Umgaqo-nkqubo Wabucala

1. Introduction

Bambanani is a school safety reporting platform operated by Bambanani ("we", "us", "our"), a South African organisation. We are committed to protecting your privacy and handling your personal information responsibly in accordance with the Protection of Personal Information Act (POPIA) of South Africa.

This policy explains what information we collect, how we use it, and your rights regarding your data.

2. Information We Collect

When you make a report (anonymous)

• School selection
• Report category and description
• Optional: location and date of incident
• Optional: contact information (only if you choose to provide it)
• A hashed version of your IP address (we cannot see your actual IP address)

Your report is anonymous by default. We do not require your name, email, or any identifying information. Your IP address is converted into an irreversible code (hash) before storage — we cannot trace it back to you.

When you track a report

• Your tracking code (entered by you)

Staff accounts (school administrators and teachers)

• Full name and email address
• Password (stored securely using industry-standard encryption)
• School association and role

3. How We Use Your Information

• Reports: Shared only with authorised staff at the selected school for investigation and resolution
• IP hashes: Used solely to prevent spam and abuse (rate limiting)
• Staff accounts: Used for authentication, report management, and email notifications
• Email addresses: Used to send report notifications and password reset links via SendGrid

We do not sell, share, or transfer your personal information to third parties for marketing purposes.

Third-party service providers (data processors):

• SendGrid (Twilio Inc.): Processes email notifications on our behalf. Email addresses and notification content are transmitted to SendGrid's servers for delivery.
• Google Analytics (Google LLC): Processes anonymous usage data to help us understand how the platform is used. No personal information is shared with Google.
• Xneelo (Pty) Ltd: Hosts our servers and database in South Africa.

4. Data Storage & Security

• All data is stored on secure servers hosted by Xneelo in South Africa
• Passwords are encrypted using bcrypt (industry standard)
• All connections are encrypted using HTTPS/TLS
• Access to reports is restricted by role-based permissions
• Session cookies are configured with Secure, HttpOnly, and SameSite flags
• Password reset tokens are cryptographically generated, hashed before storage, and expire after 1 hour

5. Your Rights Under POPIA

As a South African data subject, you have the right to:

• Access: Request a copy of any personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information (where legally permissible)
• Object: Object to the processing of your personal information
• Complaint: Lodge a complaint with the Information Regulator of South Africa

For anonymous reports, we cannot identify the reporter, which means we cannot fulfil access or deletion requests — this is by design to protect your anonymity.

6. Cookies & Analytics

We use the following cookies and tracking technologies:

Google Analytics data is anonymised and does not contain any personal information. You can opt out by using a browser extension or disabling JavaScript.

7. Data Retention

• Reports: Retained for up to 3 years from resolution (or, if a report is never formally resolved, up to 3 years from submission), then permanently deleted. Reports under active investigation may be held longer while that investigation continues.
• Staff accounts: Retained while active; deactivated accounts deleted after 1 year
• Email logs: Retained for 1 year for troubleshooting, then deleted
• Access logs: A record of which staff account viewed which report, and when, is kept for as long as the related report exists, then deleted with it. This exists to detect and investigate misuse of the platform.
• Login attempts: Automatically deleted after 1 hour
• Password reset tokens: Expire after 1 hour; deleted within 24 hours

8. Children's Privacy

Bambanani is designed to be used by school students, including children under the age of 18. We take special care to protect the privacy of young users:

• No personal information is required to make a report
• We do not knowingly collect identifying information from children
• Reports are handled confidentially by authorised school staff only
• We do not use personal information for profiling or targeted advertising

Mandatory reporting: if a report describes a child being abused, neglected, or in serious danger, South African law (Children's Act, Section 110) requires school staff who read it to report it further to the proper authorities — even though the report itself stays anonymous. Anonymity protects the reporter's identity; it does not stop the school from having to act to protect a child.

If you are a parent or guardian and believe your child's personal information has been collected inappropriately, please contact us immediately.

9. Contact Us

For any privacy-related questions, or to request access, correction, or deletion of personal information we hold about you under POPIA, please contact:

You may also contact the Information Regulator of South Africa at www.justice.gov.za/inforeg, or read our PAIA Manual for how to request access to records under the Promotion of Access to Information Act.