How CivicRewards handles your personal information

CivicRewards is operated by Signal Desk (Pty) Ltd, trading as Vessel Technologies ("CivicRewards", "we", "us", "our"), a private company registered in South Africa and based in Johannesburg, Gauteng. We are the "responsible party" for personal information processed through civicrewards.co.za, as that term is defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").

We only collect what each feature actually needs to work. Specifically:

• Service delivery reports. When you submit a report through the resident app, we collect your name, your suburb, the street address or landmark of the problem, a description of the issue, and, if you already have one, a municipal reference number. We do not collect a phone number through this form.
• Councillor accounts. When a councillor signs up for the councillor dashboard, we collect their full name, email address, password (stored securely by our authentication provider, never in plain text), ward number, and optionally a municipality name and phone number. New accounts start unapproved, and we manually verify that the person is a real ward councillor before granting access.
• Escalation contact directory. Approved councillors can register WhatsApp numbers for municipal departments or service providers (for example, a water depot or JMPD contact) inside their own dashboard. These are departmental contact numbers, not resident personal numbers.
• Payments. If you make a payment on the site, our payment processor collects what it needs to process the transaction. See section 5.
• Technical information. Standard web server logs (IP address, browser type, timestamps) for security and to keep the site running, and a login session token stored in your browser if you sign in.

Under POPIA, we need a valid legal basis to process personal information. Ours are:

• Consent. Before you submit a service delivery report, you're asked to explicitly confirm that your name, address, and report details can be shared with your ward councillor and the municipal department. We do not submit a report without that consent.
• Performance of a contract. To create and run a councillor account, and to process a payment you've asked to make.
• Legitimate interest. To keep the platform secure, prevent abuse, and improve reliability, in a way that doesn't override your own privacy rights.

We share personal information only where a feature genuinely requires it:

• Report details (name, address, suburb, description) are sent to Signal Desk's Ward 115 service delivery system, which forwards them to your ward councillor and, where applicable, logs a reference with the relevant municipal department.
• Councillor account and dashboard data is stored in our database (Supabase), which we use as our infrastructure provider. Report data shown on the councillor dashboard is read-only, and is served through a server-side process that checks the councillor is approved and only shows reports for their own ward.
• Payment details are handled directly by Paystack. See section 5.
• We do not sell personal information to anyone, and we do not share it with advertisers or data brokers.
• We may disclose personal information if legally required to do so, for example under a valid court order or statutory request.

Card payments on civicrewards.co.za are processed by Paystack (Pty) Ltd, a licensed South African payment service provider. When you pay, your card details are entered directly into Paystack's own secure checkout. We never receive or store your full card number, expiry date, or CVV. We only receive your email address, the amount, and a payment reference, which we use to confirm your transaction went through. Paystack's own privacy policy governs how it handles your payment details.

Some pages on civicrewards.co.za describe planned features such as tokenised utility bonds, sovereign bonds, or fractional municipal bonds (for example, "Jozibonds"), and redemption of civic points into these or similar instruments. These are described as part of our product roadmap, not as products currently on offer. As stated on our homepage: civic points begin as non-financial loyalty units, and any future redemption into a financial or investment-linked product depends on explicit user choice, formal agreements with regulated third-party partners, and legal and regulatory clearance, which may include approval from bodies such as the Financial Sector Conduct Authority.

Until such a product is formally launched and separately disclosed, no personal or financial information is collected for it, CivicRewards is not acting as a financial services provider, credit provider, or deposit-taking institution, and nothing on this site is investment advice or a solicitation to invest.

We use industry-standard security practices, including row-level security on our database, encrypted connections (HTTPS) for all traffic, and service-role database access restricted to server-side processes that first verify who you are. Sensitive keys are never exposed to your browser.

We keep personal information for as long as reasonably necessary for the purpose it was collected for, for example, for as long as a report or councillor account remains relevant to service delivery tracking, or as required by law. You can ask us to delete your information at any time, subject to section 11.

CivicRewards does not currently run advertising or analytics tracking cookies. If you sign in to the councillor dashboard, your browser stores a login session token locally so you don't have to sign in again on every page. That's the only thing stored in your browser by us.

CivicRewards is intended for use by adults (18 and older) reporting on municipal service issues, and by verified ward councillors. We do not knowingly collect personal information from children. If you believe a child's information has been submitted to us, please contact us using the details in section 14 and we will remove it.

Some of our infrastructure providers, including our database and payment processing partners, may process or store data using infrastructure located outside South Africa. Where this happens, we rely on providers that maintain appropriate security and contractual safeguards for personal information, consistent with POPIA's requirements for cross-border transfer.

Under POPIA, you have the right to:

• Ask us to confirm what personal information we hold about you, and to see it.
• Ask us to correct or update information that is inaccurate or out of date.
• Ask us to delete personal information we no longer have a lawful basis to keep, or that you gave consent for and are now withdrawing consent to.
• Object to processing that's based on legitimate interest, on reasonable grounds.
• Complain to us directly, or to the Information Regulator (see section 12).

To exercise any of these rights, contact us using the details in section 14. We will respond within a reasonable time, and in any event within the timeframes POPIA sets out.

If you're unhappy with how we've handled your personal information, please contact us first, so we can try to resolve it directly. You also have the right to lodge a complaint with South Africa's Information Regulator:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: enquiries@inforegulator.org.za
Website: www.inforegulator.org.za
(Contact details correct as of publication, please check the Information Regulator's own website for the most current details.)

We may update this policy as CivicRewards' features change. If we make a material change, we'll update the "last updated" date at the top of this page. We encourage you to check back periodically.

For any privacy question, or to exercise your rights under POPIA, contact our Information Officer:

Thamsanqa Nyathi, Information Officer
Signal Desk (Pty) Ltd t/a Vessel Technologies
Email: Hello@signaldesk.co.za
Phone: +27 10 142 5338
Johannesburg, Gauteng, South Africa