1. Introduction

Smart Communities Foundation NPC (“Smart Communities“, “we“, “our” or “us“) is committed to protecting the privacy, confidentiality and security of personal information entrusted to us.

We recognise the importance of safeguarding personal information and undertake to process such information in accordance with:

• the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) (“POPIA”);
• the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) (“PAIA”);
• any other applicable South African legislation governing the protection of personal information; and
• where applicable, internationally recognised information security practices.

This Privacy Policy explains how personal information is collected, used, stored, disclosed and protected when individuals access or use the Smart Communities platform, websites and mobile applications.

2. About Smart Communities

The Smart Communities platform is a secure digital platform that enables Community Based Organisations (“CBOs”), Homeowners’ Associations, Resident Associations, Community Improvement Districts, Non-Profit Organisations and similar community organisations to engage with residents, businesses and other stakeholders.

The software platform is developed and maintained using the Konektd technology platform.

For the purposes of the services provided through individual Virtual Private Communities:

• each participating Community Based Organisation acts as the Responsible Party under POPIA in respect of the personal information of residents and users within its community;
• Smart Communities Foundation acts as the technology service provider and processes personal information on behalf of the relevant Community Based Organisation in accordance with POPIA and applicable contractual agreements.

Nothing contained in this Privacy Policy transfers ownership of personal information from the relevant Community Based Organisation or the individual data subject.

3. Scope

This Privacy Policy applies to:

• the Smart Communities website;
• the Smart Communities mobile applications;
• Virtual Private Communities;
• Crowdfunding/ donations services;
• community communications;
• surveys;
• incident reporting;
• local business directories;
• payment services;
• all other services operated by Smart Communities Foundation.

This Privacy Policy does not apply to third-party websites, services or applications that may be linked from our platform.

Each third party maintains its own privacy policy and users should review those policies before providing personal information.

4. Definitions

For purposes of this Privacy Policy:

“Aggregated and De-identified Data” means information derived from Community Data that has been processed so that it no longer identifies, and cannot reasonably be used to identify, an individual Data Subject, or household, whether through aggregation, anonymisation, de-identification or other recognised privacy-preserving techniques.

“Community Based Organisation” (CBO) means any homeowners association, residents association, community improvement district, neighbourhood association, non-profit organisation, municipality or other organisation operating a Virtual Private Community on the Smart Communities platform.

“Operator” has the meaning assigned in POPIA.

“Personal Information” has the meaning assigned in section 1 of POPIA and includes any information relating to an identifiable natural person or identifiable juristic person where applicable.

“Processing” includes collection, receipt, recording, organisation, storage, updating, retrieval, consultation, use, dissemination, distribution, transmission, restriction, deletion and destruction of Personal Information.

“Responsible Party” means the person or organisation which determines the purpose and means of processing Personal Information.

“Services” means all Smart Communities products, applications, websites and services.

“User” means any resident, volunteer, donor, business, service provider, visitor or other individual using the Services.

“Virtual Private Community” means a secure online community operated by a Community Based Organisation using the Smart Communities platform.

5. Who Is Responsible For Your Personal Information?

Depending on the service being used, different organisations may have different responsibilities under POPIA.

5.2 Community Data

Where a User registers as a member of a Virtual Private Community:

• the relevant Community Based Organisation is the Responsible Party;
• Smart Communities Foundation acts as an Operator processing information on behalf of that Community Based Organisation.

The Community Based Organisation determines:

• what information is collected;
• why it is collected;
• who may access it
• how it is used within that community.

Smart Communities Foundation processes that information only to provide the agreed services.

5.2 Smart Communities Operational Data

Where Smart Communities Foundation collects information directly for its own operational purposes, including:

• website enquiries;
• partnership enquiries;
• supplier management;
• donations made directly to Smart Communities Foundation;
• employment applications;
• legal compliance;
• financial administration;

Smart Communities Foundation acts as the Responsible Party.

6. Information We Collect

Depending upon how you use the Services, we may collect:

Identity Information

• Full name
• Profile photograph
• Verification documents uploaded by users

Contact Information

• Mobile number
• Email address
• Residential address

Community Information

• Community membership
• Property information
• Resident status
• Community participation
• Survey responses

Incident Information

Users may submit:

• incident reports;
• crime reports;
• environmental reports;
• photographs;
• supporting documentation;
• vehicle registration numbers;

Users should avoid uploading unnecessary personal information relating to third parties unless authorised or legally entitled to do so.

Payment Information

Where payments are made through the platform:

• payment reference information;
• transaction history;
• billing information.

Smart Communities Foundation does not store payment card details.

Payment processing is performed by Netcash in accordance with its own privacy and security standards.

Device Information

We may automatically collect:

• IP address;
• browser type;
• operating system;
• device identifiers;
• application version;
• diagnostic information;
• security logs.

7. Lawful Basis For Processing Personal Information 

Smart Communities Foundation processes Personal Information only where there is a lawful basis to do so under POPIA.

Depending on the circumstances, Personal Information may be processed because:

7.1 Performance of a Contract

Processing is necessary to provide the Services requested by a User or Community Based Organisation, including:

• creating and managing user accounts;
• verifying user identity;
• managing Virtual Private Communities;
• facilitating communications;
• processing donations and payments;
• providing customer support; and
• maintaining platform security.

7.2 Consent

Certain processing activities require the User’s consent.

Examples include:

• enabling location services;
• accessing device contacts;
• receiving marketing communications;
• receiving push notifications;
• receiving in-app promotional messages;
• participating in optional surveys;
• allowing optional profile information to be displayed.

Users may withdraw consent at any time where processing is based solely on consent.

Withdrawal of consent will not affect processing that occurred before consent was withdrawn.

7.3 Legal Obligations

Personal Information may be processed where required to comply with applicable legislation, including:

• POPIA;
• PAIA;
• taxation legislation;
• anti-money laundering legislation where applicable;
• court orders;
• lawful requests from regulatory authorities.

7.4 Legitimate Interests

Where permitted by law, Personal Information may also be processed to protect the legitimate interests of:

• residents;
• Community Based Organisations;
• Smart Communities Foundation;
• donors;
• businesses;
• service providers; and
• the wider community.

Examples include:

• fraud prevention;
• platform security;
• abuse prevention;
• investigating complaints;
• preventing criminal activity;
• maintaining audit logs;
• improving platform performance.

8. Purposes For Which Personal Information Is Used 

Personal Information may be used for the following purposes:

• providing community management services;
• verifying users;
• facilitating communication between residents and Community Based Organisations;
• reporting incidents;
• managing community projects;
• administering volunteers;
• processing donations;
• processing payments;
• managing surveys;
• providing local business information;
• improving platform performance;
• complying with legal obligations;
• protecting platform security;
• resolving disputes;
• responding to customer enquiries.

Smart Communities Foundation will not use Personal Information for purposes incompatible with those described in this Privacy Policy unless required or permitted by law.

9. Community Access To Information

The Smart Communities platform has been designed to enable Community Based Organisations to manage their communities effectively.

Accordingly, authorised administrators of a Community Based Organisation may have access to Personal Information submitted by Users within that Community.

Depending on the permissions assigned by the Community Based Organisation, authorised administrators may be able to view:

• names;
• contact details;
• residential addresses;
• property information;
• incident reports;
• uploaded documents;
• uploaded photographs;
• identity documents;
• vehicle registration numbers;
• survey responses;
• donations where applicable;
• communication history;
• other information submitted by Users.

Community Based Organisations are independent Responsible Parties under POPIA and are responsible for ensuring that their own access, use, disclosure and retention of Personal Information complies with applicable law.

Smart Communities Foundation does not control how Community Based Organisations use Personal Information after it has been made available to them in accordance with the Services.

10. General Sensitive Information

Some Services may involve the processing of information that may be regarded as sensitive or special Personal Information.

Examples include:

• identity documents;
• criminal incident reports;
• crime-related photographs;
• emergency contact information;
• information relating to vulnerable persons where voluntarily provided.

Users should only upload information that is reasonably necessary for the purpose of using the Services.

Where Users upload Personal Information relating to another individual, the User warrants that they have the lawful authority or legal justification to do so.

11. Children’s Personal Information 

Smart Communities recognises that protecting children’s privacy is particularly important.

Certain Services may be used by persons under the age of eighteen.

Where children’s Personal Information is processed, Smart Communities Foundation and the relevant Community Based Organisation will take reasonable steps to protect that information and ensure that it is processed only for legitimate community purposes.

Children’s information will never be knowingly sold.

Parents or legal guardians who believe inaccurate information has been recorded about a child should contact the relevant Community Based Organisation or Smart Communities Foundation.

12. Location Information

Where Users grant permission through their device, Smart Communities may collect location information to:

• identify nearby incidents;
• identify nearby businesses;
• improve emergency response;
• provide geographically relevant notifications;
• improve mapping functionality;
• assist Community Based Organisations.

Users may disable location permissions through their device settings.

Some Services may not function correctly if location services are disabled.

13. Contact Information From Mobile Devices

Where Users grant permission, Smart Communities may access the contact information stored on a User’s device solely for purposes such as:

• inviting other users to join the platform;
• improving community engagement;
• facilitating referrals where requested by the User.

Access to contacts is optional.

Users may revoke this permission at any time through their device settings.

Smart Communities Foundation does not sell contact information obtained from a User’s device.

14. Marketing Communications 

Users may receive information relating to:

• community announcements;
• emergency notifications;
• platform updates;
• new services;
• local business promotions;
• community campaigns.

Marketing communications are delivered through:

• push notifications;
• in-application messages.

Users may opt out of marketing communications through the application settings.

Service-related notifications that are necessary for operation of the Services may continue to be sent even where marketing communications have been disabled.

15. International Transfers Of Personal Information Notification

The Smart Communities platform is hosted using Amazon Web Services infrastructure located in the Republic of Ireland.

Personal Information processed through the Services is therefore transferred outside the Republic of South Africa.

Smart Communities Foundation takes reasonable steps to ensure that Personal Information transferred internationally receives an appropriate level of protection consistent with POPIA.

At the date of this Privacy Policy:

• production systems are hosted within AWS Ireland;
• backups are stored within AWS Ireland;
• no direct Smart Communities production services are hosted in the United States of America, however 3rd party services may have services host in the United States of America and limited use is made of these services.

Where additional international service providers are engaged in future, Smart Communities Foundation will ensure that appropriate contractual or other lawful safeguards are implemented before Personal Information is transferred.

16. Third-Party Service Providers

Smart Communities Foundation uses carefully selected third-party service providers to operate the platform.

These currently include:

Service Provider	Purpose
Amazon Web Services	Cloud hosting, storage, infrastructure
Google Maps Platform	Address search, address validation and mapping
Netcash	Secure payment processing

Each third-party provider processes Personal Information only for the purposes necessary to provide the relevant service.

Smart Communities Foundation does not sell Personal Information to third parties.

Where anonymised or aggregated statistical information is shared, no individual User will be identifiable from that information alone.

17. General Sensitive Information

Smart Communities Foundation is committed to protecting Personal Information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

Reasonable technical and organisational safeguards have been implemented to protect Personal Information, including, where appropriate:

• Transport Layer Security (TLS) encryption for information transmitted over public networks;
• Advanced Encryption Standard (AES) encryption for Personal Information stored within our infrastructure;
• Identity and Access Management (IAM) controls limiting access to authorised personnel;
• Web Application Firewall (WAF) protection;
• system activity logging and monitoring;
• secure backup procedures;
• disaster recovery capabilities;
• role-based access controls;
• password authentication;
• secure cloud infrastructure hosted by Amazon Web Services.

No method of electronic transmission or electronic storage is completely secure.

Accordingly, while Smart Communities Foundation takes reasonable steps to protect Personal Information, no system can guarantee absolute security.

Users are responsible for:

• maintaining the confidentiality of their passwords;
• protecting access to their devices;
• promptly reporting suspected unauthorised access to their accounts.

18. Retention of Personal Information

Personal Information is retained only for as long as reasonably necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

The current retention schedule is as follows:

Information Category	Retention Period
User Accounts	1 year after account closure
Chat Messages	1 year
Audit Logs	3 months
System Backups	1 year
Financial Records	7 years
Deleted Account Records	3 years
Incident Reports	Indefinite
Uploaded Images	indefinite

Where Personal Information is no longer required, Smart Communities Foundation will take reasonable steps to securely delete, destroy, de-identify or anonymise the information unless retention is required by law.

19. Disclosure of Personal Information

Personal Information may be disclosed only where necessary to provide the Services or where disclosure is authorised or required by law.

Depending upon the circumstances, Personal Information may be disclosed to:

• the relevant Community Based Organisation;
• authorised administrators within the applicable Virtual Private Community;
• payment service providers;
• cloud hosting providers;
• mapping and address validation providers;
• professional advisers;
• auditors;
• law enforcement agencies;
• regulatory authorities;
• courts or tribunals;
• any other party where disclosure is authorised by the User or required by law.

Smart Communities Foundation will not sell Users’ Personal Information to third parties.

Anonymised or aggregated information that cannot reasonably identify an individual may be used for:

• statistical reporting;
• service improvement;
• community planning;
• academic research;
• product development.

20. Data Subject Rights 

Subject to POPIA and other applicable legislation, Users have the right to, free of charge,:

• request confirmation that Personal Information relating to them is being processed;
• request access to their Personal Information;
• request correction of inaccurate or incomplete Personal Information;
• request deletion of Personal Information where permitted by law;
• object to certain processing activities;
• withdraw consent where processing is based solely on consent;
• lodge a complaint with the Information Regulator.

Requests should be submitted in writing to the Smart Communities Information Officer at: privacy@smart-communities.org 

Smart Communities Foundation may request reasonable proof of identity before responding to any request.

Certain requests may need to be referred to the relevant Community Based Organisation where that organisation is the Responsible Party.

21. Data Breaches 

If Smart Communities Foundation becomes aware of a security compromise involving Personal Information under its control as an Operator, it will:

• investigate the incident promptly;
• take reasonable steps to contain the incident;
• notify the relevant Responsible Party without undue delay;
• cooperate with the Responsible Party in investigating the incident;
• assist the Responsible Party in meeting its notification obligations under POPIA where applicable.

Where Smart Communities Foundation is itself the Responsible Party for Personal Information, it will comply with the applicable notification requirements under POPIA.

Users who suspect a security incident should notify Smart Communities Foundation immediately.

Reports should include, where possible:

• contact details;
• description of the incident;
• date and time of discovery;
• affected information (if known);
• any supporting evidence.

22. Future Use of Artificial Intelligence 

At the date this Privacy Policy takes effect, Smart Communities Foundation does not use artificial intelligence systems to process residents’ Personal Information as part of the Services.

Should artificial intelligence technologies be introduced in future, Smart Communities Foundation will:

• update this Privacy Policy;
• assess the privacy implications of such processing;
• implement appropriate contractual and technical safeguards where third-party AI providers are used;
• provide additional notice where required by applicable law.

Artificial intelligence will not be introduced in a manner inconsistent with POPIA.

23. Third-Party Websites

The Services may contain links to websites, applications or services operated by third parties.

Smart Communities Foundation is not responsible for the privacy practices of third-party websites.

Users should review the privacy policies of those third parties before providing Personal Information.

24. Changes To This Privacy Policy

Smart Communities Foundation may amend this Privacy Policy from time to time to:

• reflect changes in legislation;
• improve clarity;
• reflect new Services;
• implement new technologies;
• improve privacy protections.

Where material changes are made, reasonable steps will be taken to notify Users through appropriate communication channels.

The most recent version of the Privacy Policy will always be published on the Smart Communities website and mobile application.

25. Complaints

Users who believe that their Personal Information has been processed unlawfully should first contact Smart Communities Foundation so that the matter can be investigated.

Where the complaint relates to processing undertaken by a Community Based Organisation acting as the Responsible Party, Smart Communities Foundation may refer the complaint to that organisation while assisting where appropriate.

If the matter cannot be resolved, Users may lodge a complaint with the South African Information Regulator.

26. Contact Details

Smart Communities Foundation

Email: legal@smart-communities.org 

Website:

• https://smart-communities.org
• https://smart-communities.app
• Information Officer: Smart Communities Foundation’s Information Officer is its Chief Executive Officer. Requests relating to Personal Information should be directed to: legal@smart-communities.org

 

• PAIA Manual: Smart Communities Foundation’s Manual, prepared in accordance with section 51 of PAIA, describes the categories of records held and the procedure for requesting access to them. The Manual is available at https://smart-communities.app/PAIA, and a copy is available for inspection at Smart Communities Foundation’s principal place of business during normal business hours.

Schedule A – Categories of Personal Information

The platform may process:

• Identity information
• Contact information
• Residential addresses
• Property information
• Vehicle registration information
• Identity documents
• Incident reports
• Community participation records
• Survey responses
• Payment references
• Donation information
• Device information
• Technical logs
• Location information (where permission has been granted)
• Communications submitted through the platform

Schedule B – Third-Party Service Providers

Service Provider	Purpose	Location
Amazon Web Services	Cloud hosting and storage	Ireland
Google Maps Platform	Address lookup and mapping	Global services
Netcash	Payment processing	South Africa