Effective date: 15 June 2025 · Organisation: Project Potential South Africa NPC (2022/436126/08)
1. Introduction
Project Potential South Africa NPC(“Project Potential”, “we”, “us” or “our”) is committed to protecting the privacy and personal information of everyone who interacts with us. This Privacy Policy explains how we collect, use, disclose and safeguard your personal information when you visit our website or use our services.
This policy is governed by the Protection of Personal Information Act, 4 of 2013 (POPIA) of the Republic of South Africa. By using our website or submitting your information to us, you acknowledge that you have read and understood this policy.
2. Information We Collect
2.1 Information you provide directly
- Contact form — full name, email address, and your relationship to our organisation (e.g. young person, employer, donor, volunteer).
- Newsletter subscription — email address.
- Donation form — full name, email address, and payment details processed securely through our payment provider.
- Partnership enquiries — organisation name, contact name, and email address.
2.2 Information collected automatically
- IP address and approximate geographic location.
- Browser type, operating system, and device information.
- Pages visited, time spent on pages, and referring URLs.
- Cookies and similar tracking technologies (see Section 8).
2.3 Information from third parties
We may receive information about you from social media platforms (Instagram, LinkedIn, Facebook) if you interact with our pages on those platforms, subject to their respective privacy policies.
3. How We Use Your Information
We use the information we collect to:
- Respond to enquiries and communicate with you about our programmes and initiatives.
- Process and acknowledge donations and issue tax certificates where applicable.
- Send newsletters and programme updates to subscribers who have opted in.
- Administer partnership and volunteer relationships.
- Improve our website, content and services.
- Comply with legal and regulatory obligations.
- Protect the security and integrity of our systems.
4. Legal Basis for Processing
Under POPIA, we process your personal information on the following grounds:
- Consent — when you submit a contact form, subscribe to our newsletter, or make a donation, you consent to us processing your information for the stated purpose.
- Legitimate interest — to operate our non-profit activities, improve our services, and maintain the security of our systems.
- Legal obligation — to comply with applicable South African law, including tax and financial reporting requirements.
- Contractual necessity — to process donations and fulfil any commitments made to donors or partners.
5. Sharing Your Information
We do not sell, rent or trade your personal information. We may share it only in the following circumstances:
- Service providers — trusted third-party vendors who assist us in operating our website and services (e.g. payment processors, email delivery services, cloud hosting), bound by confidentiality agreements.
- Legal requirements — where required by South African law, court order, or a competent regulatory authority.
- Protection of rights — where necessary to protect the rights, property or safety of Project Potential, our beneficiaries, or the public.
- Organisational transfers — in the unlikely event of a merger, acquisition or dissolution of the organisation, your information may be transferred to a successor entity that is committed to equivalent privacy protections.
6. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law:
- Contact enquiries — up to 3 years after last contact.
- Donation records — up to 5 years to comply with financial and tax obligations.
- Newsletter subscriptions — until you unsubscribe, plus a reasonable suppression period.
- Website analytics — aggregated data retained for up to 26 months.
Once the retention period expires, we securely delete or anonymise your information.
7. Your Rights Under POPIA
You have the following rights regarding your personal information:
- Right to access — request a copy of the personal information we hold about you.
- Right to correction — request that we correct inaccurate or incomplete information.
- Right to deletion — request that we delete your information where there is no lawful ground for continued processing.
- Right to object — object to processing based on legitimate interest or for direct marketing purposes.
- Right to withdraw consent — withdraw your consent at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint — submit a complaint to the Information Regulator of South Africa at www.inforegulator.org.za if you believe your rights have been infringed.
To exercise any of these rights, please contact our Information Officer (see Section 11).
8. Cookies and Tracking Technologies
Our website may use cookies and similar technologies to enhance your browsing experience:
- Essential cookies — required for the website to function correctly.
- Analytics cookies — help us understand how visitors use our site (e.g. pages visited, traffic sources). These may be provided by third-party analytics services.
- Preference cookies — remember your settings and choices.
You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.
9. Children's Privacy
Our website is not directed at children under the age of 18. We do not knowingly collect personal information from minors without verifiable parental consent. If you believe a child has provided us with personal information without appropriate consent, please contact us immediately and we will take steps to delete such information.
Where Project Potential works directly with young people under 18 through its programmes, separate consent processes are followed in compliance with POPIA and applicable child protection legislation.
10. Security
We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, accidental loss, disclosure, or destruction. These include:
- Secure HTTPS encryption for all data transmitted through our website.
- Access controls limiting who within our organisation can access personal information.
- Third-party payment processors that are PCI-DSS compliant for donation processing.
No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security and encourage you to use strong passwords and protect your own devices.
11. International Transfers
Some of our service providers may process personal information outside South Africa. Where this occurs, we ensure that appropriate safeguards are in place in accordance with Section 72 of POPIA, including confirming that the recipient country provides an adequate level of protection, or that adequate contractual protections are in place.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or operational needs. The updated policy will be posted on this page with a revised effective date. We encourage you to review this page periodically. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.
13. Contact & Information Officer
For any questions, requests or complaints regarding this Privacy Policy or the handling of your personal information, please contact our designated Information Officer:
We will respond to all requests within 30 days of receipt in accordance with POPIA.