Status and scope
Version: 2026-08-25-transfers-v3 · Last reviewed: 2026-08-25. This notice supplements the Privacy Notice and Processor Schedule (2026-09-08-processors-v5).
The controller is ELHAKIM (PTY) LTD, company number 2021/622573/07, registered in South Africa. Registered office shown in the supplied CIPC company record: 50 Von Brandis Street, Marshalltown, Johannesburg CBD, Gauteng, 2000, South Africa. The home-page form shows current intake status; submitting a request creates no account and is not acceptance.
Current transfer map
- Web requests and technical data pass through the Hostinger runtime. The account-specific origin data centre and mailbox storage country have not yet been evidenced in an archivable record.
- The verified Supabase primary project region is eu-west-1 (Ireland) for Auth and PostgreSQL. Backups, logs, supporting services and subprocessors can add processing elsewhere.
- When Turnstile is enabled, Cloudflare processes technical signals through a globally distributed network for bot protection. Ahdna does not send form-field content to Turnstile.
- The private OpenAI Sites preview is not the production path and is not authorised to hold production membership data.
POPIA basis
Section 72 of South Africa's Protection of Personal Information Act (POPIA) provides specific routes for a transfer to a party in a foreign country. When Ahdna relies on a binding agreement, it must provide adequate protection with processing principles substantially similar to POPIA and similarly constrain onward transfers.
A provider's DPA or European contractual clauses do not automatically prove section 72 adequacy. For each active path, the recipient, region, data categories, purpose, party role, transfer basis and onward-transfer limits must be recorded, with evidence that the applicable agreement was accepted. General consent is not used as an automatic substitute for this assessment.
Operational safeguards
- Data minimisation and no form-field content sent to bot protection.
- Transport encryption, membership-request email encryption before storage, and separated lookup and capability keys.
- Limited permissions, consent records, scoped export and deletion, and bounded retention.
- Review of subprocessor lists and a schedule update when a provider, region or purpose changes.
- Pause or restrict request intake if a technical control fails or the processing or transfer basis is no longer valid.
Special information and section 57
A purposeful-marriage service may involve sensitive information depending on what a member chooses to provide. Before collecting any category whose foreign transfer may require prior authorisation, Ahdna must document its section 57 review and obtain Information Regulator authorisation where applicable. This notice does not authorise collection of those categories now.
Your rights and contact
You may request a description of providers, regions and the basis used, or ask for correction, object, or raise a complaint at privacy@ahdna.co. An objection does not remove applicable legal-retention duties or limited safety records.
The public form may accept requests when technical and operating readiness gates pass. Its availability does not claim that every contracting-entity, agreement-acceptance, Hostinger origin, mailbox-region or written transfer-assessment record is complete; gaps are published here and in the Processor Schedule and remain subject to evidence and review.