1. Introduction
AARIVA (Pty) Ltd, trading as Kaya(“we”, “us”, or “our”), is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) of the Republic of South Africa. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and what rights you have.
By using the Kaya platform — accessible at homeassist.everythings.tech — you acknowledge that you have read and understood this policy.
2. Personal Information We Collect
We collect only the personal information necessary to operate the marketplace:
- Identity data: first name, last name, and identity document number (providers only, for vetting).
- Contact data: email address and mobile phone number.
- Address data: service address supplied when a job is created.
- Location data: approximate location while a job is active, used for routing and dispatch. We do not track location outside active jobs.
- Account credentials: hashed password (we never store plain-text passwords).
- Transaction data: job descriptions, quotes, payment amounts, and completion records.
- Technical data: IP address, browser type, and session tokens collected automatically for security.
- Communications: messages you send within the platform between customers and providers.
3. Purpose and Lawful Basis for Processing
| Purpose | Lawful basis (POPIA) |
|---|---|
| Creating and managing your account | Contract performance (s11(1)(a)) |
| Matching customers with service providers | Contract performance (s11(1)(a)) |
| Processing payments through escrow | Contract performance (s11(1)(a)) |
| Sending transactional notifications (job status, payment confirmation) | Contract performance (s11(1)(a)) |
| Fraud detection and platform security | Legitimate interest (s11(1)(f)) |
| Dispute resolution and mediation | Legitimate interest (s11(1)(f)) |
| Regulatory compliance and tax record-keeping | Legal obligation (s11(1)(c)) |
| Improving platform performance and user experience | Legitimate interest (s11(1)(f)) |
We will never use your personal information for direct marketing without your explicit consent, and you may withdraw that consent at any time.
4. Retention of Personal Information
We retain your personal information for as long as your account is active. Following closure of your account or our last transaction with you, we retain records for a further five (5) years to comply with South African tax legislation (including the Income Tax Act and VAT Act) and to defend against any claims arising from platform use. After this period, personal information is securely deleted or anonymised.
Technical logs (IP addresses, server logs) are retained for a maximum of 90 days unless required for an ongoing investigation.
5. Sharing of Personal Information
We do not sell your personal information to any third party. We share your information only where necessary to deliver the service:
- Other platform users:A customer’s service address and job description are shared with the assigned provider; a provider’s name and rating are visible to the customer.
- Payment processor: We pass the minimum information needed to process payment. The payment processor operates under its own privacy policy and applicable financial regulations.
- Hosting and infrastructure provider: The platform is hosted on servers operated by our cloud infrastructure provider, who processes data on our behalf under a data-processing agreement.
- Legal authorities: We may disclose personal information to law enforcement or regulatory bodies where required by law or court order.
All third-party processors are contractually bound to process your data only on our instructions and to maintain appropriate security measures.
6. Cookies and Tracking
We use session cookies only. These are strictly necessary cookies that keep you logged in during your visit and expire when you close your browser. We do not use advertising cookies, tracking pixels, or any third-party analytics that identify you across websites. No consent banner is required for strictly necessary cookies under POPIA.
7. Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. These include encrypted connections (TLS), hashed credential storage, role-based access controls, and regular security reviews. No system is perfectly secure, and we encourage you to use a strong password and keep your login credentials confidential.
8. Your Rights Under POPIA (Section 23)
As a data subject, you have the following rights under POPIA:
- Right of access (s23(1)(b)): You may request confirmation of whether we hold personal information about you and a copy of that information.
- Right to correction or deletion (s24): You may request that we correct inaccurate, outdated, or incomplete information, or delete information we no longer have a lawful basis to hold.
- Right to object (s11(3)): You may object to the processing of your personal information for legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
- Right to lodge a complaint: You may lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg.
To exercise any of the above rights, contact us at the address in Section 9 below. We will respond within 30 days.
9. Contact Our Information Officer
All data-related queries, access requests, or objections should be directed to our Information Officer:
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via a platform notification or email at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.