GDPR Notice

Effective date: 11 August 2026

Organisation: The Purple Butterfly Foundation NPC

NPC Registration No.: 2026/591667/08

1. Applicability

The Foundation is based in South Africa. GDPR is not automatically applicable to every activity of a South African organisation. It may apply where processing falls within the GDPR's territorial scope, including certain activities involving individuals in the European Economic Area.

2. Controller

Where the Foundation determines the purposes and means of processing for an activity to which GDPR applies, it may act as a controller. For requests, use Contact Us.

3. Data

Depending on the interaction, this may include identification and contact details, correspondence, donation or partnership information, volunteer information, programme information and technical website information.

4. Legal Bases

Where GDPR applies, processing will rely on an applicable legal basis such as consent, contract, legal obligation, vital interests, public interest or legitimate interests where the required conditions are met.

5. Your Rights

Depending on circumstances and exemptions, individuals may have rights to be informed, access, rectification, erasure, restriction, data portability, objection and safeguards concerning certain automated decision-making.

6. International Transfers

Where GDPR applies and personal data is transferred outside the EEA, the Foundation will consider applicable GDPR transfer requirements and appropriate safeguards.

7. Retention & Security

Personal data will not be retained longer than necessary for the relevant purpose, subject to legal, accounting, safeguarding, governance and dispute-resolution requirements. Appropriate technical and organisational security measures should be applied.

8. Complaints

Individuals may contact the Foundation first so that a concern can be investigated. Where GDPR applies, individuals may also have the right to complain to the competent data protection supervisory authority.

9. POPIA Relationship

For processing governed by South African law, the Foundation's primary privacy framework is its POPIA notice. Where another privacy law applies, additional applicable controls will be assessed.