1. Introduction

Welcome to WeSay (Pty) Ltd ("we", "our", or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp-first civic voting platform.

By using WeSay, you agree to the collection and use of information in accordance with this policy. We comply with the Protection of Personal Information Act (POPIA) and other applicable South African data protection laws.

2. Information We Collect

2.1 Personal Information We Collect

• Cellphone Number: Required for verification and deduplication. Stored in encrypted format.
• Name: Optional. Stored in encrypted format if provided.
• Province: Optional. Used for geographic analysis of voting patterns.
• Language Preference: To provide content in your preferred language.
• Vote Data: Your voting choices on petitions, timestamps, and vote source (WhatsApp, Web, or USSD).
• IP Address: Collected for security and fraud prevention purposes.

2.2 Information We Do NOT Collect

• ID numbers or passport numbers
• Email addresses
• Financial information
• WhatsApp messages or conversation history
• Contacts from your phone
• Location data beyond province selection

3. How We Use Your Information

We use the collected information for the following purposes:

• Verification: To verify your identity and prevent duplicate votes
• Platform Operation: To enable you to participate in civic voting and petitions
• Communication: To send voting confirmations and important platform updates via WhatsApp or SMS
• Analytics: To understand voting patterns, participation rates, and geographic distribution (in aggregate, anonymized form)
• Security: To detect and prevent fraud, abuse, and security threats
• Compliance: To comply with legal obligations and respond to lawful requests from authorities
• Service Improvement: To improve and optimize our platform and user experience

4. Data Security

We implement industry-standard security measures to protect your personal information:

• Encryption: All personal data (cellphone numbers and names) is encrypted at rest using strong encryption algorithms
• Secure Transmission: All data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Access Controls: Strict access controls limit who can view personal information to authorized personnel only
• Regular Audits: We conduct regular security audits and vulnerability assessments
• Secure Infrastructure: Our platform is hosted on secure, enterprise-grade infrastructure

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party service providers who assist in operating our platform (e.g., hosting, WhatsApp Business API). These providers are contractually obligated to protect your information and use it only for specified purposes.
• Legal Requirements: When required by law, court order, or government regulation
• Protection of Rights: To protect our rights, property, or safety, or that of our users or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notification to affected users)
• Aggregate Data: We may share anonymized, aggregated voting statistics that do not identify individual users

6. Your Rights Under POPIA

Under the Protection of Personal Information Act (POPIA), you have the following rights:

• Right to Access: Request confirmation of whether we hold your personal information and access to that information
• Right to Correction: Request correction of inaccurate or incomplete personal information
• Right to Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Right to Object: Object to the processing of your personal information in certain circumstances
• Right to Data Portability: Request your personal information in a structured, commonly used format
• Right to Lodge a Complaint: Lodge a complaint with the Information Regulator if you believe your privacy rights have been violated

To exercise any of these rights, please contact us at privacy@wesay.co.za.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Voting records are retained permanently for transparency and audit purposes, but personal identifiers remain encrypted. You may request deletion of your account and personal information at any time, subject to our legal obligations to retain certain records.

8. WhatsApp Integration

Our platform integrates with WhatsApp Business API. When you interact with us via WhatsApp:

• Your cellphone number is automatically verified through WhatsApp
• We send voting confirmations and updates via WhatsApp messages
• We do not access your WhatsApp conversations or contacts
• Your use of WhatsApp is also subject to WhatsApp's own Terms of Service and Privacy Policy

9. Children's Privacy

WeSay is intended for use by individuals 18 years of age and older. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected personal information from someone under 18, we will take steps to delete that information promptly.

10. International Data Transfers

Your information is primarily stored and processed in South Africa. If we transfer data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with POPIA requirements.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of WeSay after any changes indicates your acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

13. Information Regulator Contact

If you have concerns about how we handle your personal information, you may lodge a complaint with the South African Information Regulator: