POPIA Compliance

KUCO processes personal information in line with the Protection of Personal Information Act, 4 of 2013 (POPIA). This page explains the roles we play, how the platform gives effect to POPIA's conditions, and how to reach our Information Officer.

• For the account information of the people who sign up to KUCO, we are the responsible party.
• For the information a business enters about its own staff, customers, suppliers and job applicants, that business is the responsible party and KUCO acts as its operator, processing the information only on its instructions and under these published safeguards.
• For supplier compliance information shared with a corporate customer, the sharing happens only on the supplier's explicit approval, and the receiving corporate is responsible for its own further processing.

• Processing limitation: we collect only what the service needs, and supplier compliance answers are only requested when a corporate customer's template actually requires them.
• Purpose specification: every module states what the information it captures is for, and we do not repurpose it for advertising or sale.
• Openness: this page, our Privacy Policy and our Security page describe our processing publicly.
• Security safeguards: encryption in transit and at rest, database row-level security isolating every business, role-based access within a business, and audit trails on compliance data changes.
• Data subject participation: access, correction and deletion requests are honoured through the app or via the Information Officer.

KUCO's Information Officer is the head of the business, contactable at hello@kuco.co.za. Requests under POPIA or the Promotion of Access to Information Act (PAIA) can be directed there, and our PAIA manual is available on request while its publication is finalised.

You may lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, or via inforegulator.org.za.