1. Who we are
Burial Desk is run by 2K Systems (Pty) Ltd, registration number 2026/236420/07, 180 Katherine Street, Sandton, Gauteng, 2148, South Africa ("Burial Desk", "we", "us"). Our Information Officer can be reached at privacy@burialdesk.co.za.
This policy covers the Burial Desk app, web app and website, and the personal information of the people who use them: administrators and office-bearers, members of burial societies, policyholders and applicants of funeral policy companies, and the family members and beneficiaries they record.
2. Our role, and your organisation's
Burial societies and funeral policy companies use Burial Desk to keep their records. For those records, the society or company is the responsible party under the Protection of Personal Information Act (POPIA): it decides what it collects about its members and policyholders and why. Burial Desk is its operator, and processes that information on its instructions, only to provide the service (section 5 of our terms of service).
Burial Desk is the responsible party for your sign-in account, for the records we keep to run and secure the platform, and for enquiries made through this website. Where a request concerns an organisation's records, we may pass it to that organisation, which decides on it.
3. Information we collect
- Your account: name, email address, phone number and password (stored only as a one-way hash by our sign-in provider). Burial Desk staff also register an authenticator app.
- Membership and cover: ID number, date of birth and address; the organisations you belong to and your role; for funeral policy companies, policyholders and applicants, their policies, premiums and covered lives, including children.
- Money: contributions, fines, premiums and payment records; bank details and debit-order authorisations you give; payments made online through PayFast, where an organisation switches them on.
- Beneficiaries and payout nominees you name: names, relationships, ID numbers, contact numbers and, for payouts, bank details.
- Claims: claims and their decisions, death certificates, identity and other claim documents, and payout details.
- Documents uploaded to the platform, such as identity documents, proof of address and proof of payment.
- Messages: notifications, emails and push messages sent through the platform, support conversations, and enquiries made on this website.
- Security and error records: sign-in events (when, from which app platform, into which organisation), and error reports from the app (the error, the screen, the device platform and app version, linked to your account and organisation, kept for 90 days).
We do not use advertising trackers or analytics services, and we do not sell personal information.
4. How we use it
- To provide the platform, and let organisations keep their records and run their society or policy book.
- To send the messages the platform or an organisation sends: statements, receipts, reminders, meeting and claim notices.
- To process online payments through PayFast, where an organisation has switched them on.
- To keep the platform secure, investigate misuse and fix errors.
- To answer support requests and website enquiries.
- To bill the organisations that subscribe to Burial Desk.
- To meet our obligations under South African law.
5. Who can see it
Who may read or change each record is enforced in the database itself (row-level security), not only hidden in the app.
- Members see their own records and, in a burial society, the society's contributions unless an administrator turns that off for their role.
- Office-bearers, agents and administrators see what their role allows.
- A funeral company that provides a burial society's group cover sees that society's member roster and beneficiaries while the scheme is in force.
- Authorised Burial Desk staff can access records to support and secure the service. Staff sign in to the staff console with a password and an authenticator code.
6. Service providers, and where the information is kept
We use these providers, under their data processing terms:
- Supabase: the database, sign-in and file storage. Our database is hosted in Frankfurt, Germany.
- Google Firebase: delivering push notifications, and hosting the web app.
- Resend: delivering email.
- PayFast: online payments, in South Africa, where an organisation switches them on.
Because some of these providers operate outside South Africa, including in the European Union and the United States, personal information is transferred across borders. We use them because they are bound to protect it, and the European Union's data protection law gives protection comparable to POPIA.
7. How long we keep it
We keep personal information while the organisation it belongs to uses Burial Desk, and only as long as it is needed for that purpose. App error reports are deleted after 90 days.
If you delete your account, we delete or anonymise your information as described on our data deletion page. Some records stay with the organisation that holds them because the law requires it, such as a funeral policy company's records of a policy. When an organisation's subscription ends, we keep its records for 90 days so that it can return or ask for a copy, and after that delete them when its owner asks us to, except records that must be kept by law. We keep a record of each data request and how we handled it.
8. Your rights
Under POPIA you may ask to see the personal information held about you, have it corrected, have it deleted, or object to how it is used, and you may complain to the Information Regulator.
- To delete your account, use Profile, then Delete my account in the app, or the form on our data deletion page.
- For anything else, write to privacy@burialdesk.co.za. We reply within 30 days.
Where a request concerns an organisation's records about you, you can also ask the organisation directly, as the responsible party.
9. Children
Children do not hold Burial Desk accounts. A parent or guardian who is a member or policyholder may record children as covered lives or beneficiaries; this information is processed only for that organisation's cover and claims, on the adult's authority.
10. Security
Information is encrypted in transit and at rest, access is limited by role in the database, and staff access needs an authenticator code. No system is perfectly secure. If a security compromise affects personal information, we will tell the organisation responsible for it and, where the law requires, the Information Regulator and the people affected.
11. Changes to this policy
We will tell you about material changes in the app or by email, and show the date of the latest version at the top of this page.
12. Contact us
- Information Officer: privacy@burialdesk.co.za
- General: hello@burialdesk.co.za
- Post: 2K Systems (Pty) Ltd, 180 Katherine Street, Sandton, Gauteng, 2148