Privacy Policy

Vaal News and Culture is operated by [COMPANY NAME] (Pty) Ltd, a private company registered in the Republic of South Africa under registration number [COMPANY REGISTRATION NUMBER]. We are the "responsible party" for your personal information under the Protection of Personal Information Act 4 of 2013 ("POPIA"). That means we decide why and how your personal information is processed.

Registered name

[COMPANY NAME] (Pty) Ltd

Registration number

[COMPANY REGISTRATION NUMBER]

Registered address

[REGISTERED ADDRESS]

Website

https://vaal-news-and-culture.com

Email

[CONTACT EMAIL]

Information Officer

[INFORMATION OFFICER NAME], reachable at [CONTACT EMAIL]

These details are also provided to satisfy the disclosure requirements of section 43 of the Electronic Communications and Transactions Act 25 of 2002 ("ECTA").

This policy explains how we handle personal information on the Vaal News and Culture website and app: when you simply read stories, when you create an account, when you comment or join the community, and when you publish as a creator.

It does not cover what other companies do with your information once it reaches them. When a story is republished to a social platform, or when you follow a link away from our site, that platform's own privacy policy applies.

POPIA sets eight conditions for lawful processing. We apply them as follows.

Accountability

We are the responsible party and we answer for everything described here. Our Information Officer is registered with the Information Regulator.

Processing limitation

We collect the minimum we need, lawfully, and only with your consent or another lawful ground. You may withdraw consent where consent is the ground.

Purpose specification

We collect for the specific purposes listed in section 5 and nothing else.

Further processing limitation

We do not later use your information for a purpose that is incompatible with why we collected it.

Information quality

We keep your information complete and accurate, and you can correct it in your profile at any time.

Openness

This policy is that openness. It is public, permanent and reachable without signing in.

Security safeguards

We apply the technical and organisational measures described in section 9, and we notify you and the Regulator of a compromise as POPIA requires.

Data subject participation

You may ask what we hold, ask for corrections, ask for deletion, and object. See section 11.

We collect the following categories of personal information.

Account details

Your name, email address and password (stored only as a secure hash) when you sign up, or the name, email address and profile picture your Google account gives us if you sign in with Google.

Creator profile

Your display name, biography, profile picture, town or location, and links to your social accounts, including any verification information you supply when you apply to become a creator.

Content you publish

The stories, articles, video, audio, images, thumbnails, captions, tags, categories and town or location tags you upload, plus drafts, edits and version history.

Community activity

Comments, community posts, direct messages, ratings, reports you submit, likes, saves, follows and who follows you.

Device and technical information

Your IP address, browser and device type, operating system, screen size, language, referring page, and the pages you view on our site.

Upload diagnostics telemetry

Every time a creator attempts an upload we log the file name, file size, MIME type, video duration and resolution, the estimated connection speed, the user agent string, how far the upload reached, and any error returned. We do this so we can see why uploads fail on slow mobile connections and fix them. This is honest disclosure: the file name you chose on your phone is stored in our diagnostics.

Correspondence

Emails and messages you send us, including copyright complaints and support requests.

Consent records

The date and time you accepted these policies and the version you accepted.

News footage often contains other people. If you film someone identifiable, their image and voice are their personal information and you are responsible for having their permission before you upload. See the Terms of Service.

Running your account

Purpose: create and secure your account, sign you in, recover your password. Ground: performance of our contract with you (section 11(1)(b) of POPIA).

Publishing your stories

Purpose: host, display, edit and distribute the content you submit. Ground: contract, and your consent given through the creator licence in the Terms.

Community features

Purpose: show comments, follows, likes, saved items and messages. Ground: contract and your consent.

Editorial and journalism

Purpose: report the news of the Vaal Triangle, including information about identifiable people in the public interest. Ground: journalistic purposes, which POPIA recognises in section 7, subject to the Press Code we follow.

Moderation and safety

Purpose: review submissions, act on reports, prevent abuse and fraud, and enforce the Terms. Ground: our legitimate interests (section 11(1)(f)).

Upload diagnostics

Purpose: diagnose failed uploads and improve performance on slow connections. Ground: legitimate interests.

Social republishing

Purpose: share teaser clips and stories to our Facebook, Instagram, TikTok and YouTube accounts. Ground: the creator licence you grant in the Terms, and your consent.

Legal compliance

Purpose: answer lawful requests, keep records, defend claims. Ground: legal obligation and the establishment of a legal right.

We do not sell your personal information. We share it with these parties only.

Supabase

Our operator (in POPIA terms) for hosting, the database, authentication and file storage. Everything you give us sits on Supabase infrastructure. They process it only on our instructions and under a written agreement.

Facebook and Instagram (Meta Platforms)

Where our editorial desk republishes story teasers, video and captions to our own Page and account.

TikTok

Where our editorial desk posts teaser clips and captions to our own account.

YouTube (Google)

Where our editorial desk posts teaser clips as Shorts to our own channel.

Service providers

Email delivery and error monitoring providers acting on our instructions.

Law enforcement and regulators

Where we are legally obliged to disclose, or to protect our rights or someone's safety.

Be clear about this: once a story is shared to a social platform, the video, the caption and any personal information inside them have left our systems. From that moment they are governed by that platform's own terms and privacy policy, not by ours, and we cannot control how they are copied, downloaded, recommended or retained there.

Our hosting provider and all four social platforms store and process data outside South Africa, including in the United States, the European Union and other countries. This means your personal information crosses the border.

Section 72 of POPIA allows this in defined circumstances. We rely on the following grounds: our written agreements with our operators impose conditions for lawful processing that are substantially similar to POPIA (section 72(1)(a)); where you publish content or we republish a story to a social platform at your request or under the creator licence, the transfer is necessary to perform our contract with you (section 72(1)(c) and (d)); and where none of those apply we ask for your consent (section 72(1)(b)).

If you would like a copy of the safeguards that apply to a specific transfer, write to our Information Officer.

Account and profile

For as long as your account is open. When you close it we delete or anonymise your profile within 30 days, except where we must keep records longer by law.

Published stories

Indefinitely, as part of the public news archive, unless you ask us to remove them and there is no overriding journalistic or legal reason to keep them.

Drafts and unpublished uploads

Deleted 12 months after last activity.

Comments and community posts

Until you delete them or your account is closed.

Upload diagnostics telemetry

Kept for 12 months, then deleted.

Rendered teaser clips

Kept while the related social post exists, and for our records of what was published.

Moderation, audit and consent records

Kept for at least 5 years so we can show what was decided, by whom, and what you agreed to.

• All traffic to and from the site is encrypted in transit (HTTPS).
• Passwords are never stored in readable form.
• Database access is controlled row by row, so one member cannot read another member's private data.
• Access to editorial, admin and audit tools is limited by role, and every editorial action is written to an append-only audit trail.
• Social platform access tokens and app secrets are stored server-side only. They are never included in the website code your browser downloads and are not readable through our public interfaces.
• Uploaded media sits in access-controlled storage, and private files are served through short-lived signed links.

No system is perfectly secure. If a compromise of your personal information occurs, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

When you delete a story, we remove it from Vaal News and Culture and from our feeds, and we stop serving the video from our storage.

We cannot promise the same on the social platforms. Where we still hold a valid connection to the account it was posted to, we will attempt to delete the post as well and we will tell you the outcome. But a platform may refuse the request, the connection may have expired, the clip may already have been downloaded, re-shared, duplicated or embedded elsewhere, and search engines and archives may hold copies. Please treat anything published to social media as permanent in practice.

Under POPIA you have the right to:

• ask us to confirm whether we hold personal information about you, and ask for a copy of it (sections 23 and 24);
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object, on reasonable grounds, to our processing of your information (section 11(3));
• withdraw your consent, where we relied on consent, without affecting processing that already happened lawfully;
• not be subject to a decision based solely on automated processing; and
• complain to the Information Regulator.

To exercise any of these rights, email our Information Officer at [CONTACT EMAIL]. Please tell us which right you are exercising and give us enough detail to identify you. We will respond within 30 days. Formal access requests are made on Form 2 under the Promotion of Access to Information Act 2 of 2000, and we may charge the prescribed fee for copies. You can change most of your profile information yourself in Settings.

If you are unhappy with how we handled your personal information or your request, you may lodge a complaint with the Information Regulator of South Africa.

Information Regulator (South Africa)

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 (P.O. Box 31533, Braamfontein, Johannesburg, 2017)

General enquiries

enquiries@inforegulator.org.za

POPIA complaints

POPIAComplaints@inforegulator.org.za

Telephone

+27 10 023 5200

Website

https://inforegulator.org.za

You must be at least 18 years old to hold a creator account and publish content on Vaal News and Culture. Readers and commenters must be at least 13, and if you are under 18 you need the permission of your parent or guardian to hold any account.

POPIA treats the personal information of a child (anyone under 18) as special and generally prohibits processing it without the consent of a competent person, usually a parent or guardian.

Children do appear in community news footage. Where a child is identifiable in a story, the creator must obtain the written consent of the parent or guardian before uploading, and must not identify a child who is a victim of, witness to or accused in a criminal matter, in line with the Children's Act 38 of 2005 and the Press Code. Our editorial desk will blur, cut or decline footage that does not meet this standard. If you are a parent or guardian and your child appears in a story, email us and we will remove or obscure them.

Strictly necessary

We store a session token in your browser so you stay signed in, and small preference values such as your theme and whether the sidebar is collapsed. The site does not work without these.

Playback and personalisation

We keep a local record of which stories you watched and for how long, so your feed can show you more of what you actually watch. Some of this is stored on your device and some against your account.

Analytics

We record page views, story views, watch time and interactions with editorial features in our own database on Supabase. We do not run third-party advertising trackers and we do not sell this data.

Social platform embeds

If a page embeds content from a social platform, that platform may set its own cookies. Those are outside our control.

You can clear or block cookies in your browser settings, but if you block the necessary ones you will not be able to sign in.

Where the Consumer Protection Act 68 of 2008 applies to our relationship with you, nothing in this policy limits your rights under it, including your right to privacy in section 11 and your right to restrict unwanted direct marketing.

We only send you direct marketing by electronic means if you are an existing member and have not objected, or if you have consented, as section 69 of POPIA requires. Every marketing email carries an unsubscribe link. Our ECTA section 43 disclosure details appear in section 1 above.

We may update this policy. If a change materially affects your rights we will tell you in the app or by email at least 14 days before it takes effect. The "Last updated" date at the top always reflects the current version, and we keep a record of which version you accepted.

Privacy questions, access requests and objections: [INFORMATION OFFICER NAME], Information Officer, [COMPANY NAME] (Pty) Ltd, [REGISTERED ADDRESS], [CONTACT EMAIL].