Legal

Privacy Policy

Last updated: · Effective date: June 2026

This Privacy Policy explains how KiwaConnect (“we”, “us”, or “our”) collects, uses, stores, and protects your personal information when you use our platform. KiwaConnect is incorporated in Zimbabwe and complies with Zimbabwe’s Cyber and Data Protection Act, Chapter 12:07 (CDPA). Where you are located elsewhere, we also aim to honour widely recognised data-protection principles such as access, correction, deletion, and portability.

1. Who We Are

KiwaConnect is a global professional networking platform for entrepreneurs. We aggregate funding opportunities, enable peer mentorship, facilitate B2B matching, and host community discussion — with deep roots in Zimbabwe and across Africa.

Data Controller: KiwaConnect (Pvt) Ltd, Harare, Zimbabwe
Data Protection Officer (DPO) contact: privacy@kiwaconnect.com

2. Information We Collect

2.1 Information you provide

  • Account data — name, email address, password (hashed, never stored in plain text)
  • Profile data — headline, bio, city, country, industry, profile photo, professional links
  • Communications — direct messages, community posts, replies, mentorship session notes
  • Business data — company details you enter into document or vault features
  • Contact preferences — WhatsApp number (if you opt in), notification settings

2.2 Information collected automatically

  • Usage data — pages visited, features used, timestamps
  • Device data — browser type, operating system, IP address, approximate location derived from IP
  • Cookies — session cookies used for authentication (Supabase Auth); no third-party advertising cookies

2.3 Information from third parties

  • If you sign in with Google, GitHub, LinkedIn, X, or Apple, or connect LinkedIn/ORCID for verification, we receive profile data permitted by those services.

3. How We Use Your Information

We use your personal data to:

  • Provide, operate, and improve the KiwaConnect platform
  • Match you with relevant funding opportunities, mentors, and business partners based on your interests and location
  • Send notifications about connection requests, messages, and opportunities you’ve opted into
  • Verify your identity and prevent fraud or abuse
  • Generate aggregate analytics to understand how the platform is used (no individual profiling for advertising)
  • Comply with legal obligations

4. Legal Basis for Processing

We process your data on the following lawful bases:

  • Contract performance — to provide the service you signed up for
  • Legitimate interests — improving platform safety, preventing fraud, analytics
  • Consent — WhatsApp notifications, optional features (you may withdraw at any time)
  • Legal obligation — regulatory compliance, audit logs where required by law

5. Data Sharing

We do not sell your personal data. We share it only with:

  • Supabase (database and authentication) — data processor under a data processing agreement
  • Vercel (hosting) — with standard contractual clauses in place
  • Resend (transactional email) — for sending you notifications you have requested
  • Cloudflare (Turnstile bot protection) — when you register or sign in
  • Meta (WhatsApp Business API) — only if you have explicitly opted into WhatsApp notifications
  • Regulators or authorities — if required by law in Zimbabwe or your jurisdiction

6. International Transfers

KiwaConnect serves members worldwide. Your data may be processed in countries other than your own (including the United States and European Union) where our infrastructure providers operate. We rely on appropriate safeguards such as standard contractual clauses where required.

7. Data Retention

  • Account data is retained for as long as your account is active.
  • After account deletion, personal data is hard-deleted within 30 days, except where retention is required by law.
  • Anonymised, aggregated analytics data may be retained indefinitely.

8. Your Rights

You have the right to:

  • Access — request a copy of the personal data we hold about you
  • Correction — request we correct inaccurate data (editable from your Profile Settings)
  • Deletion — request deletion of your account and associated data (Settings → Advanced → Delete account)
  • Portability — export your profile and activity data in JSON format (Settings → Advanced → Export)
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — disable WhatsApp or other optional processing at any time in Settings → Notifications

To exercise any right, email privacy@kiwaconnect.com. We will respond within 30 days where practicable.

9. Security

We implement industry-standard security measures including: TLS encryption in transit, encryption at rest (via Supabase), rate limiting, Row-Level Security policies on all database tables, and regular dependency audits.

Despite these measures, no system is 100% secure. If you discover a vulnerability, please responsibly disclose it to security@kiwaconnect.com.

10. Cookies

We use only essential cookies — session tokens required to keep you logged in. We do not use tracking or advertising cookies. You can delete cookies via your browser settings, but this will sign you out.

11. Children

KiwaConnect is intended for users aged 18 and over. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notification at least 14 days before they take effect. Continued use of the platform after the effective date constitutes acceptance.

13. Contact Us

For privacy enquiries, data subject requests, or complaints:

Zimbabwe residents may also lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the data protection supervisory authority under the CDPA.

Terms of Service