Privacy Policy

Last updated: [DATE — update this each time the policy changes]

This policy explains what personal information Khula Financial Services (Pty) Ltd ("Khula", "we", "us") collects when you apply for or hold a loan with us, why we collect it, and what rights you have over it under the Protection of Personal Information Act (POPIA). This is a working draft grounded in what our systems actually do — have it reviewed by an attorney before treating it as your final, legally binding policy, the same way every compliance document in this platform is flagged for review before real reliance.

Who we are

Khula Financial Services (Pty) Ltd operates a WhatsApp-native micro-lending service in South Africa. [Add company registration number and registered address here.]

What information we collect

When you apply for a loan — on WhatsApp, on our website, or with the help of one of our agents — we collect:

Category	What we collect
Identity	Full name, South African ID number, a copy of your ID document
Contact	Phone number (verified by a one-time code sent via WhatsApp)
Address	Proof of address document
Financial	Employment status, monthly income and expenses, existing debt, proof of income (payslip or bank statements)
Banking	Payout bank account details and proof of that account, used solely to pay out and collect loan repayments
Application record	Loan amount, term, the affordability and risk assessment we run, and — if you sign — your typed signature, the date, and the IP address the signature was made from

Why we collect it

To assess affordability before offering credit, as required by the National Credit Act.
To verify your identity and reduce fraud — including confirming you control the phone number you're applying with, and that any payout account is genuinely yours.
To meet our obligations as a registered credit provider, including record-keeping and reporting requirements.
To communicate with you about your application and, if you take out a loan, payment reminders and confirmations.

We do not use your information for marketing without separate, explicit consent, and we do not sell your information to third parties.

How your information is protected

Identity, address, income, and bank account documents you upload are encrypted before they're stored (AES-256-GCM) and only accessible to authorised Khula staff reviewing your application.
Every time a staff member views one of your documents, or makes a decision on your application, it's logged against their name and the time — an audit trail, not just a policy statement.
Your ID number is never displayed back to you or anyone else in full through our systems once submitted; your account number is shown only in masked form (e.g. ****1234).

Who we share information with

Who	Why
Meta (WhatsApp Business Platform)	To deliver messages to you — application updates, verification codes, payment reminders — over WhatsApp
Our payment collection provider (e.g. Netcash or Stitch)	To collect loan repayments via DebiCheck from the bank account you provide, if you take out a loan
Credit bureaus	To check your credit record as part of assessing your application, and to report your repayment history as required by law
The National Credit Regulator and other regulators	Where required by law

We don't share your information with anyone else without your consent, except where required by law or to prevent fraud.

How long we keep your information

[This needs a real retention schedule before publishing this policy in production — for example: application and loan records are typically kept for the period required by the National Credit Act and tax law after a loan is settled or an application is declined; documents for declined applications may be deleted after a shorter period. Confirm exact periods with your compliance officer and update this section accordingly — see docs/COMPLIANCE.md in the platform codebase for the open item this corresponds to.]

Your rights under POPIA

Access — you can ask what personal information we hold about you.
Correction — you can ask us to correct information that's wrong or out of date.
Deletion — you can ask us to delete information we're not legally required to keep.
Objection — you can object to certain uses of your information.
Complaints — you can lodge a complaint with the Information Regulator of South Africa if you believe we've mishandled your information.

To exercise any of these rights, contact us at [privacy contact email — add before publishing].

WhatsApp specifically

When you message Khula on WhatsApp, that conversation is also subject to WhatsApp's own privacy policy, since Meta processes the message on their platform to deliver it to us. We only use the WhatsApp Business Platform to run your loan conversation and send you updates about your own application — never for unsolicited marketing.

Contact us

Khula Financial Services (Pty) Ltd
[Registered address]
[Contact email]
[Contact phone / WhatsApp number]

Information Regulator of South Africa: inforegulator.org.za