Privacy notice

Last updated: [date of launch]. This notice explains what kwaVast does with the personal information you give us through this website, as the Protection of Personal Information Act (POPIA) asks.

Who is responsible

The responsible party is kwaVast, run by [Themba's full name], of [physical address]. Our information officer is [Themba's full name], reachable at [kwavast@gmail.com].

What we collect

• When you book: your name, email address and phone number, and the same for each person you book for; the answers you give on the booking form (your isiXhosa level, how you heard about us, a WhatsApp number, an emergency contact, and for yoga any health notes); your agreement to the policy and the indemnity; and whether you allow photos and video of you to be shared. Card details go straight to Paystack in its own payment window; we never see or store them.
• When you send a message, ask to pay less, or join the waiting list: your name, email address, phone number if you give it, what you are asking about or waiting for, and your message.
• When you make an account: your email address and the name you add; how you signed in (Google or a code by email). We never ask for or store a password.
• When you practise the free isiXhosa words while signed in: your progress.
• To stop spam, your internet address is kept for one hour, and only as a one-way hash that cannot be turned back into the address.

Health information

Health notes are special personal information under POPIA. We ask for them only for movement sessions such as yoga, only with your consent (you give it by filling them in), and use them only so the teacher can keep you safe. They are kept with your booking and nowhere else, and are never sent to Paystack or anyone else.

Why we collect it

To take and confirm your booking, send the meeting link for online sessions and reply to you; to keep you safe in class; to reply to a "pay what you can" request; to tell people on the waiting list when a place or a new offering opens. We do not sell your information or use it for anything else.

Is it voluntary

Yes. Without an email address or a phone number we cannot confirm a booking or reply to you, so those fields are required.

Who receives it

• Cloudflare (hosting, the booking store and the spam check), which may store data outside South Africa.
• [Resend], the email provider that delivers confirmations and replies.
• Paystack, for payments: the payer's email address, the amount and the names on the booking, nothing else from the booking form.
• Google, if you choose to sign in with Google, and Google, Meta and Microsoft for the statistics and adverts described under Cookies, only if you say yes to cookies.

These providers may process information outside South Africa. We use them because they protect personal information to a standard comparable to POPIA.

How long we keep it

Bookings and their answers: [two years after the session, or until you ask us to delete them]. Messages and requests: 12 months after our last reply. Waiting list: until you ask to be removed. Accounts: until you delete yours.

Your rights

You may ask to see the personal information we hold about you, ask us to correct or delete it, object to us processing it, and withdraw a consent at any time. Write to [kwavast@gmail.com]. If you are unhappy with how we handled your information, you may complain to the Information Regulator: see inforegulator.org.za.

How we count visits

This website keeps its own visit statistics: pages and sections viewed, buttons clicked, how far a page was read, how long it was open, the site or advert that linked here, the country and the kind of device, and the steps of a booking (an offering opened, the booking page opened, the pay button pressed, the share of the full price chosen). A random number in your browser tells visits apart. It is not linked to your name. It is replaced every 30 days, or kept for up to 13 months if you say yes to cookies, so we can see when people come back. Your IP address, name, email and anything you type are not stored. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded. Records are deleted after 400 days.

Cookies and the services that set them

When you first visit, a banner asks whether you allow cookies. Until you say yes, none of the services below load. If you say yes:

• Google Analytics and Google Ads count visits and tell us which adverts brought people here.
• Meta (Facebook and Instagram) tells us which of our adverts worked and lets us show adverts to people who visited.
• Microsoft Clarity shows us where people tap, scroll and get stuck, as heatmaps and as recordings of visits. Text you type into forms is hidden from it.

These services set cookies in your browser, receive your browser's details and internet address, and may combine this with what they already know about you under their own privacy policies. They process it outside South Africa. You can change your mind at any time with the "Cookie choices" link at the foot of every page; saying no after yes stops them from the next page you open.