Privacy Policy

1. Who we are

This platform is operated by the Eastern Cape Development Corporation (ECDC) in partnership with Mirembe Muse (Pty) Ltd, to support the 2026 Eastern Cape Export Symposium & Exhibition (“the Symposium”). Our registered address is in East London, Eastern Cape, South Africa.

For privacy enquiries, contact: platform@ecdc.co.za

2. What personal information we collect

• Account information: email address, password (hashed — never stored in plain text).
• Profile information: name, organisation, role (delegate, investor, government official).
• Meeting data: meeting requests, confirmed slots, cancellations.
• Usage data: pages visited, actions taken, timestamps — collected via server logs.
• Commitment data: if you are an authorised official, commitment entries you log including notes and evidence URLs.

3. How we use your information

• To authenticate your account and enforce role-based access control.
• To display your profile in the delegate directory (only when the directory window is open and you are listed as visible).
• To facilitate meeting scheduling between delegates.
• To generate accountability reports for the 2027 Symposium.
• To audit all actions on the commitment ledger (append-only audit log).
• To communicate platform updates via email when necessary.

4. Lawful basis for processing

We process your personal information under the following bases in terms of the Protection of Personal Information Act (POPIA), 4 of 2013:

• Contractual necessity: to provide you the platform services you have registered for.
• Legitimate interest: to maintain audit logs and accountability records for the Symposium.
• Consent: for optional directory visibility and meeting scheduling.
• Legal obligation: ECDC is a Schedule 3B public entity under the Public Finance Management Act; accountability records may be required.

5. Data sharing

We do not sell your personal information. We share data only with:

• Supabase (PostgreSQL): our cloud database provider, located in EU-Central (Frankfurt). Data Processing Agreement in place.
• Vercel: our hosting provider. Processes request metadata only.
• ECDC officials: administrators with explicit ECDC credentials may access commitment data for accountability reporting.

6. Retention

Account data is retained for the duration of the Symposium programme (2026–2027) and for three years after the 2027 Symposium for audit purposes. Commitment ledger entries are retained indefinitely as public accountability records. You may request account deletion at any time; commitment entries attributed to you as a government official cannot be deleted as they form part of the public record.

7. Your rights (POPIA)

You have the right to:

• Request access to your personal information.
• Request correction of inaccurate information.
• Request deletion of your account (where not in conflict with audit obligations).
• Object to processing for direct marketing.
• Lodge a complaint with the Information Regulator: www.justice.gov.za/inforeg.

To exercise these rights, contact: platform@ecdc.co.za

8. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Passwords are hashed using Supabase Auth (bcrypt). Row-Level Security (RLS) policies are enforced at the database layer to prevent cross-user data access. Service-role credentials are never exposed to client-side code. Audit logs are append-only and cannot be deleted.

9. Cookies

We use strictly necessary cookies for session management (Supabase Auth JWT). We do not use advertising or tracking cookies. See our Cookie Policy for details.

10. Changes to this policy

We may update this policy. Significant changes will be communicated by email or via a notice on the platform. The “Last updated” date at the top of this page reflects the most recent revision.