Privacy Policy

Khula operates a tap-to-pay network that lets individuals and businesses receive digital payments through NFC cards and QR codes. Khula is the responsible party for the personal information described below.

Card payments are processed by regulated payment partners. Khula does not store full card numbers, CVV codes or card PINs at any time.

Recipients: name, mobile number, occupation, the bank account you nominate for payouts, and identity or verification documents where these are required by law or by our payment partners.

Businesses: business details, registration information, locations, and the team members you add to your account.

People who pay: the amount paid, an email address for the receipt, and an optional name or message. Payers never need an account and we do not build a profile of you.

Technical information: device and browser data, IP address and basic tap analytics used to keep the network secure and to detect abuse.

To process payments and settle money to recipients, to verify identity where the law requires it, to prevent fraud and abuse, to provide support, and to send transactional messages such as one-time codes and settlement notifications.

We do not sell personal information, and we do not use payment data for advertising.

Payment processors and banks, to move and settle money. SMS providers, to deliver one-time codes and notifications. Cloud infrastructure providers who host the service. Regulators or law enforcement where we are legally obliged to respond.

Each of these parties receives only the minimum information needed to perform their function.

A recipient sees the amount you paid, the time of the payment, and the name or message you chose to include. Recipients do not receive your card details or your contact details beyond what you voluntarily provide.

Transaction and verification records are retained for the periods required by South African financial and tax law, typically five years. Other information is kept only for as long as your account is active.

Access to personal information is restricted by role and enforced at the database level. Payment credentials are held server-side only and are never exposed to a browser.

You may request access to the personal information we hold about you, ask us to correct it, object to certain processing, or request deletion where we are not legally required to keep it. You may also lodge a complaint with the Information Regulator of South Africa.

For any privacy request, contact our information officer at privacy@khulapay.co.za. We aim to respond within 30 days.