Privacy policy

Mandate SA is operated by Mandate SA (Pty) Ltd, the “responsible party” under the Protection of Personal Information Act (POPIA).

Organisation

Mandate SA (Pty) Ltd

Privacy, PAIA and legal

Information Officer, Mandate SA (Pty) Ltd: legal@mandatesa.com

Corrections and complaints

editorial@mandatesa.com

Data and research queries

research@mandatesa.com

General enquiries

info@mandatesa.com

Partnerships and investors

partnerships@mandatesa.com

Privacy requests: see your rights and how to use them.

Most of Mandate SA is a record of public power: official election results, boundaries, office-holders, party lists, public money and the official sources they come from. Much of it names people in their public roles, such as a councillor, a candidate or a party official.

That a record is public does not make every detail about a person fit to publish. Mandate SA publishes what an official source states about a public role, with its source. It does not publish home addresses, personal phone numbers, identity numbers or family details. Contact details and identity documents sent to us are never published.

A person’s political affiliation is special personal information under POPIA (sections 26 and 27). Mandate SA shows it only as the official source states it for a public role: an IEC candidate list, a legislature roster or a party’s own registration. It is never inferred from anything else.

A submission or a sign-in can also reveal something about your political views or affiliation, for example when you write on behalf of a party. We use that only to handle the submission or the claim. We do not build profiles of people’s political views, and we never publish who sent a submission.

Four kinds of information are kept apart throughout:

• the official record, exactly as the official source published it;
• what an account holder says on their own workspace;
• what someone sends us in a submission, which stays private until an editor has reviewed it;
• what Mandate SA’s editors have assessed with evidence, such as a fact check.

• Reading the public site. No account is needed and the site sets no cookies (see the cookie notice). Our hosting and network providers process technical data such as your network address and browser details to deliver pages and to protect the service.
• Find my ward. Your device’s location is requested only when you tap “Use my location”, after your browser asks you. It is sent once to our server to find the ward containing it. It is not stored or logged, and it is not put in a web address. To limit abuse, a one-way code derived from your network address is held in our server’s memory for one minute. Searching by name sends only what you type.
• Maps. Map backgrounds load from OpenFreeMap (tiles.openfreemap.org), which receives your network address and the map area you view, as any website you load does. A voting station’s “Directions” link opens Google Maps only when you choose it; Google then receives the station’s location and your request under its own terms. Nothing is sent to Google before you follow the link.
• Javi, the research assistant (when it is switched on; it is off until an independent security review is complete). Javi answers from the published record without an AI model. It does not store your questions or its answers. To apply its free daily allowance fairly, it sets one cookie (see the cookie notice) and keeps only a one-way scrambled form of that cookie and of your network address, with a count of answers, for at most two days.
• Submissions (disputes, additional information, right of response, profile claims). Their purpose is to review the record.
  • We keep the text you write and any files you attach, up to three files of 10 MB each.
  • Contact details you give are sealed on our server with a key held offline and are not readable in our editorial system.
  • A one-way code derived from your network address is kept for 30 days to detect abuse.
  • Submissions are held in quarantine and read only by authorised staff, and each reading is logged.
• Protection against automated abuse. The submission, registration and password-reset forms are prepared for Cloudflare Turnstile, a check against automated abuse. It is not switched on yet. When it is, this section will say what Cloudflare receives.
• Registration (the account portal). Accounts are opened by invitation: Mandate SA invites an authorised official of a party or organisation at their work e-mail address. You give that e-mail address, choose a password and agree to the terms of use. We send a one-time link to confirm the address, set a short-lived browser cookie that ties that link to your browser (one hour), and you then set up two-step verification. Registering gives you a sign-in only: no account, no role and no access to any record. Whether an address is already registered is never revealed.
• Claiming a party’s profile. To show that you may act for a party, you tell us your position in the party, explain how our editors can confirm it, and give up to five links to official pages, such as a page on the party’s own website naming you or your office. The e-mail address you sign in with is part of the evidence: for a party claim it should be an address on the party’s own domain. Editors use this only to decide the claim. A claim reveals your link to a political party, which is special personal information under POPIA; we process it with your consent, which you give by submitting the claim. You may withdraw it at any time: in the portal while the claim is under review, or by asking us afterwards. Withdrawing ends the claim and any access it gave.
• Accounts (party, organisation and representative workspaces and their members). Their purpose is to give access and to verify claims. We send account e-mails (invitations, address confirmations and password resets) from an automated mandatesa.com address that does not receive replies. We keep your e-mail address, your password (as a one-way hash, held by our authentication service), your two-step verification factor, your claims, your membership roles, and your session activity (when a session started, was last active and ended). The authentication service also records the network address of sign-ins.
• Account workspace content. Change requests, messages with our editors, saved research and Javi questions and answers are kept to provide the workspace and to account for requests. They are visible to that account’s members and to authorised staff.
• Security and audit records. We keep an append-only log of security events and of changes to the record, linked in a tamper-evident chain, to protect the service and to account for every change.

We process personal information when it is necessary for these purposes: to provide a service you ask for, to meet a legal obligation, to protect legitimate interests (including the public interest in an accurate record of public power), or with your consent where that is the basis. The basis for each category is recorded in our data inventory and is subject to review by a South African attorney.

For account holders, the bases are:

• your account, sign-in, two-step verification and workspace: to provide the account you agreed to under the terms of use (POPIA section 11(1)(b));
• sign-in records, session activity and the audit trail: our legitimate interest in keeping accounts and the record secure (section 11(1)(f));
• a party claim, which shows your link to a political party: your consent (sections 11(1)(a) and 27(1)(a)).

• Public records are public. Nothing you submit is published until an editor has reviewed it, and contact details and identity documents never are.
• Inside Mandate SA, access follows staff roles, needs two-step verification, and is logged. Staff see only what their role requires.
• Our service providers: Vercel hosts the website and the account portal; Supabase runs the database, sign-in and file storage; Hostinger provides our business e-mail; and Cloudflare provides, where it is switched on, the automated-abuse check on forms. The website’s servers and the database are in São Paulo, Brazil, so information you give us is stored and processed outside South Africa; pages are delivered from Vercel’s network, including locations in South Africa. Any provider outside South Africa receives information only as POPIA section 72 allows, under that provider’s data-processing terms.
• We disclose information to authorities only when the law requires it, and we record each disclosure.
• We do not sell personal information and do not use advertising or tracking services.

• Submission text and files: two years from submission.
• Sealed contact details: one year from submission.
• The one-way network-address code of a submission: 30 days.
• Location for Find my ward: not kept.
• Account data (e-mail address, password hash, two-step verification factor, roles, claims and workspace content): while the account is open. After it closes, only what the audit trail needs is kept.
• Sign-in records and session activity: kept by our authentication service for as long as they are needed to protect accounts.
• Security and audit records: kept, because they are append-only by design. They contain identifiers, not the content of private submissions.
• Official records: kept as the public record, including corrections and retractions.

Automatic removal of expired submission data is not switched on yet. A submission is kept beyond its period only while it is still under review, while it is subject to a legal hold, or where an editor relied on it for a published decision (as the evidence for that decision).

Our safeguards include:

• access rules enforced inside the database for every role;
• two-step verification for all staff and account members;
• contact details sealed to a key kept offline;
• uploaded files checked and quarantined;
• separate applications for the public, the editorial team and account holders;
• a tamper-evident audit trail.

No system is perfectly secure. We do not promise that a breach can never happen. If one happens, see breaches below.

Under POPIA you may:

• ask whether we hold personal information about you, and for a copy (section 23);
• ask us to correct or delete information that is inaccurate, out of date, incomplete or unlawfully held (section 24);
• object to processing on grounds of legitimate interest (section 11(3));
• withdraw consent where consent is the basis;
• complain to the Information Regulator.

Send requests to the Information Officer, Mandate SA (Pty) Ltd, at legal@mandatesa.com, with the subject line “Privacy request”. To protect the people a record is about, we confirm your identity before we disclose or change anything, and we ask only for what we need to do so.

Some information cannot simply be deleted. An official record stays as the official source published it, with any correction shown beside it. Our audit trail is append-only by design. Where we cannot delete, we can correct, restrict or annotate. Requests about the official record itself go through corrections and disputes.

Account holders: there is no self-service account deletion yet. Ask us, and we will close the account and tell you what we have to keep and why.

If personal information has been, or we reasonably believe it has been, accessed or acquired by an unauthorised person, POPIA section 22 requires us to notify the Information Regulator and the people affected as soon as reasonably possible. We will tell you what happened, what it may mean for you and what you can do.

The public site is for everyone and collects no personal information from readers. You must be 18 or older to hold an account, and submissions are not intended for children. If we learn that an account belongs to someone younger, we close it. Where a public record names a minor, for example in an official source, we take extra care and publish only what the public role requires.

Contact us first at legal@mandatesa.com. You may also complain to the Information Regulator (South Africa) at any time; its contact details are on inforegulator.org.za.

Each version carries its date. A change that affects your rights will be explained before it takes effect, and where consent is the basis, consent will be asked for again.