Privacy and cookie notice
Last updated 2 November 2026.
Matrimonial profiles include some of the most sensitive information a person can share. This notice explains what we collect, why, who can see it, how long we keep it, and your rights under the Protection of Personal Information Act (POPIA).
Who is responsible
Nikkah is operated by Raazfar Digital, a sole proprietorship in South Africa, which is the responsible party for your personal information. Our information officer is the owner of Raazfar Digital, who you can reach at info@nikkah.co.za.
What we collect
- Account details: name, email address, password (stored only as a secure hash), optional phone number, account type, and for matchmakers, their area, experience and an optional reference.
- Profile answers: the answers in the profile form, partner preferences and privacy choices.
- Special personal information (POPIA section 26), which we handle with extra care:
- religious beliefs: self-described religious orientation;
- race or ethnic origin: community background (optional, and “prefer not to disclose” is always available);
- health: the optional health disclosure and medical screening answer;
- biometric information: the face and full-length verification photographs, used only to compare with the identity document.
- Identity information: the ID or passport number and the identity document, used only for verification.
- Information about children: only the number of the applicant’s children and general notes on living arrangements. Please don’t include children’s names or photographs.
- Activity: introductions, messages within introductions, shortlists, blocks, reports, consent records, and moderation decisions.
- Technical information: our hosting provider processes your IP address and browser details to deliver pages and protect the site. We keep only a one-way scrambled version of IP addresses, for rate limiting and security.
Why we use it, and on what basis
We use personal information only to run Nikkah: to verify applicants, show profiles to approved members, handle introductions, keep members safe, respond to requests and meet legal obligations. We process special personal information only with your explicit consent (POPIA section 27(1)(a)), which we record separately from your acceptance of the terms, with your name and the date. We don’t sell information, show advertising, build marketing profiles, or use analytics or tracking tools.
When a family representative or matchmaker submits a profile, they confirm the applicant’s permission. The applicant can link their own account to confirm the profile themselves, and can withdraw permission at any time.
Who can see what
| Information | Who can see it |
|---|---|
| First name, surname initial (or as you choose), age, city, province, and profile answers you haven’t kept for a match | Approved members who are logged in, and moderators |
| Profile answers you chose to show only after a match | The other side of an introduction you’ve accepted, and moderators |
| Photographs | As you choose: approved members, nobody, or only someone whose introduction you’ve accepted. Always moderators. |
| Full surname, ID number, date of birth, contact details | Moderators only (contact details: also the other side of an accepted introduction) |
| Health disclosure and medical screening answer (optional) | As you choose: approved members who are logged in, or only the other side of an introduction you’ve accepted. Never used in search. Moderators can see it when needed, and every view is logged. |
| Identity document and verification photographs | Authorised moderators only. Never members. |
| Messages within an introduction | Both sides (including the people managing each profile), and moderators when investigating a report |
Profiles are never visible on the open internet, and we take technical steps to stop search engines indexing them. ID numbers, medical details, contact details and documents never appear in profile pages, search results or web addresses.
Who we share it with
We don’t share personal information with anyone outside Nikkah except:
- Service providers (operators) who store and process it for us under contract: Cloudflare (hosting, database and encrypted file storage) and, once enabled, an email delivery service for account emails. Their servers may be outside South Africa; we use providers that protect information to a standard similar to POPIA (section 72).
- When the law requires it, for example a valid court order, or to protect someone’s safety.
How we protect it
- Identity documents, verification photographs, profile photographs, ID numbers and health disclosures are encrypted before they’re stored.
- Only authorised moderators can see private information, and every time they open a verification file, ID number, health disclosure, contact details or an introduction, it’s recorded in an audit log that can’t be edited.
- All connections are encrypted (HTTPS). Passwords are stored only as secure hashes.
How long we keep it
| Information | How long |
|---|---|
| Identity document and verification photographs | Deleted automatically 30 days after the verification decision, or straight away if the profile is deleted. We keep a record that verification took place. |
| Profile answers, photographs, ID number and health disclosure | While the profile exists. Deleted when you delete the profile or your account, or when we remove a profile at the applicant’s request. |
| Messages within introductions | Deleted with the profile, unless they’re part of an open report. |
| Reports and case notes | Kept to keep members safe and handle appeals, then deleted automatically 5 years after the case is closed. |
| Moderation decisions and appeals | Deleted automatically 5 years after the decision. |
| Consent records | Kept as proof of consent, then deleted automatically 5 years after the profile or account is deleted. |
| Audit log (who accessed or changed what) | Deleted automatically after 5 years. |
| Account details after you delete your account | Removed straight away; the account is replaced by an anonymous placeholder. |
Your rights
You may ask to see the information we hold about you (you can download most of it from Account & privacy), correct it, delete it, object to its use, or withdraw consent at any time. Withdrawing consent hides the profile straight away. To use these rights, sign in or email info@nikkah.co.za. If you’re the subject of a profile you don’t have an account for, use the withdrawal form.
If you’re unhappy with how we handle your information, please tell us first. You may also complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
If something goes wrong
If we have reason to believe personal information has been accessed without authorisation, we’ll contain it, notify the Information Regulator and the members affected as soon as reasonably possible (POPIA section 22), and tell you what happened and what you can do.
Cookies and storage
We use one essential cookie, nk_session, which keeps you signed in. It expires after 14 days or when you sign out. Your browser may also remember which profile you last browsed for (stored on your device only). Cloudflare’s “I am human” check on sign-in and sign-up forms may set a short-lived security cookie. We don’t use advertising, analytics or tracking cookies, so there’s no cookie banner.
Changes
If we change this notice in a way that affects how your information is used, we’ll tell you when you next sign in.