Privacy
Policy

1. Who We Are

The NexGen Leaders Foundation (registered name to be confirmed), a registered Non-Profit Organisation in South Africa with NPO registration number NPO number to be confirmed, is the responsible party for the personal information described in this policy. In this policy, "we", "us", and "the Foundation" all refer to The NexGen Leaders Foundation.

We take your privacy seriously. Much of our work involves young people, and we treat the information they and their families trust us with accordingly. This policy explains, in plain language, what we collect through this website, why we collect it, who else sees it, and what you can ask us to do about it.

This policy is written to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA").

2. What We Collect

We only collect information you choose to give us. We do not buy personal information from third parties, and we do not build profiles on you.

3. Why We Use It

We use your personal information only for the purpose you gave it to us for. Specifically, to:

• Assess and respond to program applications and mentor registrations.
• Run our programs, including placing participants into cohorts and matching them with mentors.
• Process donations and keep accurate financial and tax records.
• Respond to enquiries you send us.
• Send you updates about our work, but only if you have asked us to.
• Report on our impact to funders and partners, using aggregated or anonymised figures that do not identify you.
• Meet our legal, accounting, and audit obligations as a registered Non-Profit Organisation.

Under POPIA, we rely on your consent (which you give by submitting a form), the performance of an agreement with you, our legal obligations, and our legitimate interests in running the Foundation. We do not use your information for automated decision-making, and we never sell your personal information to anyone.

4. If You Are Under 18

Our programs are open to people from the age of 16, which means some of our applicants are children under South African law. POPIA gives children's information special protection.

If you are under 18, you must have the permission of a parent or legal guardian (a "competent person") before you submit any personal information to us. We will ask for written confirmation of that permission before your application can proceed, and before a young person takes part in any of our programs.

If you are a parent or guardian and you believe your child has given us information without your permission, contact us at info@nexgenleaders.org and we will delete it.

5. Payments & PayFast

Donations on this website are processed by PayFast (Pty) Ltd, a South African payment provider. When you donate, you are taken to PayFast's own secure checkout page to enter your payment details.

• Your card and banking details are entered on PayFast's systems, not ours.
• We never receive, see, or store your card number, expiry date, CVV, or banking credentials.
• We pass PayFast your name, email address, and the donation amount so it can process the payment and send you a receipt.
• PayFast tells us whether the payment succeeded, along with a reference number and the fee it charged. That is all we record.
• If you set up a monthly donation, PayFast stores a secure token that lets it collect the same amount each month. You can cancel at any time by emailing us or through PayFast directly.

PayFast handles your payment data as a responsible party in its own right, under its own privacy policy.

6. Who We Share It With

We do not sell, rent, or trade your personal information. We share it only with the service providers we need in order to operate, and only to the extent they need it:

We may also disclose personal information where the law requires it — for example, in response to a lawful court order or a request from a regulator.

7. Cookies

This website does not use advertising cookies and does not track you across other websites. We do not run third-party advertising or behavioural analytics.

Our administrator dashboard uses essential browser storage to keep staff signed in. That storage is only ever set for logged-in administrators, never for ordinary visitors.

Because we load our typefaces from Google Fonts, your browser makes a request to Google's servers, which reveals your IP address to Google. If you would rather that did not happen, most browsers and privacy extensions allow you to block it.

8. How Long We Keep It

• Donation records — at least five years, as required by South African tax and financial record-keeping law.
• Successful applications and mentor registrations — for as long as you are involved with the Foundation, and for three years afterwards.
• Unsuccessful applications — twelve months, so that we can consider you for a future intake. You can ask us to delete them sooner.
• Contact enquiries — twelve months after we have resolved your query.

When a retention period ends, we delete the information or anonymise it so that it can no longer be linked to you.

9. How We Protect It

We take reasonable technical and organisational steps to keep your information safe, including:

• All traffic to and from this website is encrypted using HTTPS.
• Our database enforces row-level security, so that no visitor can read or alter another person's records.
• Donation records can only be written by our verified payment system, never from a browser. Each payment notification from PayFast is cryptographically verified before we act on it.
• Access to personal information is limited to the staff and mentors who genuinely need it, and is protected by individual accounts and passwords.

No system is perfectly secure. If a breach ever occurs that puts your personal information at real risk, we will notify you and the Information Regulator as POPIA requires.

10. Your Rights

POPIA gives you real, enforceable rights over your personal information. You may:

• Ask what we hold about you, and receive a copy of it.
• Correct or update anything that is wrong or out of date.
• Ask us to delete information we no longer have a lawful reason to keep.
• Object to us processing your information in a particular way.
• Withdraw your consent at any time, including unsubscribing from our updates.
• Complain to the Information Regulator if you believe we have mishandled your information.

To exercise any of these rights, email info@nexgenleaders.org. We will respond within a reasonable time, and in any event within 30 days. Exercising your rights is free, and we will never treat you differently for doing so.

11. Cross-Border Transfers

Some of our service providers — including Supabase and GitHub — store data on servers outside South Africa. POPIA permits this where the receiving country or provider offers a comparable standard of protection. We choose providers who commit contractually to protecting personal information to a standard equivalent to POPIA.

12. Changes

We may update this policy from time to time — for instance, if we start using a new service provider. The "last updated" date at the top of this page always reflects the current version. If we make a change that materially affects your rights, we will make a point of telling you.

13. Contact & Complaints

Our Information Officer is Information Officer name to be confirmed. For any question about this policy, or to exercise your rights, contact us:

• Email: info@nexgenleaders.org
• Phone: Amber — 081 039 0081
• Address: 28 Offord Manor, Ottery East, Cape Town, South Africa

Please come to us first — we would much rather fix a problem directly. But you always have the right to complain to the regulator:

See also our Terms of Use, which govern your use of this website and any donation you make through it.