Privacy policy
How ToviHub, operated for the South African Township & Village Tourism Association (SATOVITO, NPC 2020/615362/08), handles personal information under the Protection of Personal Information Act (POPIA).
Draft for review — SATOVITO should have this checked and adopted by its Information Officer / legal adviser before launch. Replace bracketed details.
1. Who we are
SATOVITO is the responsible party for personal information processed on ToviHub. Information Officer: [name], [email]. The Information Officer is (or will be) registered with the Information Regulator.
2. What we collect
Member business details (trading name, registration number, location, category); contact details of the member's representatives (name, email, phone); documents you upload for vetting; payment records; messages we send you; and, where you use the referral or ToviPlan features, limited details of clients you refer or quote for.
3. Why we process it
To administer your membership and certificate, collect fees, send renewal reminders (a service message, not marketing), operate the member directory and trade features, and meet SATOVITO's legitimate association and reporting purposes. Marketing messages are sent only where you have opted in.
4. Referred-client information
When you refer or quote for a client, we store only what is needed to pass the booking to the receiving member. Those details are shown to the receiving member on acceptance and are not used for marketing. Members are responsible for having a lawful basis to share their clients' information.
5. Who we share it with
Operators who process data on our behalf under agreement: our hosting and database providers, email and WhatsApp messaging providers, and payment gateways (PayFast, Yoco). Your public directory listing (if enabled) shows your business name, category, province, offerings at public rates and rating — never your trade rates or private feedback.
6. Security & retention
We apply reasonable technical and organisational safeguards; payment-gateway credentials and other secrets are encrypted at rest. We keep personal information only as long as needed for the purposes above or as the law requires, and anonymise or delete referred-client details after a booking is complete.
7. Your rights
You may ask to access, correct or delete your personal information, object to processing, or withdraw a consent, by contacting [email]. You may also lodge a complaint with the Information Regulator (inforeg@justice.gov.za).