Privacy policy
Action needed before launch: the operator name, address and
Information Officer details below are still placeholders. Set them in
config('legal') (see config.sample.php) — POPIA requires a
named Information Officer, and this text says so.
This policy explains what personal information Newspapers South Africa ("the Site", "we", "us") collects, why, and what you can do about it. It applies to everyone who reads the Site and to every newsroom that publishes through it. Newspapers South Africa is operated by [Khwaza Media pty ltd], [76 Jan Van riebeeck Ave, Stilfontein, South Africa].
We process personal information in line with South Africa's Protection of Personal Information Act (POPIA). This page is a plain-language summary, not a substitute for legal advice — if you rely on it for a live site handling real people's data, have a South African attorney check it against your actual setup.
Information we collect
| Who | What we collect | Why |
|---|---|---|
| Everyone browsing the Site | Standard web server logs (IP address, browser, pages requested); a one-way cryptographic hash of your IP address (not the IP itself) tied to form submissions and login attempts | Keep the Site running, diagnose problems, and stop spam and brute-force abuse of the sign-up, sign-in and password-reset forms |
| Newsroom publisher accounts | Your name, email address, a securely hashed password (we never store or see the password itself), and the newspaper details you enter (name, location, contact details, articles, images and PDFs you upload) | Create and run your account, let you publish, and let readers find and contact your newspaper through the details you chose to make public |
| Anyone completing a form (registration, sign-in, password reset) | The reCAPTCHA cookie and check, if we have it turned on | Confirm you're a person, not an automated script |
| Everyone, via cookies | A session cookie (keeps you signed in and protects forms from forgery); if advertising is enabled, cookies set by Google AdSense | Site functionality; advertising that helps fund the Site (see below) |
We do not ask readers to create an account, and we do not collect payment information anywhere on the Site.
Cookies
- Essential. A session cookie identifies your browser session so you can stay signed in and so forms are protected against cross-site forgery. The Site does not work without it, so it is set regardless of consent, as most data protection laws (including POPIA) allow for cookies that are strictly necessary for the service you asked for.
- reCAPTCHA (if enabled). Google sets cookies to tell people apart from bots on the registration form. See Google's own policy below.
- Advertising (if enabled). If we turn on Google AdSense, Google and its advertising partners may set cookies to serve and measure ads, including ads based on your visits to this and other sites.
You can block or delete cookies in your browser at any time; the Site will still work, though you may need to sign in again more often.
Third parties we share information with
- Our hosting provider, who stores the database and uploaded files on our behalf and can only use them to provide hosting to us.
- Our email delivery service (whichever mailbox or provider is configured for the Site), used only to send you account-related email — verification links, password resets, and (for newsroom owners) approval notices.
- Google, if AdSense and/or reCAPTCHA are enabled, under Google's own privacy policy. You can manage ad personalisation at Google Ad Settings and read how Google uses cookies for ads at policies.google.com/technologies/ads.
We do not sell personal information, and we do not share it with anyone else for their own marketing purposes. Some of the services above (including Google) may process information on servers outside South Africa; where that happens, we rely on their own compliance frameworks for cross-border transfers.
How long we keep it
Account information is kept for as long as the account is active, plus a reasonable period afterwards in case you want to return or in case we need it to resolve a dispute. Server logs and abuse-prevention hashes are kept for a short rolling window and then deleted automatically. Published articles and PDF editions are kept as a public record of what a newsroom published, unless removed under our complaints process.
Keeping it secure
Passwords are never stored in plain text — only a one-way cryptographic hash. Every form that changes data is protected against cross-site request forgery, and uploaded files are checked and stored where they cannot be executed as code. No online service can guarantee perfect security, but we take reasonable technical steps to protect what we hold.
Your rights under POPIA
You can ask us, at any time and free of charge, to:
- Access the personal information we hold about you;
- Correct information that is inaccurate, outdated or incomplete;
- Delete your account and associated personal information, subject to anything we're legally required to keep;
- Object to a particular use of your information; and
- Ask how an automated decision (if we ever made one about you) was reached.
To exercise any of these, email our Information Officer (details below). If you are not satisfied with our response, you may complain to South Africa's Information Regulator.
Children
The Site is not directed at children, and newsroom accounts are not intended for anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as the Site changes. Material changes will be reflected in the "Last updated" date above.
Contact us / Information Officer
Under POPIA, our Information Officer is [Ikey Carlson]. Reach them at ikey@khwaza.co.za.