Privacy Notice · Tuu Post Impact NPC

This privacy notice explains how Tuu Post Impact NPC (“Tuu Post Impact”, “we”, “our” or “us”), a non-profit company registered in South Africa under number 2025 / 015649 / 08, collects, uses, shares and protects personal information.

Our registered office is at First Floor, Work Central, Bel Air Shopping Mall, Bellairs Drive and Malibongwe Drive, Northriding, Johannesburg, 2169. Tuu Post Impact is a separate juristic person from Timbaktuu Post (Pty) Ltd; this notice should be read together with our Website Terms of Use and our PAIA Manual. Where we deliver programmes alongside Timbaktuu Post (Pty) Ltd, each entity remains responsible for the personal information it processes for its own purposes.

Introduction

Tuu Post Impact is a mission-driven non-profit that promotes and drives social, financial and digital inclusion for underserved South African communities. In pursuing that mission we process personal information relating to programme beneficiaries and participants, youth ambassadors and community volunteers, donors, funders and grant-makers, implementing and community partners, our directors, employees and suppliers, and users of our website.

Where we determine the purpose and means of processing — for example to register beneficiaries, run a programme or report to a funder — we are the Responsible Party under the Protection of Personal Information Act 4 of 2013 (“POPIA”). Where we process personal information on behalf of a funder or partner under written instruction, we may act as an Operator, with that party being the Responsible Party. We are committed to protecting your privacy; we do not sell personal information, and we share it only as described in this notice or as permitted by law.

Section 01Information Officer

We have appointed an Information Officer, registered with the Information Regulator, who is responsible for ensuring our compliance with POPIA and the Promotion of Access to Information Act 2 of 2000 (“PAIA”). If you have any questions about this notice, or wish to exercise any of your rights, please contact:

Vuyo Tofile — Information Officer
Email: admin@tuupost.com
Telephone: +27 (0) 10 449 1467
First Floor, Work Central, Bel Air Shopping Mall, Bellairs Drive and Malibongwe Drive, Northriding, Johannesburg, 2169

Section 02Categories of data subjects and information we process

Depending on your relationship with us, we may collect, use, store and transfer the following categories of personal information:

Beneficiaries and programme participants — full names; identity, passport or permit number; date of birth; residential address; contact numbers and email; household, socio-economic and eligibility information; photographs and, where a programme requires it and a lawful basis exists, biometric or proof-of-life data; attendance, assessment and outcome records; and, where relevant, the personal information of children processed with parental or guardian consent.
Youth ambassadors and community volunteers — names and contact details; identity number and right to work or participate; proof of residence; qualifications and training records; banking details for stipends or reimbursements; tax number where applicable; vetting and reference checks; and activity, geolocation and performance records.
Donors, funders and grant-makers — representative names and contact details; organisation and registration details; banking and payment information; grant, funding-agreement and reporting records; and correspondence.
Implementing and community partners — organisation and representative details, due-diligence and accreditation records, and commercial or collaboration terms.
Directors, employees, job applicants and suppliers — identity and contact details; qualifications and CVs; contracts; remuneration, payroll, tax and banking information; B-BBEE and equity data where lawfully required; and due-diligence records.
Website users, visitors and correspondents — account or profile information; device, browser and IP metadata; cookie identifiers; session logs; correspondence; and CCTV footage at our premises where applicable.

We may aggregate anonymised or de-identified information for monitoring, evaluation, research and reporting. Aggregated data is not personal information in law because it does not reveal your identity; if we combine it with data that can identify you, we treat the combined data as personal information.

Section 03Special personal information and children

Special personal information — such as biometric data, or data about health, race or ethnicity — and the personal information of children are processed only where a lawful basis exists and in strict compliance with Sections 26 to 35 of POPIA, including, where required, prior authorisation from the Information Regulator under Section 57. Because our programmes may serve children and vulnerable groups, we take particular care to process their information only to the extent necessary for their inclusion and wellbeing, and with appropriate consent and safeguards.

Section 04Why we process your personal information

We process personal information for the following lawful purposes:

to register, verify, enrol and support beneficiaries and participants in our social, financial and digital-inclusion programmes;
to recruit, vet, train, manage and pay stipends to youth ambassadors and community volunteers;
to design, deliver, monitor and evaluate programmes, and to measure and report social impact to donors, funders and partners;
to administer donations, grants and funding agreements, including due diligence, receipting, invoicing, audit and reporting;
to comply with legal and regulatory obligations, including POPIA, PAIA, the Companies Act 71 of 2008, the Nonprofit Organisations Act 71 of 1997 (where applicable), and tax and labour legislation;
to prevent, detect and investigate fraud, misuse of funds and policy breaches, and to safeguard the people we serve;
to operate, secure and improve our website and systems; and
for statistical, research and planning purposes, using anonymised or aggregated data wherever practicable.

We will not process your personal information for a secondary purpose unless that processing is compatible with the original purpose, you have consented, or another lawful basis exists under POPIA.

Section 05Lawful basis for processing

We process personal information on one or more of the lawful bases recognised by POPIA: with your consent; because it is necessary to conclude or perform a contract or programme arrangement with you; because we have a legal obligation to do so; to protect your legitimate interests; because processing is necessary to pursue our legitimate interests or those of a third party; or because it is necessary for the proper performance of a public-benefit function carried out in the public interest. Where we rely on consent, you may withdraw it at any time by contacting our Information Officer, although this may affect our ability to include you in a programme or service.

Section 06Who we share personal information with

We disclose personal information only to the extent lawful and necessary for the purposes above. Recipients may include:

donors, funders, grant-makers and their auditors, for reporting, verification and audit of funded programmes;
implementing, community and delivery partners engaged to run programmes on the ground;
Timbaktuu Post (Pty) Ltd, where it provides network, technology or delivery infrastructure under a written agreement with appropriate POPIA safeguards;
verification and identity-verification bureaus, and, where lawful, credit or qualification bureaus;
the South African Revenue Service, financial institutions and payroll or stipend providers, for banking, tax and payment information;
the Department of Social Development / NPO Directorate, the CIPC, regulators and, where applicable, B-BBEE verification agencies, for statutory and compliance purposes;
cloud infrastructure, communications and email providers processing data under written Operator agreements; and
legal advisors, external auditors, courts, tribunals and the Information Regulator, for legal and dispute matters.

Section 07Transfers outside South Africa

We use cloud-based infrastructure and software services that may result in personal information being stored or processed outside the Republic. Any such transfer is made only on a lawful ground permitted by Section 72 of POPIA — for example, where the recipient is subject to laws, binding corporate rules or a binding agreement providing adequate protection, where you have consented, or where the transfer is necessary to perform a contract. Transfers are limited to reputable providers whose data-protection commitments meet or exceed the POPIA standard and are governed by written Operator agreements with contractual safeguards.

Section 08How we keep your information secure

In compliance with Sections 19 to 22 of POPIA, we maintain reasonable technical and organisational measures to protect the confidentiality, integrity and availability of personal information, including:

role-based access controls, least-privilege permissions, multi-factor authentication and audit logging;
encryption of personal information in transit and at rest;
endpoint protection, anti-malware, and vulnerability and patch management;
data backup, tested recovery procedures and business-continuity planning;
a documented incident-response plan covering containment, investigation, breach notification to the Regulator and affected data subjects, and post-incident review;
written Operator agreements with all third-party processors; and
POPIA awareness training and physical security controls at our premises.

These measures are reviewed at least annually, or whenever a material change to our processing, technology or threat environment occurs.

Section 09How long we keep your information

We keep personal information only for as long as necessary to fulfil the purposes for which it was collected, including to deliver a programme, to comply with legal, tax, funding and regulatory obligations, and to establish, exercise or defend legal claims. Where we act as an Operator for a funder or partner, the retention period is governed by the applicable agreement. When information is no longer required, we securely destroy or de-identify it.

Section 10Your rights

Subject to POPIA, you have the right to:

be notified that we are collecting your personal information, and that it has been accessed by an unauthorised person;
request access to the personal information we hold about you (Section 23);
request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (Section 24);
object, on reasonable grounds, to the processing of your personal information (Section 11(3));
withdraw consent where processing is based on consent; and
opt out of any communications or direct marketing at any time (Section 69).

Section 11How to exercise your rights

To access your personal information, or to request correction, deletion or object to processing, submit the applicable Information Regulator form — Form 2 for access, Form 3 for correction or deletion, and Form 1 for objection — to our Information Officer at admin@tuupost.com. These forms are available on the Regulator’s website, and the full procedure and any prescribed fees are set out in our PAIA Manual. We will respond within the periods required by POPIA and PAIA, ordinarily within 30 days of receiving a compliant request. Before acting on a request, we take reasonable steps to verify your identity.

Section 12Cookies and browsing information

Our website uses cookies — small text files placed on your device — to enable core functionality, remember your preferences and understand how the site is used. When you first visit, we ask whether you consent to our use of non-essential cookies. Our servers also record technical information such as your IP address, approximate location and device and browser type, which we use in aggregate to assess and improve our website. You can control cookies through your browser settings, although disabling them may affect how the site works.

Section 13Complaints and remedies

If you are unhappy with how we have handled your personal information or an access request, please first contact our Information Officer at admin@tuupost.com so we can try to resolve the matter. If you remain aggrieved, you may, within 180 days, lodge a complaint with the Information Regulator or apply to a court of competent jurisdiction under Section 78 of PAIA.

The Information Regulator (South Africa) can be contacted at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; by email at POPIAComplaints@inforegulator.org.za or PAIAComplaints@inforegulator.org.za; or via inforegulator.org.za.

Section 14Changes to this notice

We may update this privacy notice from time to time to reflect changes in our processing activities or the law. The version that applies to you is the one posted here on the day you use our website. If you have any questions about this notice, please contact us.