5. Biometric Data

Relevant legal provisions:
This section is based on POPIA Section 26, Section 27(1)(a), and Section 1.

Original legal text:
“A responsible party may, subject to sections 27 to 33, not process special personal information.” POPIA, Section 26.

“The prohibition on processing special personal information, as referred to in section 26, does not apply if—
(a) processing is carried out with the consent of a data subject;” POPIA, Section 27(1)(a).

“‘biometrics’ means a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition;” POPIA, Section 1.

Types of Voice Data Collected

We collect the following types of voice-related data:

☐ Raw audio recordings
☐ Voice notes
☐ Transcribed text
☐ Voice features, such as speaker identification or voiceprint

Purpose of Collection

Voice data is used for:

☐ Survey response collection only
☐ Transcription
☐ Data analysis
☐ Model improvement
☐ Other: [specify]

Consent Mechanism

We obtain consent through:

☐ Verbal consent at start of call
☐ Written or digital consent prior to call
☐ Opt-in mechanism

Consent is:

☐ Explicit, required for biometric data
☐ Implied

Use for AI Training

Voice or transcript data is used for training AI models:

☐ Yes
☐ No
☐ Only in anonymized or aggregated form

If yes, specify:

[free text]

Data Retention Period

Voice data is retained for:

☐ <30 days
☐ 30–90 days
☐ 3–12 months
☐ Indefinitely
☐ Other: [specify]

Third-Party Processing

Voice data is shared with:

☐ Cloud providers
☐ Speech-to-text providers
☐ AI / LLM providers
☐ None

Safeguards for Biometric Data

We protect biometric or voice-related data through:

☐ Encryption in transit
☐ Encryption at rest
☐ Access controls
☐ De-identification / anonymization
☐ Other: [specify]