Privacy Policy

Responsible Party and Information Officer

The Responsible Party for this platform is Kinship Ministries (NPC) trading as King & Co (CIPC registration 2019/343464/08) ("we", "us") — King & Co is a ministry of that NPC, not a separate company. The Information Officer is Gary Smythe, contactable at privacy@kingandco.org.za.

If the legal structure later changes (for example a dedicated King & Co company), this policy and the Responsible Party disclosure will be updated.

Responsible Party Model — Platform and Churches

Processing on this platform is split by purpose. Kinship Ministries (NPC) trading as King & Co is the Responsible Party for platform-level processing: accounts, donations, platform operations, and public-facing services.

Each church or standalone ministry that uses the administration tools (listing vetting, member communications, and similar) is the Responsible Party for their own administrative processing. In that context, King & Co acts as an Operator — processing personal information on behalf of the church or ministry, under their instruction. A formal data processing agreement between the platform and each church is planned for a later phase.

Special Personal Information

POPIA classifies certain categories of information as special personal information and requires a higher level of care. This platform processes the following special personal information where you or your church administrator provide it:

• Church fellowship attestation — confirmation that you are a member or leader of a specific fellowship.
• Denomination — the denominational tradition of your church or ministry.
• Christian affiliation — contextual information indicating affiliation with the Christian faith, provided through profile details, event participation, or directory listings.

This information is used only to enable platform features (directory listings, vetting, event categorisation) and is not sold or shared with third parties for marketing purposes.

Authentication

When you create an account or sign in, we collect your email address, display name, and a securely hashed password. We issue JSON Web Tokens (JWT) for session management. On the mobile app, tokens may be stored in the device's secure storage provided by the operating system. Client tokens are retained until logout or expiry. We do not sell your account details. You can update your profile in Account settings. To close your account, submit an Account deletion request from Account settings.

Events

When you browse, save, or subscribe to events, we process event details you view or save (titles, dates, locations, categories, and organiser information), your saved-event preferences, and geographical filters you apply for discovery. Organisation administrators who publish events provide content that is displayed publicly according to each event's visibility settings. When churches or ministries publish and manage events, they do so as the Responsible Party for that processing; King & Co acts as Operator.

Donations and Paystack

Donations are voluntary gifts that support the running costs of the platform. They are not payment for features or entitlements, and they are never routed to a church or linked to your member record.

Donations are processed through Paystack, our payment processor. Paystack acts as an Operator for donation processing and handles your payment card details directly; King & Co does not store card details on our servers. We retain donation payment refs for accounting purposes for 5 years. During a donation checkout session, handoff data is stored in sessionStorage for the duration of the checkout tab and cleared when the tab is closed.

Notifications

With your consent, we send transactional notifications about events and account activity through email and push notifications on mobile devices and other channels you enable in your notification preferences. Push delivery uses device tokens registered to your account; you can disable push in app settings or at the OS level. Notification preferences are stored so we respect your channel and topic choices.

When you add an event to your calendar, the native app may request calendar access only when you choose Default calendar. Choosing Google Calendar opens Google's site and is subject to Google's terms.

WhatsApp

When Platform WhatsApp is enabled for your organisation or individual account, King & Co may send transactional WhatsApp messages (e.g. event reminders or vetting outcomes) through our Platform WhatsApp bridge. Messages are sent from the King & Co Platform WhatsApp account, not from your personal WhatsApp. We process your phone number and message delivery status only as needed to deliver these notifications.

Operators and Third-Party Services

We use the following operators and service providers who may process your personal information on our behalf:

• Google — authentication (Sign in with Google), calendar integration, and mobile app push notifications.
• Meta Facebook Login — authentication (social sign-in via Facebook Login).
• Paystack — payment processing for donations.
• WhatsApp — WhatsApp transactional messaging via the WhatsApp Platform.
• PostHog Cloud — product analytics Operator after Analytics consent.
• Xneelo — hosting, platform infrastructure, and email delivery.

Each operator is engaged under appropriate data processing terms.

Product analytics

With your Analytics consent, we use PostHog Cloud as an Operator to measure unique visitors, path interest, and member conversion. Analytics scripts and visitor identifiers load only after you opt in. You may withdraw Analytics storage on the Cookie Policy without clearing all site data.

Cross-Border Transfers

Some of our operators — including Google, Paystack, Meta/WhatsApp, and PostHog Cloud — may process your personal information on servers located outside South Africa (PostHog Cloud hosts analytics in Frankfurt). Hosting and email via Xneelo are provided in South Africa. We do not promise SA-only processing for every operator. Where cross-border transfers occur, we take steps to ensure appropriate safeguards are in place in accordance with POPIA Section 72. By using this platform, you acknowledge that your information may be transferred to and processed in other countries.

Data Retention

We retain personal information only as long as necessary for the purpose it was collected, or as required by law. Our retention schedules are:

• Account and general data: after you confirm an Account deletion request in Account settings, a 30-day clock starts. Your account remains usable and you may cancel in-app during that period. Operations may place a Deletion hold or cancel the request where legal or operational holds apply. When the clock completes, a Retention purge executes the POPIA Retention schedule and hard-deletes your account data from the live platform.
• Donation payment refs: 5 years from the date of the donation payment.
• Vetting and security logs: 90 days, unless there is an active dispute or legal proceeding.
• Client tokens (JWT / session tokens): retained until logout or expiry, whichever occurs first.
• Checkout sessionStorage: retained for the duration of the checkout tab and cleared when the tab is closed.
• UI preferences: retained until cleared by you in your browser or app settings.

Backup retention is separate from the POPIA Retention schedule and Retention purge. After a Retention purge, deleted Member data may remain in those backup files until Backup retention ends.

Your Rights and Data Subject Requests

Under POPIA, you have the right to request access to, correction of, deletion of, or objection to the processing of your personal information. For account closure, submit an Account deletion request from Account settings (see Data Retention above for the 30-day clock and Deletion hold, or our Data deletion instructions). For access, correction, or objection, contact our Information Officer, Gary Smythe, at privacy@kingandco.org.za. We will respond to verified requests within the timeframes required by POPIA.

If your request relates to processing performed by a church or ministry (as Responsible Party), we may direct your request to that organisation.

Cookies and Storage

We use client-side storage to operate the platform. For full details on what we store and why, see our Cookie Policy.