Privacy Policy

What Personal Data We Collect

We collect the following categories of personal information:

• Contact information: Full name, email address, and phone number provided through our contact, volunteer registration, and donation forms.
• Donation details: Donation amount, frequency, transaction reference, and email address used for donation receipts and records.
• Volunteer information: Area of interest, availability, and any additional information you provide in your volunteer registration.
• Analytics data: Anonymous page view counts, session duration, country, device type, and browser information collected through privacy-respecting analytics.
• Communication records: Messages submitted through our contact form, including subject and message content.

Purpose of Collection

We process your personal information for the following purposes:

• Communication: To respond to your enquiries, provide updates about our programmes, and send confirmation emails for form submissions.
• Donation processing: To process your financial contributions, issue receipts, manage recurring donations, and comply with financial record-keeping requirements.
• Volunteer coordination: To match you with suitable volunteer opportunities and coordinate your involvement with our programmes.
• Service improvement: To understand how visitors use our website and improve our content, functionality, and user experience.
• Legal compliance: To meet our obligations under South African law, including the Non-Profit Organisations Act and tax regulations.

Legal Basis for Processing

Under POPIA, we process your personal information based on one or more of the following lawful grounds:

• Consent: Where you have voluntarily provided your information through our forms (e.g., contact form, volunteer registration, donation).
• Contractual obligation: Where processing is necessary to fulfil a transaction you have initiated, such as processing a donation or sending a receipt.
• Legitimate interest: Where processing is necessary for our legitimate organisational interests, such as improving our website and understanding visitor engagement, provided these do not override your rights.
• Legal obligation: Where we are required to retain certain records for compliance with tax, financial, or non-profit regulatory obligations.

Data Retention

We retain your personal data for no longer than 12 months after your last interaction with us, unless a longer retention period is required by law (for example, financial records may be retained for the period prescribed by the Income Tax Act).

After the retention period expires, your personal data will be securely deleted or anonymised so that it can no longer be associated with you.

Analytics data is retained for a maximum of 24 months and is collected in aggregate form that does not identify individual visitors.

Third Parties

We may share your personal information with the following trusted third-party service providers who assist us in operating our website and delivering our services:

• Paystack: Our payment gateway for processing online donations. Paystack is PCI DSS compliant and handles payment card data securely. We do not store your card details on our servers. For more information, see Paystack's Privacy Policy.
• Resend: Our email delivery service used to send confirmation emails, donation receipts, and responses to your enquiries. For more information, see Resend's Privacy Policy.
• Plausible Analytics: Our privacy-focused analytics service that collects anonymous usage data without using cookies or tracking personal information. For more information, see Plausible's Data Policy.

We do not sell, trade, or rent your personal information to any other parties. We will only disclose your information to third parties if required by law or with your explicit consent.

Cookie Policy

Our website uses cookies to enhance your browsing experience. Cookies are small text files stored on your device that help us provide and improve our services.

Categories of Cookies

• Essential cookies: These are necessary for the website to function properly. They include cookies that remember your language preference and cookie consent choice. These cannot be disabled.
• Analytics cookies: These help us understand how visitors interact with our website by collecting anonymous information. We use Plausible Analytics, which operates without cookies by default. If additional analytics features are enabled, these cookies will only be set after you give explicit consent.
• Functional cookies: These remember your preferences and choices (such as language selection) to provide a more personalised experience.

Non-essential cookies will not be set until you explicitly accept them through our cookie consent notice. You can withdraw your consent at any time through your browser settings or by clearing your cookies.

Your Rights

Under POPIA, you have the following rights regarding your personal information:

• Right of access: You may request confirmation of whether we hold personal data about you and request a copy of that data.
• Right to correction: You may request that we correct or update any inaccurate or incomplete personal information we hold about you.
• Right to deletion: You may request that we delete your personal data. Upon receiving a valid request, we will remove or anonymise your data within 30 days.
• Right to object: You may object to the processing of your personal data where we rely on legitimate interest as the legal basis.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at info@vukaazani.org.za. We will respond to your request within 30 days of receiving it.

Data Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it. These measures include:

• Encryption of data at rest using AES-256 or equivalent encryption strength.
• All data transmitted between your browser and our website is encrypted using HTTPS with TLS 1.2 or higher.
• Payment card data is processed securely by our PCI DSS compliant payment gateway (Paystack) and is never stored on our servers.
• Input validation and sanitisation to protect against common web attacks.
• Regular security reviews and updates to maintain protection standards.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and the Information Regulator within 72 hours of becoming aware of the breach, as required by POPIA. The notification will include details of the breach, the potential consequences, and the measures we are taking to address it.

Contact Us About Your Data

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

If you are not satisfied with our response to your query or complaint, you have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.