Privacy Policy
Last updated 17 September 2026. This policy is written for compliance with South Africa's Protection of Personal Information Act, 2013 (POPIA). It is a starting template — have it reviewed by a legal adviser before launch, and register your Information Officer with the Information Regulator.
1. Who we are
Khwaza Radio is operated by Khwaza Media ("we", "us"). We are the responsible party for the personal information described here. Our Information Officer can be reached at privacy@khwaza.co.za.
2. What we collect
- Account data — your email address and a securely hashed password.
- Station data — the station name, genre and settings you create, and the streaming account provisioned for you on our streaming server.
- Technical data — your IP address at sign-up, session cookies, and server logs (timestamps, pages requested, errors) kept to run and secure the service.
- Billing data (paid plans, when enabled) — the plan you choose and a payment reference from our payment provider. We do not store card numbers.
- Support data — messages you send us and our replies.
3. Why we process it, and our lawful basis
| Purpose | Lawful basis (POPIA) |
|---|---|
| Create and run your radio station; provide the dashboard and support | Performance of a contract with you |
| Send account, verification and service emails | Performance of a contract |
| Prevent abuse, fraud and security incidents; enforce our terms | Legitimate interests |
| Comply with law (e.g. responding to lawful requests, copyright complaints) | Legal obligation |
| Product updates or marketing emails, if any | Consent (you can opt out at any time) |
4. Who we share it with
- Our streaming server (SonicPanel / ShoutCast) — your station username, email and plan are sent there to create and manage your stream.
- Email delivery — our mail provider transmits the emails we send you.
- Payment providers (paid plans) — they process payments under their own privacy policies.
- Authorities or complainants — where we are legally required to, or to handle a valid copyright or abuse complaint.
We do not sell your personal information.
5. Where it is processed
Our infrastructure is hosted in South Africa. Some service providers (e.g. email) may process data outside South Africa; where they do, we rely on providers that offer an adequate level of protection as required by POPIA.
6. How long we keep it
Account and station data is kept while your account is active and for up to 12 months after closure (for billing, dispute and abuse-handling purposes), then deleted or anonymised. Server logs are kept for up to 6 months. Copyright and abuse records are kept for up to 3 years.
7. Your rights
Subject to POPIA, you may ask us to confirm what personal information we hold about you, to correct or delete it, to object to certain processing, or to send you a copy. Contact privacy@khwaza.co.za. You also have the right to lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.
8. Cookies
We use a single essential session cookie to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising or third-party tracking cookies.
9. Security
Passwords are hashed with Argon2id. Stream and panel credentials are encrypted at rest. Traffic is served over HTTPS. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information and will notify you and the Regulator of a breach where the law requires.
10. Changes
We will post any changes on this page and update the date above. Significant changes will be notified by email.