Privacy Policy & POPIA

Effective date: 11 August 2026

Responsible organisation: The Purple Butterfly Foundation NPC

NPC Registration No.: 2026/591667/08

1. Commitment

The Foundation respects privacy and is committed to responsible processing of personal information. South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) establishes conditions for lawful processing and regulates personal information and cross-border transfers.

2. Information We May Collect

• Name and contact details.
• Information provided when you contact us, volunteer, donate, request support or enquire about programmes.
• Partnership and corporate-support information.
• Information reasonably required for administration, safeguarding, programme delivery, accountability and legal obligations.
• Basic technical information generated through website use, where applicable.

3. Sensitive Survivor Information

Our work may involve women and children affected by abuse or trauma. Such information may be particularly sensitive. Access should be limited to authorised persons with a legitimate need to know and appropriate confidentiality controls.

4. Purposes

Information may be used to respond to enquiries; administer donations and partnerships; coordinate volunteers; deliver programmes and referrals; communicate with supporters; maintain records; protect people and assets; meet legal obligations; and manage incidents.

5. Lawful Processing

Processing will rely on an applicable lawful ground, which may include consent, contract, legal obligation, vital interests or another lawful justification recognised by applicable law.

6. Sharing

We do not sell personal information. Information may be shared with authorised service providers, professional advisers, programme partners, payment providers, authorities or other recipients where lawful and reasonably necessary.

7. Security

We use reasonable technical and organisational safeguards appropriate to the information and risks involved. No internet transmission or storage system can be guaranteed completely secure.

8. Retention

Information is retained only as reasonably necessary for its purpose, legal obligations, audit, accountability, dispute resolution and legitimate organisational requirements, after which it should be securely deleted, destroyed or de-identified as appropriate.

9. Data Subject Rights

Subject to applicable conditions and limitations, data subjects may have rights relating to access, correction, objection to certain processing, withdrawal of consent where consent is the basis, and complaint or enforcement mechanisms.

10. Cross-Border Transfers

Where information is transferred outside South Africa, the Foundation will apply POPIA requirements for transborder information flows, including section 72 requirements.

11. Children

Because our programmes may support children, information relating to children receives heightened care. Appropriate authority, consent or another lawful basis will be considered before processing children's information.

12. Incidents and Complaints

Suspected loss, unauthorised access, disclosure or compromise should be reported promptly. Privacy requests can be submitted through Contact Us. Where appropriate, complaints may also be made through the South African Information Regulator's processes.