via a password-protected admin dashboard (with optional two-factor authentication), every administrative action is logged, and data in transit is encrypted (TLS).
Information Officer
[Name, designation and contact details — pending.]
Complaints
If you believe your information has been mishandled, you may lodge a complaint with South Africa's Information Regulator (please verify current contact details before publishing this notice, as they are set independently of this campaign).