KaziGo services marketplace

KaziGo Legal

Privacy Policy

Effective date: 18 September 2026

This Privacy Policy explains how KaziGo collects, uses, shares and protects personal information. It is written primarily against the Protection of Personal Information Act 4 of 2013 ("POPIA") of the Republic of South Africa, and applied across every market in which we operate. Where local law gives you stronger rights, those rights apply.

KaziGo is the responsible party (in some jurisdictions, the "data controller") for the personal information described here. Contact: info@kazi-go.com.

1. Information we collect

  • Identity and contact information — name, phone number, email address, profile photograph, city and country.
  • Identity verification information — a photograph of a government identity document, a selfie, the document type and the name printed on it. This is special personal information under POPIA and is treated accordingly.
  • Professional information — trade, services offered, service areas, rates, years of experience, certificates, portfolio images, ratings and reviews.
  • Transaction information — jobs posted and applied for, prices offered and agreed, completions, Premium payments and references from the payment provider. We never see or store your full card number.
  • Communications — in-app messages, WhatsApp conversations with our assistant, support tickets, photographs shared in a chat, and call metadata (we do not record call audio).
  • Location information — the area of a job, and an approximate location shown to professionals before hire. A precise address is collected from the Client and released only as described in section 5.
  • Technical information — IP address, device and browser type, pages visited, and diagnostic logs.
  • Marketing information — how you found us, referral codes used, and your communication preferences.

2. How we collect it

  • Directly from you when you register, build a profile, post a job or message us.
  • Automatically as you use the Platform, through our own logs and analytics.
  • From WhatsApp when you message our business number.
  • From payment providers when you subscribe to Premium (confirmation and reference only).
  • From other users, when they review you, report you, or refer you.

3. Why we process it, and on what lawful basis

  • Creating and running your account — necessary to perform our contract with you (s11(1)(b)).
  • Matching clients with professionals and sending job alerts — contract performance and our legitimate interest in operating the marketplace (s11(1)(f)).
  • Identity verification of professionals — your explicit consent, and our legitimate interest in the safety of users (s26–s27).
  • Preventing fraud, abuse and unsafe conduct — legitimate interest and compliance with law.
  • Processing Premium payments — contract performance.
  • Service messages — alerts, reminders, receipts — contract performance.
  • Marketing messages and daily tips — your consent; you may opt out at any time.
  • Improving and securing the Platform — legitimate interest.
  • Meeting tax, accounting and legal obligations — compliance with an obligation of law (s11(1)(c)).

4. Automated processing

We use an automated model to assist identity verification, to help triage profile edits and to moderate content, and an AI assistant to answer questions on WhatsApp and in the app. No decision that materially affects you is taken by automation alone — a human admin reviews and decides every verification, suspension and removal. You may ask for the reasons behind a decision and appeal it.

5. When personal information is shared with other users

  • Your name, photograph, city, trade, rating and reviews are visible on your public professional profile.
  • A client's job description, budget and approximate area are visible to matching professionals.
  • Phone numbers are never shown on profiles. They are released only to the counterparty once a hire is agreed, and to administrators for support and safety.
  • The exact address of a job is released only once a site visit is agreed or the professional is hired.
  • Contact details typed into bios, job posts or chat messages are automatically masked.
  • Identity documents are never shown to another user in any circumstance.

6. Operators and third parties

We share personal information with the following categories of operator, each bound by a written agreement to process it only on our instructions and to keep it secure:

  • cloud hosting, database and storage providers;
  • the WhatsApp Business messaging platform, for messages you exchange with us there;
  • email delivery providers, for transactional and notification email;
  • payment providers, for Premium subscriptions;
  • AI model providers, for verification assistance, moderation and the assistant — inputs are used to serve your request, not to train third-party models;
  • analytics, advertising measurement and error-monitoring tools;
  • professional advisers, law enforcement and regulators, where the law requires or permits it.

We do not sell your personal information.

7. Cross-border transfers

Some of our operators host or process personal information outside South Africa and outside Zimbabwe. We transfer personal information across borders only where section 72 of POPIA is satisfied — that is, where the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles of lawful processing substantially similar to POPIA, or where you have consented, or where the transfer is necessary to perform our contract with you. A list of the countries involved is available on request.

8. Security

We apply the following controls, and review them regularly:

  • encryption of all traffic in transit, and encryption of identity documents and selfies at rest using AES-256-GCM;
  • identity documents held in a private store, retrievable only by you or an administrator through a link that expires in ten minutes;
  • phone numbers withheld from the application layer entirely and served only through a server-side permission check;
  • row-level access rules on every data table, so a user can only reach their own records;
  • mandatory two-step verification for every administrator, and role-based limits on what each can see;
  • a personal-data access log recording every administrative view of a phone number, email address or identity document;
  • passwords checked against known breach databases, and the current password required before it can be changed;
  • regular automated security scanning of the platform and its dependencies.

9. Retention

We keep personal information only as long as we need it:

  • Identity document and selfie images — erased 90 days after approval, or 30 days after rejection, by an automated daily job.
  • Record that verification was completed, and its outcome — life of the account.
  • Account, profile and job history — life of the account, then 12 months, then anonymised.
  • Messages and shared photographs — life of the account, then 12 months.
  • Payment records — 5 years, as required by tax law.
  • Administrative access logs — 24 months.
  • One-time verification codes — minutes; expired automatically and unreadable by anyone.
  • Closed accounts — 30-day grace period, then deleted or anonymised.

10. Your rights

Under POPIA and comparable laws you may:

  • ask what personal information we hold about you, and receive a copy — the Download my data button in your account settings gives you a complete export immediately, once per day;
  • ask us to correct or complete information that is wrong;
  • ask us to delete information, subject to legal retention periods — use Delete my account in settings;
  • object to processing based on legitimate interest, or to direct marketing, at any time and free of charge;
  • withdraw consent where processing rests on it, without affecting what came before;
  • not be subject to a decision based solely on automated processing that significantly affects you;
  • complain to us at info@kazi-go.com, and then to the Information Regulator (South Africa) at enquiries@inforegulator.org.za, or to the data protection authority in your own country.

11. Direct marketing

We send service messages you cannot opt out of while you hold an account — verification codes, job alerts you subscribed to, receipts and safety notices. Marketing messages, including daily tips and promotions, are sent only with your consent and every one carries an unsubscribe or STOP instruction that we honour immediately.

12. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to keep you signed in and secure, and analytics and advertising measurement tags to understand how the Platform is found and used. You can control non-essential cookies through your browser settings.

13. Children

The Platform is not for anyone under 18. We do not knowingly collect personal information from children, and we delete it promptly if we learn we have. If you believe a child has registered, contact info@kazi-go.com.

14. Breach notification

If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected users as soon as reasonably possible after establishing the extent of the compromise, describing what happened, what information was involved, and what you should do.

15. Changes to this policy

We may update this policy. Material changes will be notified in the Platform or by email at least 14 days before they take effect, and the effective date at the top of the policy will change.

16. How to contact us

Information Officer, KaziGo — info@kazi-go.com. In South Africa, the Information Regulator can be reached at enquiries@inforegulator.org.za or POPIAComplaints@inforegulator.org.za. In Zimbabwe, the Postal and Telecommunications Regulatory Authority acts as the Data Protection Authority under the Cyber and Data Protection Act [Chapter 12:07].

Questions about this policy? Contact us at info@kazi-go.com.