1. Introduction
1.1 This Privacy Policy ("Policy") explains how Thungo, operated by Aluma Holdings (Pty) Ltd ("Company," "we," "us," or "our"), collects, processes, uses, stores, and discloses personal information in connection with our platform, website, mobile applications, and related services (collectively, the "Service").
1.2 This Policy applies to every persona on the Thungo platform, namely contractors, suppliers, clients, staff (team members), and independent workers, as well as any customer whose information is processed through the platform on a contractor’s or independent worker’s behalf. It should be read together with our Terms & Conditions.
1.3 This Policy is governed by the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and other applicable South African data protection and privacy laws.
2. Definitions and key concepts
2.1 "Personal Information" means any information relating to an identified natural person, or a natural person who is identifiable from one or more pieces of information, including but not limited to names, contact details, ID numbers, financial information, location data, and behavioral data.
2.2 "Data Subject" means any natural person to whom personal information relates.
2.3 "Responsible Party" (or "Data Controller") means Aluma Holdings (Pty) Ltd, which determines the purposes and means of processing personal information.
2.4 "Data Processor" means any person who processes personal information on behalf of the Responsible Party (e.g., payment processors, cloud providers, email service providers).
2.5 "Processing" means any operation performed on personal information, including collection, recording, organization, structuring, storage, retrieval, usage, transmission, and erasure.
3. Personal information collected
3.1 Information you directly provide, depending on your persona:
- Account registration (all personas): name, email address, phone number, business name, business registration number, VAT number (if applicable), physical address
- Contractor business profile: trade qualifications, licenses, certifications, insurance details, banking information for payment processing
- Supplier profile: company name, product catalog, pricing lists, delivery areas, warehouse or branch locations, and banking information for settlement
- Independent worker profile: trade skills, certifications, availability, KYC verification documents, portfolio items, and banking information for payment processing
- Client profile: name, contact details, billing address, and project or service preferences
- Workforce and staff data: team member names, phone numbers, email addresses, daily rates, work history, and performance notes
- Customer information: customer names, contact details (email, phone, physical address), project locations, service requirements, and communication history
- Quote and invoice data: project descriptions, materials, pricing, itemized services, and site/location information
- Payment information: banking details, credit card numbers (processed by third-party Payment Processors), payment transaction history
- Communication data: messages, emails, WhatsApp conversations, and support tickets exchanged through Thungo
3.2 Information automatically collected:
- Device and browser information: device type, operating system, browser type, IP address, device identifiers
- Usage data: pages accessed, features used, time spent on platform, clicks, scroll behavior, feature interaction patterns
- Location data: approximate location derived from IP address; precise location only if you explicitly enable location services
- Cookies and tracking: necessary cookies and similar storage listed in Section 10 (including Tawk.to live chat); Google Analytics cookies only after you accept or save that preference
- Performance data: system performance metrics, error logs, crash reports, and diagnostic data
3.3 Information from third parties:
- Payment Processors: transaction data, payment status, chargeback information (PayShap, PayFast, Paystack, Ozow, Stitch)
- Supplier integrations: product pricing, availability, supplier information, and catalog data
- WhatsApp Meta Cloud API: message delivery status, timestamps, and metadata from WhatsApp communications
- Email service providers: email delivery and engagement data (open rates, click-through rates)
4. Purposes of processing personal information
4.1 Thungo processes your personal information for the following lawful purposes:
- Service delivery: providing, maintaining, and improving Thungo features and functionality
- Account management: creating and managing your account, verifying identity, and authenticating users
- Payment processing: facilitating transactions, processing payments, managing invoicing, and handling payment disputes
- Smart Assistant Agent: powering AI-driven customer communication, automated email drafting, appointment booking, and follow-up messages
- WhatsApp integration: sending appointment confirmations, service notifications, and follow-up messages to customers
- Supplier integrations: sourcing product pricing and availability data to populate quote calculators
- Analytics and reporting: generating usage analytics, business reports, and performance metrics
- Compliance and legal obligations: complying with tax laws (SARS), payment regulations, and legal requests
- Security: detecting fraud, preventing abuse, securing accounts, and protecting against unauthorized access
- Customer support: providing technical and customer support, troubleshooting, and resolving issues
- Marketing (with consent): sending promotional emails, platform updates, feature announcements, and educational content
- Research and development: improving algorithms, calculators, and user experience through analytics
4.2 Thungo will not process personal information for purposes other than those listed above without first obtaining your explicit consent, except where required or permitted by South African law.
5. Legal basis for processing (POPIA compliance)
5.1 Under POPIA Section 11, Thungo processes personal information based on the following lawful bases:
- Consent: you explicitly consent to processing (e.g., opt-in to marketing communications)
- Contract performance: processing is necessary to perform our contractual obligations to you (e.g., billing, service delivery)
- Legal obligation: we are required by law to process personal information (e.g., tax compliance, payment regulations)
- Legitimate interest: processing serves our legitimate business interests (e.g., fraud prevention, security, business analytics)
5.2 We balance our legitimate interests against your privacy rights and will only process data where the benefit outweighs potential harm.
7. Data retention and deletion
7.1 Thungo retains personal information for as long as necessary to fulfill the purposes outlined in this Policy, comply with legal obligations, and resolve disputes.
7.2 Retention periods by data category:
- Active user accounts: retained for the duration of account activity plus 7 years (tax compliance with SARS)
- Deleted accounts: personal data retained for 90 days to allow recovery, then permanently deleted
- Payment records: retained for 7 years for tax and regulatory compliance
- Invoices and quotes: retained for 7 years or as required by tax regulations
- Communication records: retained for 2 years unless subject to legal hold
- Usage analytics: aggregated data retained indefinitely; identifiable data deleted after 12 months
7.3 You may request deletion of your personal information at any time (subject to legal retention requirements) by contacting privacy@thungo.app.
8. Data security and protection measures
8.1 Thungo implements industry-standard security measures to protect personal information from unauthorized access, disclosure, alteration, and destruction:
- Encryption: data in transit is encrypted using TLS 1.3; sensitive data at rest is encrypted using AES-256
- Access controls: role-based access controls limit data access to authorized personnel only
- Authentication: multi-factor authentication (MFA) available for account protection
- Payment card compliance: all payment processing complies with PCI-DSS standards; credit card numbers are tokenized by Payment Processors
- Regular audits: security audits and vulnerability assessments conducted regularly
- Incident response: documented procedures for responding to data breaches within 24-48 hours
8.2 While we implement robust security measures, no system is completely secure. You are responsible for protecting your account credentials.
8.3 In the event of a data breach affecting personal information, Thungo will notify affected individuals and relevant authorities as required by POPIA within 30 days of discovery.
9. Your rights as a data subject
9.1 Under POPIA, you have the following rights:
- Right of access: you may request access to your personal information held by Thungo
- Right to correction: you may request correction of inaccurate or incomplete information
- Right to deletion: you may request deletion of your personal information (subject to legal retention obligations)
- Right to object: you may object to processing of your personal information for specific purposes
- Right to restrict processing: you may request restriction of processing in certain circumstances
- Right to data portability: you may request a copy of your personal information in a portable format
- Right to withdraw consent: you may withdraw consent to processing at any time
9.2 To exercise these rights, submit a request to privacy@thungo.app with your account details and specific request. Thungo will respond within 20 business days as required by POPIA Section 24.
11. Third-party services and data processors
11.1 Thungo integrates with third-party services, each with their own privacy policies:
- Payment Processors (PayShap, PayFast, Paystack, Ozow, Stitch): see their respective privacy policies for payment data handling
- Email providers (ZeptoMail, Resend, SES, Postmark): see their privacy policies for email data handling
- WhatsApp (Meta): see Meta’s privacy policy for WhatsApp data handling
- Cloud providers (Cloudflare, PostgreSQL): see their privacy policies for infrastructure data handling
- Google Analytics / Google Tag Manager (Google LLC): usage measurement on the marketing site after you consent; see Google’s privacy policy
- Sentry (Functional Software, Inc.): error and crash diagnostics; see Sentry’s privacy policy
- Tawk.to: live chat support on the marketing site and contractor console; see Tawk.to’s privacy policy
11.2 Thungo is not responsible for the privacy practices of third parties. We recommend reviewing their privacy policies independently.
11.3 All third-party data processors are contractually bound to process personal information only on Thungo’s instructions and in compliance with POPIA.
12. Customer data processed on your behalf
12.1 When you create quotes, invoices, or store customer information in Thungo, you act as the Data Controller (or Responsible Party) and Thungo acts as your Data Processor.
12.2 You are responsible for:
- Obtaining customer consent before collecting personal information
- Ensuring customer information is accurate and lawfully obtained
- Complying with POPIA Section 11 principles when collecting customer data
- Processing customer data only for lawful purposes
- Honoring customer data subject rights (access, correction, deletion)
12.3 Thungo provides a Data Processing Agreement (DPA) available upon request to formalize the data processor relationship.
13. International data transfers
13.1 Thungo operates primarily in South Africa. However, some personal information may be transferred to international cloud service providers (for example Cloudflare, Google LLC for Analytics after consent, Sentry, and Tawk.to for live chat) for storage and processing.
13.2 All international transfers are protected by:
- Standard contractual clauses or data processing agreements
- Encryption of data in transit and at rest
- POPIA Section 72 compliance measures
13.3 We ensure international recipients provide an adequate level of protection equivalent to South African standards.
14. Children’s privacy
14.1 Thungo is not designed for children under 18 years old. We do not knowingly collect personal information from children.
14.2 If we become aware that a child has provided personal information, we will delete such information and notify the parent/guardian.
15. Direct marketing and communications
15.1 Thungo may send you marketing communications, platform updates, and feature announcements via email only if you have consented.
15.2 You can opt out of marketing communications at any time by:
- Clicking the "Unsubscribe" link in any marketing email
- Updating your communication preferences in your Thungo account settings
- Contacting privacy@thungo.app with an opt-out request
15.3 Transactional communications (invoices, payment confirmations, support updates) will continue even if you opt out of marketing.
16. Changes to this privacy policy
16.1 Thungo may update this Policy at any time to reflect changes in practices, technology, legal requirements, or other factors.
16.2 Material changes will be communicated via email at least 30 days in advance. Your continued use of Thungo following notification constitutes acceptance of the updated Policy.
17. Contact information and data subject requests
For privacy-related questions or to exercise your data subject rights, contact:
- Thungo Privacy Officer
- Email: privacy@thungo.app
- Address: Johannesburg, South Africa
- Company: Aluma Holdings (Pty) Ltd
You can reach the privacy team directly at privacy@thungo.app.
17.1 If you have complaints about Thungo’s privacy practices, you may lodge a complaint with the Information Regulator (South Africa’s POPIA enforcement authority):
- Information Regulator of South Africa
- Website: www.inforegulator.org.za
- Email: complaints@inforegulator.org.za
© 2026 Aluma Holdings (Pty) Ltd. All rights reserved.