Home › Privacy policy
Privacy policy
How we collect, use and protect personal information, in line with the Protection of Personal Information Act, 2013 (POPIA). Last reviewed September 2026.
Who we are
Thee Buhle Foundation is a non-profit organisation based at Cornwallis Street S.E.7, Vanderbijlpark, Gauteng. We are the responsible party for the personal information described below. Our information officer can be reached at hello@theebuhlefoundation.co.za.
What we collect, and why
| Who | What we hold | Why |
|---|---|---|
| Learners | Name, date of birth, grade, school, suburb, attendance record, school-issued marks, and a reference code. | To run the programmes, to report to parents, and to measure whether what we do works. |
| Parents and guardians | Name, relationship, phone numbers, email address, and the consent decisions you record. | To contact you about your child, and to hold your permission for activities. |
| Mentors and volunteers | Name, contact details, skills, availability, and clearance status. Only the last four digits of your ID number. | To match you to a learner, and to record that you have been screened. |
| Donors | Name, email address, phone number, amount, and the payment provider’s reference. No card details. | To issue your receipt. |
| Website visitors | The message you send us, and the IP address it came from. | To answer you, and to stop automated abuse of our forms. |
Things we deliberately do not do
- We never store card details. When you donate, your card is entered on our payment provider’s own site. All that reaches us is your name, your email address and a payment reference.
- We do not keep your full ID number. It is needed for the SAPS clearance application, which we submit on your behalf. We retain only the last four digits, which is enough to match a returned certificate to an application.
- We never publish a learner’s name or photograph. Learners appear publicly — on our Sponsor a Child page — as a reference code, a grade and a suburb. A sponsor is introduced to their learner by name only after the sponsorship is confirmed and the guardian has given written consent.
- We do not sell, rent or share your information for marketing. Ever, by anyone, for any amount.
- We do not use advertising or analytics trackers on this website. There are no third-party cookies, so there is no cookie banner to dismiss.
Consent, and changing your mind
Where we need your permission for something — a camp, a photograph, a trip — we ask for it explicitly and we keep the answer. Withdrawing permission does not erase the record that you once gave it. Instead, a withdrawal is recorded as a new decision, so the full history stays reconstructible: if you ask us what you agreed to and when you changed your mind, we can tell you precisely. That is a POPIA requirement and it is how our system is built.
You can withdraw a permission at any time in the parent app, or by phoning us on +27 71 000 0000.
Your rights under POPIA
You have the right to:
- ask what personal information we hold about you or your child, and receive a copy;
- ask us to correct anything that is wrong;
- ask us to delete information we no longer have a reason to keep;
- object to how we are using it;
- complain to the Information Regulator of South Africa.
Email hello@theebuhlefoundation.co.za and we will respond within 30 days. There is no charge for a first request.
How long we keep things
- Learner records — while the learner is on a programme, and then for five years, so we can confirm participation for a bursary or a job application later.
- Consent records — seven years, as evidence of what was agreed.
- Donation records — seven years, as SARS requires for Section 18A.
- Volunteer clearance documents — seven years after the volunteer leaves, then purged automatically.
- Website enquiries — two years.
How we protect it
Data is held in South Africa. Passwords are stored as Argon2id hashes and are never recoverable, including by us. Access is by role: a parent can see their own child and no other, and a safeguarding concern about a child is visible to our designated safeguarding lead alone. Every change to a learner’s record is logged with who made it and when, and that log cannot be edited or deleted by anybody, including an administrator.
Children
Most of the people we work with are under 18. We collect their information with the written consent of a parent or guardian, we hold the minimum we need to run a programme and report on it, and we never make it public. Learners over 13 with their own app account can see their own record and nobody else’s.
Related: our child safeguarding policy, which sets out how a concern about a child is handled and who may work with our learners.