Privacy Policy

1. Who We Are and Our Responsibility

The Cuban Alumni Association of South Africa (CAASA) is the responsible party for personal information it processes for association activities and this website. We are committed to protecting that information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA).

This policy applies to members, applicants, website visitors and people who contact CAASA. It reflects the Executive Committee’s approved cybersecurity and personal information protection arrangements. Using the website does not, by itself, constitute consent to every form of processing.

2. Information We Collect

We collect information you provide and information needed to operate and secure your account:

• Account details: email address, account identifier and email-verification status. Passwords are handled by the sign-in service; CAASA officials do not receive your password in registration notices.
• Membership details: full name, contact number, professional regulatory body number, Cuban university, graduation year, current qualification, province and place of work, together with your CAASA membership number, registration date and status.
• Merchandise orders: name, email, contact number, selected items, sizes, quantities, order reference, delivery or collection choice, and delivery address where applicable.
• Payment administration: membership or order references and proof of payment you send to the Secretariat. Website payments are by EFT; the checkout does not request payment-card details or banking passwords.
• Correspondence and association records you provide, including existing governance records retained for legitimate administrative or legal purposes.
• Security records: account identifiers, activity type, outcome and time for recorded account actions, such as sign-ins, registrations, orders, protected document downloads and authenticator enrolment.

3. Why We Process Information

We use personal information only for specified, lawful purposes, with information limited to what is reasonably needed. Depending on the activity, processing is based on your consent, steps needed to provide membership or fulfil an order, a legal obligation, or a legitimate interest of CAASA or the person concerned, subject to POPIA.

We use account and membership details to verify and administer membership, issue CAASA numbers, provide protected member access and communicate relevant association notices. Order information is used to arrange payment reconciliation, delivery or collection. Security information is used to protect accounts, investigate misuse and support accountability. Summaries support association administration and understanding website activity.

Where consent is required, it will be requested for the specific purpose. You may withdraw that consent, without affecting lawful processing already undertaken. Declining information required for registration or an order may prevent us from providing that service. We do not treat membership as permission for unrelated marketing.

4. Access, Sharing and Official Communications

CAASA does not sell or rent personal information. Member records are not a public directory. Access must be limited to the member’s own information and authorised officials or service providers who need it for their duties. Public committee announcements are separate from private member records.

Registration and transaction notices are sent to the official Secretariat and PRO mailboxes: secretary@cubanalumni.com, held by Dr Kgoshigadi Nkokeng-Sibeko (Secretary), and info@cubanalumni.com, held by Dr Nhlakanipho Gumede (Public Relations Officer). The weekly website and membership summary is designated for these same two offices. These communications are for authorised association administration, not public circulation.

We may share the information necessary for hosting, account authentication, official email, order fulfilment or another disclosed association service. We may also disclose information where required by law or with a valid lawful basis. Officials and providers must protect information and must not use it for unrelated purposes.

5. Website Security Measures

The website’s current safeguards include the measures below. They reduce risk but cannot guarantee that every security incident will be prevented.

• Signed-in access to member information, official documents, award photographs and shop information; purchases are linked to the signed-in account.
• Restricted storage and short-lived download links for protected documents and award photographs. Members must not publish or redistribute private information without authority.
• A minimum of 12 characters for new account passwords, with screening against known compromised passwords. Use a unique password or passphrase and do not share it.
• Authenticator-based two-factor sign-in, with the mandatory commencement date described below.
• Restricted security activity logging. Activity logs are available only to authorised administrators; passwords, authenticator setup secrets and access tokens are not recorded in those logs.
• Access controls that restrict members to authorised actions and reserve management functions for authorised administrators.

6. Two-Factor Authentication and Account Recovery

The Executive Committee requires two-factor authentication for all member accounts from Friday, 23 October 2026. Authenticator setup is available now; members should complete it before that date. This is the announced commencement date, not a statement that mandatory enforcement is already active before then.

Download Microsoft Authenticator from the official Apple App Store or Google Play Store, checking that Microsoft Corporation is the publisher. Sign in to CAASA, open My Membership → Account security and select Set up two-factor sign-in. Add an Other account in Microsoft Authenticator, scan the CAASA QR code (or enter the setup key manually), then enter the app’s six-digit code on the CAASA page and select Activate two-factor sign-in. Setup is complete only when the account status shows Active.

Keep access to the authenticator for subsequent sign-ins. Never share your password, setup key, QR code or verification codes, including by email. CAASA officials will not ask you to email these secrets.

If you lose your phone or cannot access the authenticator, contact secretary@cubanalumni.com. Recovery requires identity checks and confirmation by two committee members before access is restored. Do not send identity documents or sensitive supporting records unless the Secretariat explains the necessary secure submission process.

7. Service Providers and Cross-Border Processing

The website uses Lovable Cloud for hosted website data and account services, and CAASA uses Google Workspace for its official mailboxes. Hosting, authentication and email providers may process information outside South Africa.

Where cross-border transfers occur, CAASA must ensure a permitted basis under section 72 of POPIA, including adequate protection through applicable law or binding arrangements, or another basis allowed by that section. Service-provider safeguards and written operator arrangements are part of CAASA’s continuing governance responsibilities; this policy does not certify that all provider agreements or assessments have been completed.

8. Retention and Disposal

We retain personal information only for as long as needed for the purpose for which it was collected, a lawful association requirement, or an applicable legal obligation. Relevant membership, payment, order and security records may need to be retained after membership ends where a lawful reason remains.

The Executive Committee’s detailed retention schedule remains to be finalised; this policy does not claim that fixed deletion periods or automated deletion are already in place. Information no longer lawfully required should be securely deleted, destroyed or de-identified, including through appropriate handling of provider-held copies and backups. A deletion request will be assessed against any lawful retention obligations.

9. Your POPIA Rights and How to Exercise Them

Send privacy requests to secretary@cubanalumni.com for the attention of the Information Officer, Dr Sipho Ntshalintshali. Describe the information or processing concerned and the action you are requesting. We may need proportionate identity verification before releasing or changing personal information. Never include your password or authenticator codes.

The Secretariat will handle requests with the Information Officer, subject to POPIA, other applicable law and lawful exceptions. If a request cannot be granted, we should explain the applicable reason. Any prescribed procedure or fee that applies to a formal access request will be explained. Registration details can be viewed on My Membership; requests to correct them should be sent to the Secretariat.

• Ask whether CAASA holds personal information about you and request access to it, subject to applicable access rules.
• Request correction of inaccurate or incomplete information, or deletion or destruction where the legal grounds apply.
• Object to processing on grounds permitted by POPIA and withdraw consent where consent is the processing basis.
• Object to direct marketing and ask to stop receiving optional promotional communications.
• Lodge a complaint with South Africa’s Information Regulator if you believe your personal information has been handled unlawfully. Contacting CAASA first is encouraged but is not a condition of making a complaint.

10. Cookies, Browser Storage and Website Activity

The website’s sign-in service uses browser storage and may use cookies to maintain your session. This is necessary to provide protected account access. Blocking or clearing this storage can sign you out or prevent member functions from working. Sign out when using a shared device.

Recorded account events may contribute to administrative website-usage summaries. We do not describe this essential account storage as consent to unrelated tracking. Any future non-essential tracking must be assessed and accompanied by appropriate notice and consent where required.

11. Security Incidents and Continuing Governance

Report suspected unauthorised access, disclosure or account misuse promptly to secretary@cubanalumni.com, for the Information Officer’s attention. Provide a description of the issue without sending passwords, authenticator secrets or unnecessary copies of other members’ information.

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, CAASA must assess the incident and notify the Information Regulator and affected data subjects as required by section 22 of POPIA, as soon as reasonably possible, subject to lawful exceptions or permitted delays.

The appointment of the Information Officer and website safeguards do not, on their own, establish complete POPIA compliance. Provider agreements, independent security testing, a formal retention schedule and incident-register arrangements remain committee governance work to be completed and maintained.

12. Policy Updates

This policy was updated on 18 October 2026 to reflect the new official office holders, Information Officer appointment, website security improvements and the announced two-factor requirement commencing on 23 October 2026. Material changes will be published on the website and communicated to members where appropriate.

13. Contact Information

If you have questions or concerns about this policy or wish to exercise your rights, please contact:

Cuban Alumni Association of South Africa (CAASA)
Email: secretary@cubanalumni.com
Information Officer: Dr Sipho Ntshalintshali
Address: 98 Heilbron Street, Crystal Place, Benoni, 1501, South Africa.

Secretariat: Dr Kgoshigadi Nkokeng-Sibeko — Secretary. Privacy and data-protection requests are directed to the Information Officer through this office.

General and media enquiries: Dr Nhlakanipho Gumede — Public Relations Officer, info@cubanalumni.com.

Independent complaints: Information Regulator of South Africa.