At Penny Appeal, we are committed to respecting your data privacy. The Protection of Personal Information Act, 2013 (Act 4 of 2013), The Protection of Personal Information Act: Regulations: Information register (English / Afrikaans), GG 42110, RG 10897, 14 Dec 2018 and The Promotion of Access to Information Act, 2000 (Act 2 of 2000) require that we provide you with information about how and why we use personal data. We aim to process information about you fairly, lawfully, and in a transparent manner and the aim of this document is to provide you with sufficient information for you to understand what we are doing with your personal data. This policy also explains our commitment to protecting your personal data and your rights towards those data. Please read it carefully to understand our views and practices regarding your personal data and how we will use it.
The controller of your data is Penny Appeal South Africa, registered at Suite 7, 565 Peter Mokaba Ridge, Essenwood, Durban, South Africa. References to we, our or us in this policy are to the controller, Penny Appeal.
2. Personal Information we may collect about you
We collect information about you in the following ways:
Personal data you provide to Penny Appeal directly
You may provide us with information about you when you submit an enquiry form on our website, write to us, call us, or when you make or enquire about making a donation, fostering or adoption. This may include your name, address, email address, telephone number, payment details, appeal you wish to support, gift aid status etc. and information you provide in any correspondence with us. You may also provide us with marketing and communications preferences and in some cases an indication of your consent for us to perform certain processing activities on your personal data.
Information collected by your involvement with Penny Appeal
Your activities and involvement with Penny Appeal will result in personal data being collected. This could include details of how you’ve helped us by being involved with our campaigns activities. If you decide to donate to us or get involved in our fostering and adoption campaign, then we will keep records of when and how much you give to a particular cause and information you provide for the adoption process. When you use our website we will collect personal information about you using cookies and other digital media technologies details of which are contained in our Cookies Policy. We will receive and store information about the type of device you use to access our website, what operating system you have, some of your device settings and your IP address.
Information from other sources
We may receive information from our sub-contractors providing services to us such as payment services in order to process any donation you may make. We will collect information about you from other sources such as professional fundraising agencies, data cleansing companies, event organisers, data brokers and sources such as Companies House and the Electoral Register who are able to provide us with information about you such as your forwarding address if you move house, your charity affiliations to help us to understand you more as an individual.
Depending on your settings or the privacy policies of the social media platforms and messaging services you use (e.g. Facebook, YouTube, Twitter, Instagram, WhatsApp etc.) you may allow us to access information from those services for example if you publicly “like” or “follow” us we may be able to collect information from your social media profile. We strongly advise you to check the privacy settings on your social media accounts to ensure that you know what information is shared with us and others.
3. Lawful basis for processing
Data Protection laws require that a controller that processes personal data must do so based on one of the following lawful legal basis:
Contractual obligation: the processing is necessary for the performance of a contract or taking steps to enter into a contract between the controller and the data subject.
Legal Obligation: the processing is necessary for the controller to comply with the law or a legal requirement (not including contractual obligations).
Vital Interests: the processing is necessary to protect someone’s life
Legitimate interests: the processing is necessary for the controller’s legitimate interests, or the legitimate interests of a third party however, such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of the personal data
Consent: the data subject has given consent for the processing for one or more specific reasons
Public task: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
4. How we use your personal information
The table below describes the main purposes for which we process your personal information, the categories of your information involved and our lawful basis for doing so.
|Personal data||Our Purpose||Our Lawful basis|
|Name; address; cheques, card, bank or other payment details||Necessary to fulfill the wishes of our donors making a donation and to enable the use of the funds for the purpose it was donated for||Legitimate interest of Penny Appeal and the donor|
|Personal contact information collected from donors||Our donor information is used to creating and maintaining a database of donors and potential donors, their relationship with us, respond to complaints, queries, etc.||Legitimate interest of Penny Appeal and the donor|
|Name, address, email, phone number and other contact details||To contact you as a follow-up on your enquiry regarding fostering/adoption; send you marketing correspondence where you have given your consent||Legitimate interest;
|Name and house address||We use our donor database to contact our former, current and prospective donors from time to time, through direct postal mail, to ask if they would like to make a donation to an appeal.||Legitimate interest of Penny Appeal and the donor|
|Name, email, phone number and other electronic contact details||We use our donor database to contact our former, current and prospective donors from time to time, through a range of digital methods such as email, SMS or social media to ask if they would like to make a donation to an appeal.||Consent of the donor|
|Name, address, email, phone number and other contact details||Where you have donated towards a particular project/appeal, we may contact you from time to time to update you on how your donations was/is being used, the success of our appeals, our activities on the field, developments of new products and services, and new campaigns||Legitimate interest;|
|Name, address, email, phone number and other contact details||To respond to queries, questions or questions we may receive from our donors, in a time and professional manner.||Legitimate interest of Penny Appeal|
5. Withdrawing consent
Where you have given consent to use your data in a particular manner, you have the right to withdraw that consent at any time. You may do this by contacting us using the contact details below. Please note however that the withdrawal of your consent will not affect the lawfulness of any processing that had commenced before the consent was withdrawn. When we contact you by electronic means, we will always provide you with the option to opt out of receiving further communication of that nature from us.
6. Sharing your data
Penny appeal uses third parties to help us keep you informed with whom we may need to share your data for these specific purposes only. Services used including mailing houses, email and text marketing services. We will share your personal data with other organisations to enable us process your donation, send you communication materials, and to undertake other activities in line with the information provided in the above table.
Please note that we may need to disclose your personal information where we:
- are under a legal duty to comply with any legal obligation or in order to enforce or apply our terms and conditions; or
- need to disclose it to protect our rights, property or safety of our customers or others, including the exchange of information with other companies, organisation and/or governmental bodies for the purposes of fraud protection and credit risk reduction
- Other organisations as we may determine from time to time such as payment processors (Worldpay, KeyIVR, SmartDebit, PayPal), email and text messaging providers (Text Marketer, MailChimp, Mailing House) and for publicity (media channels carrying appeals).
7. Transferring your data internationally
Where we transfer your personal data or use service providers that are located outside the EEA, we will ensure that the country where the organisation operates from is one where the European Commission has issued an opinion which approves the adequacy of the data protection laws of that country. We will also ensure that under GDPR and DPA 2018 requirements, that we have a signed data processing agreement and service contract with them, which contains the “model clauses” approved by the European Commission for an agreement of this nature. Additionally, we will also ensure that the third-party is signed up to an approved transfer mechanism such as the EU-US Privacy Shield where the organisation is based in the United States of America.
We use MailChimp to send emails and newsletter. MailChimp is based in the U.S.A. and subscribes to the EU-US Privacy Shield meaning that MailChimp has adopted work practices that are approved by the EU in relation to data protection practices. The MailChimp registration on the Privacy Shield is available to review on the Privacy Shield website www.privacyshield.gov/list
We also use SurveyMonkey to facilitate the sending of surveys from time to time. SurveyMonkey subscribes to the EU-US Privacy Shield and their registration can also be reviewed on the Privacy Shield website above.
8. How long we keep your personal information for
Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements and we will review this from time to time. How long information will be stored for depends on the information in question and what it is being used for. For example, we will retain information about donors and donations for no longer than 7 years from the date of donation for taxation and financial record-keeping. We retain information about queries and/or contact from individuals for as long that it is needed for us to respond to the query and/or maintain records of queries for our internal management purposes. We retain records of donors and potential donors for as long as we feel you may be interested in making donations. Records of our marketing activities are kept in accordance with our donor records as above. If you ask us not to send you marketing emails, we will stop storing your emails for marketing purposes (though we’ll keep a record of your preference not to be emailed). We continually review what information we hold and delete what is no longer required. We never store payment card information.
It is important to ensure that the personal information we hold about you is accurate and up-to-date, and you should let us know if anything changes, for example if you move home, change your phone number or email address. If you want to update your personal data, please contact us at firstname.lastname@example.org
We may use information from external sources such as the post office national change of address database and/or the public electoral roll to identify when we think you have changed address so that we can update our records and stay in touch. We do this so we can continue to contact you where you have chosen to receive marketing messages from us and contact you if we need to make you aware of changes to our terms or assist you with problems with donations. This activity also prevents us from having duplicate records and out of date preferences, so that we don’t contact you when you’ve asked us not to. You may object to any data processing we undertake which involves direct marketing.
9. Your Rights in relation to personal information
You have the following rights concerning your personal data:
- Brief Explanation
- Right to be informed
Right of access
Commonly known as “subject access request”(SAR). You have the right to obtain confirmation from us as to whether we are processing your personal data, and where that is the case, access to that personal data. If you are seeking to obtain specific information (e.g. about a particular matter from a particular time period), it helps if you clarify the details of what you would like to receive in your written request.
Right to restriction of processing
You have the right (under certain circumstances, but not all) to ask us to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of your personal data that we hold.
Right to data portability
You have the right (under certain circumstances, but not all) to ask us to provide you with the personal data about you which you have provided to in a structured, commonly used and machine-readable format.
Right to object to direct marketing
Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing.
Rights in relation to automated decision making and profiling
We do not perform any automated decision-making based on personal data that produces legal effects or similarly significantly affects you.
You should note that some of these rights, for example the right to require us to transfer your data to another service provider, may not apply as they have specific requirements and exemptions which apply to them and they may not apply to personal information recorded and stored by us. For example, we do not use automated decision making in relation to your personal data. To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details below.
10. Profiling and Automated-decision making
Penny Appeal does not currently carry out any automated profiling using the personal information we hold. We do, however, use the services of external companies, including social media companies, who may profile personal data they hold to enable them to offer us to more accurately target our promotional activity on their platforms.
11. Your right to lodge a complaint
If you wish to complain about the way Penny Appeal is managing your personal information (including a complaint about fundraising activity), we would like you to give us the opportunity in the first instance, to address your concerns. Please contact us using the details below:
Phone: 031 11 00 573
12. Changes to this policy