Privacy Policy

1. Introduction

Buktika ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our restoration funding platform.

1.1 International Operations

We operate internationally with current focus in South Africa. We comply with UK GDPR as our primary standard (registration jurisdiction) and local data protection laws where we operate, including POPIA (South Africa), PDPA (Thailand), and other applicable regulations.

Multi-Jurisdictional Compliance: We apply UK GDPR standards as our baseline and supplement with local law requirements where we operate.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email, phone, location
Identity Verification: Government ID, proof of address (KYC/AML compliance)
Financial Information: Wallet addresses, transaction history
Land Information: Property details, GPS coordinates, photos
MamaDEX Consent: Photos, stories, testimonials (only with explicit consent)

2.2 Automatically Collected

Usage Data: IP address, browser type, device information
Cookies: Session management, preferences, analytics
Technical Data: Error logs, performance metrics

2.3 Third-Party Sources

Verification Services: Identity verification providers
Sanctions Screening: Compliance databases
Blockchain Data: Public blockchain records

2.4 Blockchain Information

Transactions on Celo blockchain are public and permanent. We cannot delete or modify blockchain records.

3. How We Use Your Information

Platform Operations: Account management, transaction processing, verification
Compliance: KYC/AML, sanctions screening, legal obligations
Communications: Service updates, programme notifications, support
Improvement: Analytics, user experience, security
MamaDEX: Community showcasing (only with explicit consent)

4. How We Share Your Information

We share information only as necessary:

Service Providers: Hosting, verification, payment processing (under strict confidentiality)
Legal Requirements: Court orders, law enforcement, regulatory compliance
Business Transfers: Mergers, acquisitions (with notice and protection)
Viridians: Aggregated, anonymised restoration data for claims
Public Blockchain: Transaction data (public by design)
Verification Partners: Programme participants for evidence validation
MamaDEX: Names, photos, stories ONLY with your explicit, withdrawable consent

MamaDEX Consent: We never share your name, photo, or personal story without your explicit permission. You can withdraw consent anytime.

5. International Data Transfers

We operate across multiple jurisdictions. Your data may be processed outside your country of residence.

5.1 Safeguards

Standard Contractual Clauses (SCCs): EU-approved data transfer mechanisms
Adequacy Decisions: Transfers to countries with adequate protection
Data Processing Agreements: Binding contracts with processors
Technical Safeguards: Encryption, access controls

5.2 Controller/Processor Roles

Buktika is the data controller. Service providers act as data processors under our instructions.

6. Data Retention

6.1 General

We retain data as long as necessary for purposes described, legal obligations, or dispute resolution.

6.2 Evidence Retention

Restoration evidence retained for seven years minimum for audit, verification, and compliance.

6.3 Blockchain Data

Blockchain transactions are permanent and cannot be deleted.

6.4 Deletion Requests

You may request deletion subject to legal retention requirements and blockchain immutability.

7. Security

We implement security measures aligned with ISO/IEC 27001 and ISO/IEC 27701 standards.

7.1 Technical Safeguards

Encryption: Data encrypted in transit (TLS) and at rest (AES-256)
Access Controls: Role-based permissions, least privilege
Multi-Factor Authentication: Required for sensitive operations
Integrity Hashes: SHA-256 cryptographic hashes for evidence
Regular Audits: Security assessments, penetration testing

No system is 100% secure. We continuously improve our security posture but cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have rights including:

Access: Request copy of your personal data
Portability: Receive data in structured, machine-readable format
Correction: Update inaccurate information
Deletion: Request deletion (subject to legal obligations)
Objection: Object to certain processing
Restriction: Request limited processing
Withdraw Consent: Revoke consent for consent-based processing

To exercise rights, email [email protected] with subject "Privacy Rights Request."

9. Legal Bases for Processing (UK/EU)

We process data under these legal bases:

Contract: Necessary for service delivery
Legal Obligation: KYC/AML, sanctions screening, tax compliance
Legitimate Interests: Fraud prevention, security, analytics
Consent: MamaDEX participation, marketing communications

10. Children's Privacy

Buktika is not intended for individuals under 18. We do not knowingly collect data from children. If we discover child data, we delete it immediately.

11. Third-Party Links

Platform may link to third-party sites. We are not responsible for their privacy practices. Review their policies before sharing information.

12. Cookies and Tracking

We use cookies and similar technologies:

Type	Purpose	Duration
Essential	Authentication, security, basic functionality	Session
Functional	Language preference, user settings	1 year
Analytics	Usage patterns, performance monitoring	2 years
Security	Fraud detection, abuse prevention	Session

12.1 Your Choices

You can control cookies through browser settings. Disabling essential cookies may affect functionality. See our Cookie Policy for full details.

13. Changes to This Policy

We may update this Policy. Material changes notified via Platform, email, or public posting with 30 days notice.

Continued use after changes constitutes acceptance. We recommend reviewing this policy periodically.

14. Contact Us

Buktika
Trading as Buktika

Privacy Inquiries: [email protected]
Subject: "Privacy Inquiry"

Website: www.buktika.com

15. Complaints and Regulatory Authorities

If unsatisfied with our response, you may lodge complaints with:

UK: Information Commissioner's Office (ICO) — ico.org.uk
South Africa: Information Regulator — inforegulator.org.za
Other: Your local data protection authority

16. Consent-Based Processing

MamaDEX: All participation is voluntary and consent-based. We never share your name, photo, or story without explicit permission. You can withdraw consent anytime without penalty.

We operate with deep respect for dignity and privacy. Your participation must always feel safe and empowering.

17. Acknowledgment

By using Buktika, you acknowledge you have read, understood, and agree to this Privacy Policy.