Privacy Policy

This Privacy Notice was last updated on 12 September 2026 and applies to citizens and legal permanent residents of South Africa.

1. Who we are

Nature Connect Trust (Nature Connect, we, us) is a not-for-profit organisation registered in South Africa.

• Non-Profit Organisation No. 013-964
• Public Benefit Organisation No. 930023924
• Registered address: Unit 3B, Tokai On Main Office Park, 2 Burchell Street, Tokai, 7945
• Postal address: Postnet Suite 298, Private Bag X26, Tokai
• Telephone: +27 21 100 5613
• Website: https://natureconnect.earth

Information Officer

• Name: Llewellyn Williams
• Email: [email protected]
• Telephone: +27 21 100 5613

2. What this notice covers

This notice explains what personal information Nature Connect collects about you, why we collect it, how long we keep it, who we share it with, and what rights you have. It applies to our website, our programmes, our events, our funding and volunteering processes, and our recruitment.

It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).

It does not cover how our staff handle data internally. That is governed by IT-06 Data Protection and Privacy Policy.

3. What personal information means

POPIA defines personal information as any information relating to an identifiable living natural person, or an identifiable existing juristic person. In plain terms it is any information that can identify you. That includes obvious things like your name and contact details, and less obvious things like identity numbers, location data and online identifiers.

Special personal information means sensitive categories such as race, ethnic origin, health and criminal behaviour. We process these only where the law permits or requires it, for example employment equity reporting and accredited training records.

4. What we collect, and how

We collect information directly from you wherever it is practicable to do so.

Where it comes from	What we collect	Why
Donation form (/get-involved/donate/)	Name, email, telephone, donation amount, payment details handled by PayFast or SnapScan, and Section 18A receipt details where requested	To process the donation, issue receipts, and meet tax and audit obligations
Volunteer sign-up (/get-involved/volunteer-contact/)	Name, contact details, availability, areas of interest, emergency contact	To place and coordinate volunteers, and for safety on site
Newsletter (/about/newsletter/)	Name and email address	To send the newsletter you asked for. You may unsubscribe at any time
Vacancies and internships (/about/vacancies/)	CV, identity number, qualifications, employment history, references and supporting documents	To assess applications and meet SETA and funder reporting requirements
Programme participation	Participant names, ages, school or organisation, attendance, assessment records, and photographs or video taken at events	To run and report on programmes to funders. Photography consent is obtained separately
Website chat and email	Whatever you choose to send us	To answer your enquiry
Website analytics and cookies	IP address, device and browser information, pages viewed. See our Cookie Policy	To keep the site secure and understand how it is used

5. Children's information

Many of our programmes work with learners under 18. POPIA treats a child's personal information as special personal information, and we handle it accordingly.

We collect a child's information only with the consent of a parent, guardian, or the school acting in loco parentis, and only what the programme requires: name, age or grade, school, attendance, assessment records, emergency contact, and any medical or dietary information needed to keep them safe on an activity.

Photography and video of learners is consented to separately. A parent or guardian may decline it without the child being excluded from the activity.

All work with children is governed by our Child Protection and Safeguarding Policy, which covers staff screening, supervision, transport of learners, and how concerns are reported.

6. Our lawful basis for using your information

We process personal information only where POPIA allows it. Depending on the situation we rely on:

• your consent, for example the newsletter or photography at an event;
• the performance of a contract, for example an employment or internship agreement;
• a legal obligation, for example tax, employment and accredited training records;
• the protection of a legitimate interest, including yours; and
• our own legitimate interests, where these do not override your rights.

Where we rely on consent you may withdraw it at any time. Withdrawing consent does not affect processing that already took place, and some records must be kept where the law requires it.

7. How long we keep it

We keep personal information only as long as we need it, or as long as the law requires. In practice that means:

• Newsletter and campaign mailing list: retained until you unsubscribe or ask us to remove you
• Unsuccessful job and internship applicants: retained on file for future opportunities unless you ask us to remove them
• Employee, intern and accredited training records: seven years, as required by SETA and employment rules
• Donation and financial records: five years, as required by tax legislation
• Programme and funder reporting records: for the life of the grant plus its audit period

You may ask us at any time to delete information we hold about you, using the contact details in section 1. We will do so unless we are required by law to keep it.

8. Who we share it with

We do not sell your personal information, and we do not share it for anyone else's marketing. We do share it in these situations:

• Operators who process information on our behalf under written agreement: Microsoft (Microsoft 365, SharePoint and Outlook), PayFast (donation payments), Brevo (newsletter delivery), Cloudflare (website delivery and security), and Google (website analytics and related services)
• Funders and SETAs, where a grant or accredited training requires participant reporting. We share the minimum needed
• Professional advisors such as auditors, where they are bound by confidentiality
• Authorities, where we are legally required to disclose

9. Information sent outside South Africa

Some of our service providers store or process information outside South Africa. Microsoft 365 and Google services are the main examples.

Where information leaves the country we rely on the provider's contractual commitments to protect it to a standard comparable with POPIA, as section 72 of the Act requires.

10. How we protect your information

We take reasonable technical and organisational steps to protect personal information, including access controls, multi-factor authentication on organisational accounts, staff training, and an incident response procedure.

If a breach occurs that is likely to affect you, we will notify you and the Information Regulator as POPIA requires.

11. Cookies, analytics and our website

Our website uses cookies and similar technologies. The services involved include Google Analytics, Google reCAPTCHA, Google Fonts, Google Maps, YouTube, Wordfence and Complianz.

Full detail, including each cookie and its purpose, is in our Cookie Policy at natureconnect.earth/about/cookie-policy/. You can change your choices at any time through the cookie banner.

12. Social media

We publish our own content to our Facebook Page and Instagram account, including through an application we operate called Nature Connect Publishing. That application posts our material to our own channels. It does not collect information about you.

When you interact with us on those platforms, the platform processes your information under its own privacy terms, which we do not control.

13. Your rights

Under POPIA you have the right to:

• be told what personal information we hold about you and where we got it;
• ask for a copy of it;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object to processing on reasonable grounds;
• withdraw consent where consent is the basis we rely on;
• refuse direct marketing by electronic communication; and
• complain to the Information Regulator.

We do not use your personal information for automated decision-making or profiling.

14. How to make a request

Send requests in writing to the Information Officer using the details in section 1. A request to access your information is a Subject Access Request, made on Form 2 under the Promotion of Access to Information Act. We will respond within 30 days. Where a request is complex we may extend that, and we will tell you if we do.

A prescribed fee may apply to access requests, as PAIA allows.

15. Complaints

If you are unhappy with how we have handled your personal information, please contact the Information Officer first so that we can try to put it right.

You may also complain directly to the Information Regulator of South Africa:

• POPIA complaints: [email protected]
• PAIA complaints: [email protected]
• General enquiries: [email protected]
• Telephone: 010 023 5200, or toll free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: https://inforegulator.org.za

A POPIA complaint is lodged on the Regulator's Form 5 and sent to the POPIA complaints address above.

16. Changes to this notice

We may update this notice when the law changes, or when we change how we handle personal information. The current version is always the one published at natureconnect.earth/about/privacy-policy/, and the date it was last updated is shown at the top of the page.