Privacy Policy

The Umvoto Foundation NPC | Effective date: 15 October 2026 | Protection of Personal Information Act 4 of 2013 (POPIA)

1. Who we are

The Umvoto Foundation (“TUF”, “we”, “us”) is a non-profit company based in Cape Town, South Africa. We work with communities, scientists and partners on clean and healthy water systems and ecosystems. This policy explains what personal information we collect through this website and in our work, why we collect it, who we share it with, how long we keep it, and what rights you have.

For the purposes of POPIA, the responsible party is:

The Umvoto Foundation NPC
8 Beach Road (entrance in Maynard Road), Muizenberg 7945, Cape Town, South Africa
Telephone: +27 21 709 6700
Email: info@theumvotofoundation.org

Our Information Officer is responsible for making sure we comply with POPIA. You can reach the Information Officer at info@theumvotofoundation.org with any privacy question or request.

2. What we collect

2.1 Information you give us

  • Contact form. Your name, email address, phone number and the message you send us.
  • “Stay in touch” sign-up. Your email address.
  • Emails and phone calls. Whatever you choose to tell us when you contact us directly, for example to book a guided hike or to ask about our projects.
  • Donations. This website does not take payments. If you donate to us by other means, we keep your name, contact details and the amount and date of your donation. If you ask for a section 18A tax certificate, we also keep the details the South African Revenue Service requires on that certificate, such as your identity, passport or company registration number, and your address.
  • Community and project work. When you take part in one of our projects, workshops or events, we may record your name, contact details and your participation, and with your permission, photographs.

2.2 Information collected automatically

When you visit this website, we collect technical information about your visit through Google Analytics: the pages you view, how long you stay, the website or search that brought you here, your device and browser type, and your approximate location (city or country). Google receives your IP address to do this. Section 7 explains the cookies involved.

We do not knowingly collect special personal information (such as health, religious or political information) through this website, and we do not knowingly collect information from children through it.

3. Why we use it

  • To answer your enquiries and arrange bookings you ask for.
  • To send you news about our work, if you signed up for it.
  • To issue donation receipts and section 18A certificates, and to keep the records the law requires of a non-profit company and a public benefit organisation.
  • To run our projects and report on them to our partners and funders. When we report, we use totals and summaries, not your personal details, unless you have agreed otherwise.
  • To understand how people use this website so that we can improve it.
  • To keep this website secure.

4. Our legal grounds

POPIA allows us to process personal information on the following grounds, and we rely on them as set out here:

  • Your consent, when you sign up for news or agree to be photographed. You can withdraw it at any time.
  • Taking steps you have asked for, when you send us an enquiry or make a booking.
  • A legal obligation, for donation and tax records.
  • Our legitimate interest, for website analytics and security. We do not use these in a way that overrides your rights.

5. Who we share it with

We do not sell or rent your personal information. We share it only with the people and companies that help us run the foundation and this website, and only for the purposes above:

  • Our website host, which stores this website and the form submissions on servers in South Africa.
  • Sorted Design International, the agency that builds and maintains this website for us. Its team can see form submissions while doing that work.
  • Google, which provides Google Analytics and the fonts this website uses.
  • Outdooractive, which provides the interactive trail map on our home page. When that map loads, Outdooractive receives your IP address.
  • Auditors, the South African Revenue Service and other authorities, where the law requires it.

Our links to Facebook, Instagram and LinkedIn take you to those platforms. Once you are there, their own privacy policies apply.

5.1 Information sent outside South Africa

Google and Outdooractive may process information on servers outside South Africa, including in the United States and the European Union. Section 72 of POPIA allows this where the recipient is bound by laws or agreements that give protection similar to POPIA. Google’s data protection terms provide this.

6. How long we keep it

  • Enquiries and contact form messages: two years from our last contact with you.
  • “Stay in touch” sign-ups: until you ask us to stop.
  • Donation and section 18A records: five years, as South African tax law requires.
  • Website analytics: the period set in our Google Analytics account, no longer than 14 months.
  • Project records: for as long as our agreements with our partners and funders require, then deleted or made anonymous.

When we no longer need information, we delete it or remove anything that identifies you.

7. Cookies

Cookies are small files a website stores in your browser. This website uses:

  • Analytics cookies from Google Analytics (names starting with _ga), which tell us how visitors use the site. We rely on our legitimate interest under section 11 of POPIA for these, and we tell you about them in the notice shown on your first visit.
  • A notice cookie (tuf_cookie_notice), which remembers that you have seen that notice so it does not appear on every page.
  • Third-party cookies that the Outdooractive trail map may set when it loads.

We do not use advertising cookies.

7.1 Changing your choice

You can delete or block cookies in your browser settings at any time. To stop Google Analytics from measuring your visits on every website, install Google’s opt-out add-on from tools.google.com/dlpage/gaoptout. You can also object to analytics by emailing info@theumvotofoundation.org.

8. How we protect it

This website uses an encrypted (HTTPS) connection. Access to form submissions and our records is limited to the people who need it for the purposes above. No method of storing or sending information is completely secure. If you think your information has been compromised, email us at once on info@theumvotofoundation.org. If a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

9. Your rights

Under POPIA you have the right to:

  • ask whether we hold personal information about you, and ask for a copy of it;
  • ask us to correct information that is wrong or incomplete;
  • ask us to delete information we no longer have a lawful reason to keep;
  • object to us using your information, including for analytics;
  • withdraw your consent, for example by unsubscribing from our news;
  • complain to the Information Regulator.

To use any of these rights, email info@theumvotofoundation.org. We may ask you to confirm your identity before we act. We will reply within 30 days.

10. The Information Regulator

If you are not happy with how we have handled your information, please tell us first so we can put it right. You may also complain to the Information Regulator (South Africa) at inforegulator.org.za or by email to POPIAComplaints@inforegulator.org.za.

11. Changes to this policy

We may update this policy when our work or the law changes. The effective date at the top shows when it last changed.