Privacy Policy

Heartshine NPC is committed to protecting the personal information of all individuals we interact with, including staff, community champions, donors, partners, and programme participants.

This policy explains how we collect, use, store, and protect personal information in line with the Protection of Personal Information Act (POPIA), Act 4 of 2013.

We may collect and store the following types of personal information:

● Names and contact details (email, phone number, address)

● Identity or demographic information where necessary

● Employment or volunteer information (for staff and champions)

● Programme participation records (attendance, engagement data)

● Donor and partner information related to funding and communication

● Photos and media captured during programmes or events (with awareness and consent where required)

We only collect personal information when it is necessary for:

● Running and managing our programmes

● Communicating with staff, champions, donors, and partners

● Reporting to funders and stakeholders

● Monitoring and improving programme impact

● Complying with legal and organisational requirements

We do not collect more information than we need.

We process personal information on one or more of the following legal bases: consent, the performance of a contract or obligation, compliance with a legal requirement, or our legitimate organisational interests in delivering our programmes and protecting the children and communities we serve.

Because our work involves children and young people, we take special care when processing their personal information. In line with Section 35 of POPIA, we will not process the personal information of a child (anyone under the age of 18) without the prior consent of a parent or legal guardian, unless otherwise permitted by law.

Where we collect information about children – including attendance records, photos, or programme participation data – this information is handled with heightened care and shared only where strictly necessary.

POPIA affords additional protection to certain sensitive categories of personal information, including health and medical information, racial or ethnic origin, and information relating to the physical or mental wellbeing of individuals. Given the nature of our work with vulnerable young people, we may occasionally come into contact with such information.

Where this occurs, we apply heightened safeguards. We only process special personal information where we have explicit consent, or as otherwise permitted by law, and only to the minimum extent necessary for our programmes.

Personal information is used only for legitimate organisational purposes.

We may share information with:

● Staff and authorised volunteers (on a need-to-know basis)

● Service providers who support our operations (e.g. email platforms, accounting systems)

● Funders (where reporting is required, and where personal data is relevant and permitted by law)

We do not sell personal information or use it for unrelated purposes.

We take reasonable and appropriate steps to protect personal information from loss, misuse, unauthorised access, or disclosure.

This includes:

● Password-protected systems and accounts

● Restricted access to sensitive information

● Secure storage of digital records

● Careful handling of physical documents where applicable

Some of the digital tools and platforms we use (such as email, cloud storage, or accounting software) may be hosted on servers outside South Africa. Where this is the case, we take reasonable steps to ensure that those providers offer an adequate level of protection for personal information, consistent with POPIA.

We only keep personal information for as long as it is needed for:

● Programme delivery

● Reporting and legal obligations

● Organisational record-keeping requirements

After this period, information is securely deleted or archived where appropriate.

Individuals have the right to:

● Access their personal information held by Heartshine NPC

● Request correction of inaccurate or outdated information

● Request deletion of personal information where appropriate

● Object to certain forms of processing (where legally applicable)

Requests can be made using the contact details below.

In the unlikely event of a data breach, Heartshine NPC will:

● take immediate steps to contain and investigate the issue

● notify affected individuals where required by law

● take corrective action to prevent future occurrences

For any POPIA-related queries or requests, please contact:

Information Officer: Yolandi Kosmatos

Email: yolandi@theheartshine.org

This policy will be reviewed periodically and updated when necessary to reflect changes in our operations or legal requirements.