Privacy & POPIA

Last updated 2 August 2026

Privacy notice

Harvest Church respects your privacy and processes personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).

This notice explains what information may be collected through the Harvest Church website and Progressive Web App (PWA), why it is used, who may receive it and the choices available to you.

1. Responsible party

The responsible party is Harvest Church, uMhlanga, Durban.

Privacy and POPIA enquiries may be addressed to the Harvest Church Information Officer using these contact details.

2. Information we collect

The information collected depends on how you use the PWA.

Website use

The PWA may use a randomly generated anonymous visitor identifier and the page visited to understand general website usage. This analytics information is kept separate from information submitted through event, Life Group or payment forms.

App installation

When the PWA is installed or opened as an installed app, it may record:

• A randomly generated installation identifier
• Device platform and general device type
• Browser user-agent information
• Whether the record followed installation or an installed-app launch

Notifications

Where you enable notifications, OneSignal processes the notification subscription and related technical identifiers. The installation identifier may be associated with that subscription so notifications can be managed correctly. You may disable notifications through the PWA or your browser or device settings.

Event registration

Event-registration forms may collect:

• First and last name, mobile number and email address
• Number of attendees and additional notes
• Answers to event-specific questions
• The selected event and registration form
• Payment status and amount where payment is required
• The PWA installation identifier where available

The fields marked as required must be completed for the registration to be processed. An email address is required for paid registrations.

Life Group requests

A Life Group request may collect the selected Life Group, your name, mobile number, optional email address, optional information about you and your family, and the request date. The request may be made available to authorised Harvest administrators and the leader of the selected Life Group.

Giving and payments

The Harvest giving form collects the selected giving category and amount. Online payment is completed through PayFast, which collects and processes the payment and card information required to complete the transaction. Harvest does not capture card details on the giving page. Paid event registrations may also be transferred to PayFast for payment.

Ask Harvey

When you use Harvey, your question, the current PWA page and limited messages from the current Harvey conversation are sent to the Harvest Harvey service. Relevant Harvest context is provided to OpenAI to generate a response. Do not include confidential, private or highly sensitive information in a Harvey question. Voice input is converted to text using facilities provided by your browser or device.

Direct communications

When you contact Harvest by email, telephone, WhatsApp or another external service, that service may also process the information you provide under its own privacy terms.

3. Why we use the information

Personal information is used only where reasonably necessary to:

• Respond to enquiries and requests
• Arrange Life Group visits
• Manage event registrations and attendance
• Communicate about an event or request
• Process and confirm payments
• Send requested notifications
• Provide Harvey responses
• Operate, secure and improve the PWA
• Maintain appropriate administrative and transaction records
• Meet applicable legal, accounting and regulatory obligations

Information submitted for one purpose will not be used for an unrelated purpose unless permitted by law or you have been appropriately informed.

4. Required and optional information

Using the PWA and submitting public forms is voluntary. Fields marked as required must be completed for Harvest to process the relevant request or registration. If required information is not supplied, Harvest may be unable to complete the requested action. Optional fields may be left blank.

5. Who may receive the information

Information may be accessed or processed by:

• Authorised Harvest Church administrators
• The leader of a selected Life Group where necessary
• Supabase, which provides database, storage and server-function services
• Afrihost, which provides hosting and outgoing email services
• Google Workspace, which receives Harvest email
• PayFast, which processes online payments
• OneSignal, which provides push notifications
• OpenAI, which supports Harvey response generation
• Other service providers required to operate, secure or maintain the PWA
• Public authorities where disclosure is required by law

Service providers receive only the information reasonably necessary for the service they perform.

6. Processing outside South Africa

Some technology providers operate internationally. Information may therefore be processed or stored outside South Africa. Where this occurs, Harvest will take reasonably practicable steps to ensure that the information receives appropriate protection consistent with POPIA.

7. Browser storage

The PWA uses browser local storage for functions that may include:

• Anonymous website visitor identification
• PWA installation identification
• Install-prompt dismissal
• Notification preferences and installation dates
• Records of notifications cleared by the user
• Limited interface and session settings

Clearing browser data may remove these settings and identifiers.

8. Retention

Harvest retains personal information only for as long as reasonably necessary for the purpose for which it was collected, or where retention is required for lawful administrative, transaction, accounting or regulatory purposes.

Current automated rules include:

• A closed Life Group request is deleted after it has remained closed for at least 30 days.
• Related Life Group email-queue records are deleted with the request.
• An expired, unpaid event registration may be deleted 30 days after the event where it has no payment link or payment-completion record.
• Paid, payment-related, undated and more recent event registrations are not removed by that automated cleanup rule.

Other records will be reviewed and deleted or de-identified when Harvest is no longer authorised or reasonably required to retain them.

9. Security

Harvest uses reasonable technical and organisational measures to protect information against loss, unauthorised access, misuse, alteration or disclosure. No internet-based system can be guaranteed to be completely secure. Where Harvest becomes aware of a qualifying security compromise, it will follow the notification obligations required by POPIA.

10. Your rights

Subject to POPIA and any applicable legal limitations, you may request that Harvest:

• Confirm whether it holds personal information about you
• Provide access to that information
• Correct inaccurate or incomplete information
• Delete information that Harvest is no longer authorised to retain
• Restrict or object to certain processing
• Explain who has received or had access to the information

Harvest may require reasonable proof of identity before acting on a request.

11. Children and sensitive information

Where information is submitted for or about a child, it should be submitted or authorised by a parent, guardian or other competent person where required.

Do not submit identity-document numbers, banking credentials, medical information or other highly sensitive details unless Harvest has specifically requested them for a legitimate purpose. Information entered into Harvey should not contain confidential or sensitive personal information.

12. Complaints

Please contact Harvest first so the matter can be investigated:

You also have the right to lodge a POPIA complaint with the South African Information Regulator.

• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200
• Toll free: 0800 017 160
• Information Regulator complaints page

13. Changes to this notice

This notice may be updated when the PWA, its forms, service providers or information-processing practices change. The current version and revision date will remain available through the Privacy & POPIA footer link.