Privacy Policy &
POPIA Notice

01. Legislative Framework & Definitions

This Privacy Policy and Compliance Manual constitutes the statutory disclosure of MIND HAVEN INNOVATIONS (PTY) LTD ("MHI", "the Responsible Party", "we", "us", or "our") pursuant to the provisions of:

• Section 14 of the Constitution of the Republic of South Africa, 1996 (the fundamental constitutional right to privacy);
• The Protection of Personal Information Act No. 4 of 2013 ("POPIA");
• The Promotion of Access to Information Act No. 2 of 2000 ("PAIA");
• The Electronic Communications and Transactions Act No. 25 of 2002 ("ECTA");
• The Cybercrimes Act No. 19 of 2020;
• The Children's Act No. 38 of 2005 (governing protection and best interests of vulnerable minors); and
• The National Health Act No. 61 of 2003 (governing emergency medical coordination and triage parameters).

02. Lawful Grounds & Justification for Processing (Section 11 POPIA)

In strict compliance with Section 11(1) of POPIA, MHI processes personal information only where one or more of the following statutory grounds apply:

• Performance of a Contract (Section 11(1)(b)): Processing is indispensable for concluding or executing the LifeLink terms of service, coordinating community safety alerts, authenticating verified civic helpers, and managing emergency subscription dispatch services.
• Vital Interests of the Data Subject or Another Person (Section 11(1)(d)): Processing is critically necessary to protect the life, physical integrity, or bodily safety of an individual during an active emergency, such as a missing child alert, elderly dementia patient wandering, severe medical trauma, or imminent physical danger, where prior consent cannot be obtained in the moment.
• Compliance with Legal & Statutory Obligations (Section 11(1)(c)): Processing is mandatory to comply with South African legislation, including the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011 (retaining accounting and transaction records for five years), and reporting mandates under the Criminal Procedure Act 51 of 1977.
• Legitimate Interests of the Responsible Party & Community (Section 11(1)(f)): Processing is necessary to protect public safety, prevent fraudulent distress signals, verify helper integrity, secure command console operations, and prevent vigilantism or malicious tracking.
• Voluntary & Explicit Consent (Section 11(1)(a)): Where individuals voluntarily opt-in to non-emergency civic notifications, submit optional medical triage notes, or register as community guardians.

03. Categories of Personal Information Collected

In accordance with the statutory Principle of Minimality (Section 10 of POPIA), we collect only the minimal personal information strictly required to coordinate life-saving community response and family reunification:

04. Compliance with the 8 Conditions for Lawful Processing

Our operational architecture and governance protocols embody the eight statutory conditions set out in Chapter 3 of POPIA:

05. Zero-Knowledge Cryptography, Telemetry & Biometric Protection

MHI recognizes the profound sensitivity of Special Personal Information (Section 26 POPIA) and children's data (Section 34 POPIA). Our platform implements cutting-edge cryptographic guarantees:

• Client-Side Edge Hashing: Photographs submitted by parents or guardians for missing child identification are processed on-device. The device extracts mathematical facial embeddings and applies a one-way cryptographic hash before transmitting the cryptographic digest to decentralized IPFS content networks. Raw unencrypted facial rasters are never broadcast publicly.
• Protection of Children (Sections 34 & 35 POPIA): Profiles for individuals under the age of 18 may only be registered by an authorized parent or legal guardian. Child telemetry is strictly locked down and accessible solely when an active amber/missing alert is initiated by the verified guardian.
• Strict Proximity Dispatch Fencing: Civilian helpers responding to an emergency beacon do not receive identifying biographical details or phone numbers of the distressed individual. Responders receive an ephemeral navigational vector, ensuring privacy and eliminating potential stalking or harassment.

06. Civilian Helper Vetting, CPF Synergy & Emergency Liaison

Community safety requires trust, rigorous vetting, and close synergy with South African statutory law enforcement:

07. Operators & Cross-Border Data Transfers (Section 72 POPIA)

Zero-Data-Selling Guarantee: Mind Haven Innovations does not sell, rent, monetize, or broker personal information or contact databases under any circumstance.

We disclose information solely to authorized Operators under binding Section 21 Operator Agreements:

• Technology Licensor (VaultCore Solutions (Pty) Ltd): Engineers the core cryptography, decentralized IPFS infrastructure, and application logic under strict South African data processing covenants.
• Cloud & Sovereign Infrastructure (Google Firebase Hosting & Sovereign VPS Nodes): Redundant high-availability web delivery via Firebase Hosting and sovereign containerized backend nodes with MinIO S3 object vaults. In terms of Section 72(1)(a) of POPIA, all hosting clusters operate under binding data processing agreements providing equivalent or superior data protection standards.
• Regulated Payment Gateways (Paystack Payments): Subscription billing and helper token payouts are processed through Paystack (a PASA-registered, PCI-DSS Level 1 certified gateway).
• WhatsApp Business Cloud API (Meta Platforms): Automated, encrypted delivery of real-time emergency notifications to verified family circles and community response units.

08. Security Safeguards & Breach Protocol (Sections 19–22 POPIA)

We enforce comprehensive technical, physical, and operational safeguards to protect all personal records against loss, damage, or unauthorized access:

Section 22 Breach Notification Protocol: Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorized person, MHI will immediately notify both the Information Regulator and affected data subjects as required by Section 22 of POPIA, providing full details of the incident, suspected consequences, and remediation measures implemented.

09. Retention & Destruction of Records (Section 14 POPIA)

Personal information is retained only for as long as necessary to achieve the designated safety purpose or satisfy South African statutory obligations:

• Financial, Subscription & Tax Records: Retained for a mandatory statutory period of five (5) years in compliance with the Tax Administration Act No. 28 of 2011 and Companies Act 71 of 2008.
• Active Incident Geolocation & Telemetry Logs: Ephemeral emergency coordinate data is automatically anonymized or permanently purged within thirty (30) days of verified incident closure.
• Registered Family Circle Profiles: Maintained for the duration of the active membership. Upon account deletion request, profiles and biometric hashes are permanently destroyed or irreversibly de-identified within forty-eight (48) hours.
• Destruction Protocol: Digital records are expunged using cryptographically verified deletion algorithms; physical paper records are cross-cut shredded or incinerated.

10. Data Subject Rights & Information Officer Particulars

Under Sections 23, 24, and 25 of POPIA and the provisions of PAIA, you have the following enforceable constitutional and statutory rights:

• Right of Access (Section 23 POPIA & PAIA Section 51): Request confirmation of whether we hold your personal information and obtain a formal copy free of charge.
• Right to Rectification (Section 24 POPIA - Form 2): Request correction, updating, or completion of inaccurate, irrelevant, outdated, or incomplete records.
• Right to Erasure / Destruction: Request deletion of personal records where MHI is no longer authorized to retain them.
• Right to Object (Section 11(3) POPIA - Form 1): Object on reasonable grounds to the processing of your personal information.
• Right to Withdraw Consent: Withdraw consent for non-essential processing at any time without retroactive impact.

11. Direct Marketing & Cookie Policy (Section 69 POPIA)

Electronic Direct Marketing: We strictly adhere to Section 69 of POPIA. We only send community safety bulletins, software updates, or news to individuals who have provided explicit opt-in consent or who are existing subscribed members. Every communication contains an instant, functional one-click unsubscribe mechanism.

Strictly Essential Cookies: Our web properties use only strictly essential first-party cookies necessary for platform operation:

• Theme Preference Cookie: Persists your dark/light operational console display mode.
• Session Authentication State: Maintains secure token-authenticated sessions when accessing dispatcher command consoles.
• Bot & Abuse Mitigation: Utilizes client-side challenge mechanisms to prevent automated scraping, malicious beacon spam, and Denial of Service attacks.
• Zero Advertising Trackers: We never embed third-party advertising cookies, Facebook tracking pixels, or data brokerage telemetry scripts.