Privacy Policy

Who we are

helyi is a platform that connects local food community members with each other. The responsible party under the Protection of Personal Information Act (POPIA) is the operator of the local you have been invited to join.

What personal information we collect

• Account data: first name, last name, email address, phone number, and phone verification status (timestamp of verification). SA ID numbers are validated but never stored.
• Usage data: bookings, basket orders, and preferences stored while using the platform.
• Communication data: emails sent to you are logged (sender, recipient, subject, status) for up to 2 years.
• Session data: login tokens and timestamps, IP addresses used at login.

Why we process your information

• To provide the platform services you have signed up for (lawful basis: contract performance).
• To send you booking confirmations and order invoices (lawful basis: contract performance).
• To maintain security and detect abuse (lawful basis: legitimate interest).

Account verification

To protect our communities, we ask members to verify their phone number. Organisers are also required to verify their identity before managing a local.

Phone verification

When you verify your phone number, we send a one-time code (OTP) via SMS. Your phone number is stored as part of your account data and used only for account verification.

Organiser identity verification

Organisers are required to provide their South African ID number as part of identity verification. Your ID number is validated in real time and is never stored. Only the outcome (verified or not) and the timestamp of verification are retained.

Who we share your data with

Your data is shared only with the operators of your local (organisers, suppliers as relevant to your orders). We do not sell or share personal data with third parties for marketing.

Emails are sent via Scaleway Transactional Email (Scaleway SAS, France), who process email delivery on our behalf and are bound by a data processing agreement.

SMS verification messages are sent via Clickatell (Clickatell.com, South Africa), who process SMS delivery on our behalf.

How long we keep your data

• Account data: until you delete your account.
• Order and booking history: retained for financial record purposes (7 years).
• Email logs: purged after 2 years.
• Login session tokens: expire automatically after 60 days.

Your rights under POPIA

You have the right to:

• Access the personal information we hold about you — email privacy@helyi.net.
• Correct inaccurate information — update your profile in Account Settings.
• Delete your account and personal data — available in Account Settings.
• Object to processing — email privacy@helyi.net.
• Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za .

Security

All data is transmitted over HTTPS. Passwords are hashed using Argon2. Access to personal data is restricted to authenticated users and local organisers.

Contact

For privacy-related requests, email privacy@helyi.net.