Information collected
Hashtag Family may collect contact information, identity and date-of-birth details, address and employment information, registered family and beneficiary details, payment records, claim information, and the documents supplied in support of those records. An unfinished registration temporarily stores the submitted name, email address, optional phone number, an expiring keyed verification-code hash and delivery timestamps.
The public contact form collects the sender's name, email address, optional mobile number, enquiry topic and message. An accepted enquiry is emailed to the official committee address and is not copied into the membership database. The sender's email becomes the Reply-To address so the committee can respond.
Why the information is used
The information is used to verify applicants, administer membership, allocate member numbers, maintain contribution records, identify shared dependant records, prevent duplicate requests, assess internal assistance, communicate decisions and support any authorised provider process.
When a member enters an ID or passport number already attached to another family's record, the portal compares the normalised identifier. When that optional number is not supplied, the entered full name and mandatory date of birth are used for a possible-match check. The member sees only the information they entered and never the other member's identity. Authorised committee administrators may see the affected membership names and numbers so they can review whether the overlap is legitimate.
Authorised committee administrators may create a membership record for a person who cannot use the online process. The administrator must confirm that signed membership terms and privacy consent were received. An email address and portal access are optional for this committee-entered record, and the action is retained in the audit trail.
Who can access it
Access is limited by recorded committee role. The Super Administrator controls committee accounts, roles and protected system setup. The Chairperson, Secretary, Treasurer and Committee Member see only the application, contribution, assistance, report or audit functions assigned to that office. The same checks protect direct page and document requests; hiding a menu is not treated as access control. Necessary service providers may receive limited access for hosting, communications, banking or an authorised funeral-cover process. Information should not be used for an unrelated purpose without a lawful basis or the member’s consent.
Security and retention
The portal uses verified email ownership, hashed account passwords, expiring single-use verification codes, least-privilege role access, server-side permission checks, protected document storage and activity records. Committee-role changes and denied protected requests are recorded. Raw verification codes are not stored in the database. Incorrect code attempts are limited and recorded for security. A completed verification request is removed when the profile is created; expired unfinished requests older than seven days are removed when registration requests are processed. The hosting account must use HTTPS, restricted administrator access and secure backups. Other records should be kept only for as long as required for membership administration, legal obligations and dispute handling.
General enquiries use form-expiry protection, validation, an automated-submission trap and a short resend cooldown. The form does not accept attachments and should never be used for passwords, identity documents, banking details or payment proofs. Once emailed, the committee must manage the enquiry under its normal mailbox access and retention controls.
Your choices and rights
A member may ask to access or correct personal information, object to unlawful processing, or ask how a record is being used. Some records may need to be retained where a legal, financial or dispute-related obligation applies.
Contact
Send privacy questions to info@hashtagfamily.co.za. The committee should update this address in config.php if another official contact is used.