Privacy notice

Information we collect

Depending on how you engage with us, we may collect your name and contact details through our contact form; contact details, skills and availability through volunteer applications; your name, contact details and guest count for event RSVPs; ticket order contact details, ticket quantities and payment method and status; campaign donations and payment status; and beneficiary contact, care and identity details, including a South African ID number where it is needed. When staff sign in, we also keep the account, time, outcome and IP address for security.

Why we use it

We use information to respond to enquiries, assess and coordinate volunteer support, manage event attendance and ticket orders, administer donations and campaign progress, provide and administer beneficiary care, and protect access to staff accounts. We record consent or the applicable lawful reason before storing a beneficiary ID number. Beneficiary records and ID numbers are not included in the website assistant's information.

Who can see it

Only staff who need information for their work may access it. Beneficiary records are restricted to authorised administrators, and full ID numbers are available only to those administrators; other views mask the number. Service providers that host or operate the website may process information only as needed to provide those services. We do not sell personal information.

How we protect and retain it

We use role-based access and appropriate technical safeguards. Beneficiary identity details, including ID numbers, are encrypted in storage. Contact enquiries, volunteer applications and event RSVPs are kept for no longer than 12 months after the enquiry is closed, the application is decided, or the event takes place, unless an ongoing relationship, safeguarding need or legal obligation requires longer. Beneficiary care records are retained while support is active and for up to five years after it ends where required for accountability or legal obligations. Staff sign-in audit records are retained for 365 days. Records are reviewed and securely removed or de-identified when they are no longer required.

Your rights and requests

You may ask to access or correct your personal information, or request its deletion. Deletion may be limited where we must retain information for a legal, safeguarding or accountability reason. To make a request, please use our Contact page and describe the information and request; we may need to verify your identity before responding.

This notice may be updated when our services or legal obligations change.