Privacy Policy
1. INTRODUCTION
1.1 We, [ uMkhuze Honorary Officers ] (“we”, “us” or “our”), are the responsible party for the personal information described in this policy and are committed to protecting your privacy and processing your personal information lawfully under POPIA.
1.2 This policy applies to personal information we collect through our website at [ www.umkhuzeho.org.za ] (the “Website”), our services, and our dealings with you. It should be read together with our Website Terms of Use at [www.umkhuzeho.org.za].
1.3 In this policy, “personal information”, “processing”, “data subject”, “responsible party” and “operator” have the meanings given to them in POPIA.
2. WHAT WE TELL YOU WHEN WE COLLECT YOUR INFORMATION (POPIA section 18)
2.1 When we collect your personal information, POPIA requires us to make you aware of the following, which (together with the details on the first page) we set out here:
(a) the information we collect and, where we do not collect it from you, its source;
(b) our name and address, as the responsible party (see the first page);
(c) the purpose for which we collect the information (see clause 4);
(d) whether providing the information is voluntary or mandatory;
(e) the consequences of not providing it (for example, that we may be unable to provide a service);
(f) any law that requires or authorises the collection, where applicable;
(g) whether we intend to transfer the information to another country and the protection it has there (see clause 8); and
(h) your rights — including the right to access and correct your information, to object to processing under section 11(3), and to complain to the Information Regulator (see clauses 6 and 10).
3. INFORMATION WE COLLECT
3.1 Information that does not identify you. When you visit the Website, we collect technical information such as your IP address, operating system, browser type and internet service provider. On its own this does not identify you personally.
3.2 Personal information you give us. We collect and process the personal information you provide, including when you:
(a) fill in forms on the Website, register, or subscribe to our services;
(b) report a problem or correspond with us;
(c) complete a survey for research purposes;
(d) carry out a transaction with us; and
(e) use the Website (including traffic, location and log data and the resources you access).
3.3 We use third-party providers — for example a payment provider and analytics providers — who may process some of this information on our behalf or collect technical information through the Website.
3.4 Special personal information and children. We do not seek to collect special personal information (such as health, religion or biometric data) or the personal information of children unless the law allows it and, where required, we have consent. If you believe a child has given us personal information, please contact our Information Officer so we can delete it.
4. HOW AND WHY WE USE YOUR INFORMATION
4.1 We use your personal information to:
(a) provide the Website, our services and the content you request, and present them effectively;
(b) carry out our contract with you and respond to your queries;
(c) create and manage your account and provide customer support;
(d) send you service-related notices and, where you have consented or the law allows, marketing;
(e) generate aggregated, de-identified statistics and improve our services; and
(f) comply with our legal obligations and protect our rights.
4.2 Lawful basis. We process personal information only where POPIA allows it — that is, where you have consented; where it is necessary to conclude or perform a contract with you; where it is required by law; to protect your legitimate interests; or for our (or a third party’s) legitimate interests in a way that does not override your rights.
5. OUR COMMITMENT — THE EIGHT POPIA CONDITIONS
5.1 We process personal information in line with the eight conditions for lawful processing in POPIA:
(a) Accountability — we take responsibility for complying with POPIA;
(b) Processing limitation — we process information lawfully, minimally, and with your consent or another lawful basis;
(c) Purpose specification — we collect it for a specific, defined purpose;
(d) Further-processing limitation — we use it only for purposes compatible with that original purpose;
(e) Information quality — we take reasonable steps to keep it accurate and up to date;
(f) Openness — we are transparent, through this policy, about what we do;
(g) Security safeguards — we apply reasonable technical and organisational measures to protect it (clause 7); and
(h) Data-subject participation — we honour your rights to access and correct your information (clause 6).
6. YOUR RIGHTS (POPIA sections 23–25 and 11)
6.1 Subject to POPIA, you have the right to:
(a) ask us to confirm, free of charge, whether we hold personal information about you, and to request a copy or description of it (section 23);
(b) ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
(c) object, on reasonable grounds, to the processing of your personal information (section 11(3));
(d) withdraw any consent you have given, without affecting processing that already took place; and
(e) lodge a complaint with the Information Regulator (clause 10).
6.2 To exercise these rights, contact our Information Officer (see the first page). Access requests are dealt with under the Promotion of Access to Information Act 2 of 2000 (PAIA) and may require the prescribed form and proof of identity.
7. STORAGE, SECURITY AND RETENTION
7.1 We take reasonable technical and organisational measures to protect your personal information against loss, damage and unauthorised access. We do not store your full card details; card payments are processed by our third-party payment provider using secure (SSL/TLS) technology.
7.2 The transmission of information over the internet is not completely secure. While we use reasonable measures to protect your information, we cannot guarantee its security, and any transmission is at your own risk. If you have a password for the Website, please keep it confidential.
7.3 We keep personal information only for as long as is necessary for the purposes described in this policy, or as required by law, after which we securely delete or de-identify it.
7.4 If we become aware of a security compromise affecting your personal information, we will notify the Information Regulator and you as required by section 22 of POPIA.
8. COOKIES AND SIMILAR TECHNOLOGIES
8.1 We use cookies (small text files stored on your device) to manage your sessions, remember your preferences, speed up searches, recognise you on return, and understand how the Website is used.
8.2 Some cookies may be set by third-party providers. We do not control third-party cookies, and this policy covers only cookies set by us.
8.3 You can set your browser to refuse cookies, but some features of the Website may then not work properly.
9. WHEN WE SHARE YOUR INFORMATION
9.1 We may share your personal information with operators who process it on our behalf (such as hosting, payment and analytics providers) under written agreements that require them to protect it and process it only on our instructions.
9.2 We may disclose personal information where the law requires it — for example to comply with a court order, subpoena or lawful request — or where reasonably necessary to enforce our terms, protect our rights, or protect the safety of any person.
9.3 The Website may link to third-party websites that have their own privacy policies. We are not responsible for those websites, and we recommend you review their policies.
9.4 If our business (or substantially all of its assets) is sold or merged, your personal information may be transferred to the acquiring party, who will be required to handle it in accordance with POPIA.
10. CROSS-BORDER TRANSFERS, DIRECT MARKETING AND CONTACT
10.1 Cross-border transfers (POPIA section 72). Sometimes your personal information is stored or processed outside South Africa (for example by a cloud provider abroad). We do this only where section 72 of POPIA allows it — that is, where one of the following applies:
(a) the recipient is subject to a law, binding corporate rules or a binding agreement that gives your information an adequate level of protection;
(b) you have consented to the transfer;
(c) the transfer is necessary to perform our contract with you; or
(d) the transfer is for your benefit and it is not reasonably practical to get your consent.
10.2 Direct marketing (POPIA section 69). We will only send you electronic direct marketing where you have consented, or where you are an existing customer whose details we obtained in the context of a sale, in respect of our own similar products or services. You may opt out of marketing at any time, free of charge, using the unsubscribe mechanism or by contacting our Information Officer.
10.3 Information Regulator. You have the right to complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — POPIAComplaints@inforegulator.org.za.
10.4 Changes and contact. We may update this policy from time to time and will publish any material change on the Website. If you have any questions about this policy or how we handle your personal information, contact our Information Officer at [ webmaster@umkhuzeho.org.za ] with “Privacy Policy” in the subject line.