Privacy policy.

1. Who We Are

This website (www.mightymindsmovement.org, the "Site") is operated by Mighty Minds Movement NPC, a non-profit company incorporated in South Africa (Registration Number: 2026/354843/08), with its registered address at 24 Francolin Road, Cape Town, 8005, South Africa ("MMM", "we", "us").

MMM is the "responsible party" for the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"). For visitors in the European Union or United Kingdom, MMM acts as the "controller" of your personal data for the purposes of the General Data Protection Regulation ("GDPR") and UK GDPR, where those laws apply.

Information Officer
Our Information Officer is Matthew Moore Gibson, registered with the Information Regulator (Registration No. 2026-028865), and can be reached at:
Email: [email protected] (marked "Attention: Information Officer")
Post: The Information Officer, Mighty Minds Movement NPC, 24 Francolin Road, Cape Town, 8005

2. Scope of This Policy

This Policy explains how we collect, use, share, and protect personal information when you visit the Site, contact us, donate, partner with us, or sign up for the Pathways Series. It applies to website visitors, donors, corporate and school partners, parents and guardians, students, and anyone else who interacts with us through the Site.

Our scholars and their families receive separate, more detailed privacy notices and consent forms as part of the scholarship onboarding process. Those documents govern the scholarship relationship; this Policy governs the Site.

3. What Personal Information We Collect

Information you give us directly:

• Contact and partnership enquiries: name, role/job title, company or school name, email address, and the contents of your message (for example through our corporate intake form or by emailing [email protected]).
• Donations: name, email address, intended amount and frequency, your personal payment reference, and the details of your transfer as they appear on our bank statement; optionally, how you heard about us and whether we may name you as a supporter. Donations are made by bank transfer; we do not use a card payment provider. If you ask for a Section 18A tax receipt, we collect the details the South African Revenue Service requires on the receipt and in our IT3(d) reporting: donor type, names, identification type and number (or company or trust registration number), date of birth, tax residency, income tax reference number, physical address, cell phone number and email address. If you give through an intermediary such as TrustBridge and agree to share your details with us, we receive your name, email address and gift details from that intermediary. If your transfer reaches us without your payment reference, we may ask for your proof of payment, which shows your name, your bank and part of your account number, and keep it with the donation record as evidence of the payment.
• Newsletter and updates: name and email address, if you opt in to receive updates from us.
• Pathways Series and student forms: if you sign up for or enquire about the Pathways Series through the Site, we collect your name, school, grade, and contact details. Special rules apply if you are under 18 (see Section 5).

Information collected automatically:

• Technical data such as IP address, browser type, device information, pages visited, and approximate region. Our Site is served through a third-party hosting and security provider, which processes this data to deliver and secure the Site (including security cookies). See Section 8 (Cookies).
• On the donation page, a security check (Cloudflare Turnstile) assesses signals from your browser and device to confirm that a person, not an automated program, is asking for a payment reference.
• Our pages load fonts from Google Fonts, so your browser sends your IP address to Google when it fetches them.
• When you receive a payment reference, your browser keeps your reference, your private link, your name and your email address for 14 days, so that you can return to your donation. This stays on your device; "Forget this donation on this device" on the donation page removes it.

Information from other sources:

• Referrals from partner schools, teachers, current scholars, or partners (for example, when a teacher contacts us about the Pathways Series on behalf of students).

We do not intentionally collect special personal information (such as race, health, religious beliefs, or biometric data) through the Site. Please do not include such information in free-text fields.

4. Why We Process Your Information and on What Basis

Purpose	Lawful basis (POPIA / GDPR)
Responding to enquiries and partnership requests	Legitimate interest; steps prior to entering an agreement
Processing and acknowledging donations; issuing Section 18A receipts and reporting them to SARS (IT3(d))	Performance of a contract; compliance with legal (tax) obligations
Administering the Pathways Series with partner schools	Legitimate interest; consent (and parental consent for children)
Sending newsletters and updates	Your opt-in consent
Operating, securing, and improving the Site	Legitimate interest
Complying with South African law (tax, NPO, company law)	Legal obligation

We will not use your personal information for purposes incompatible with those listed above without telling you first.

5. Children's Personal Information

Protecting children is central to our work, and POPIA (sections 34–35) prohibits processing a child's personal information without the prior consent of a competent person (a parent or guardian).

• If you are under 18, please do not submit any form on this Site or email us your personal details unless your parent or guardian has consented. Where a form may be completed by a student, we ask for the parent or guardian's name and contact details and take reasonable steps, appropriate to the circumstances, to confirm that they have consented before we process the submission.
• The Pathways Series is delivered in partnership with schools. Where a student takes part, we arrange the necessary consents with the partner school and, where required, directly with the student's parent or guardian.
• Photographs, names, and stories of scholars and alumni appearing on this Site and on our LinkedIn archive are published with the prior written consent of the scholar's parent or guardian (or of the alumnus/alumna themselves once they are 18 or older). Consent can be withdrawn at any time by contacting our Information Officer, and we will remove the relevant content within a reasonable period.
• We do not knowingly send direct marketing to children.

If you believe a child's personal information has been submitted to us without proper consent, contact our Information Officer and we will delete it.

6. Who We Share Information With

We do not sell personal information. We share it only with:

• Service providers who help us run the Site and our operations, namely our website hosting, security and database provider (Cloudflare, including its Turnstile security check), our email and productivity provider (Microsoft 365), the service that delivers our donation emails (Resend), our bank (Investec), from which our donation register reads incoming transfers to match them to donors, and Google Fonts. These providers act under contracts requiring them to protect your information.
• Partner schools, only as needed to administer the Pathways Series, and with appropriate consents.
• Professional advisers (legal, accounting, audit) under confidentiality obligations.
• Authorities, where disclosure is required by law (for example SARS, the CIPC, or the Information Regulator).

7. Cross-Border Transfers

Some of our service providers store or process information outside South Africa, including in the European Union and the United States. Our donation records, including Section 18A receipt details, are stored in a database located in the European Union. South African law (POPIA section 72) permits such transfers only where the recipient is bound by law or contract providing substantially similar protection, or where you consent or the transfer is necessary for a contract with you.

We rely on contractual safeguards with our providers (including data processing agreements and, for GDPR purposes, standard contractual clauses) and, where required, on your consent. By submitting information through the Site you acknowledge that it may be processed in these jurisdictions under these safeguards.

8. Cookies and Analytics

The Site uses cookies and similar technologies, including:

• Strictly necessary cookies, such as security cookies set by our hosting and security provider (for example bot-protection cookies), which are required for the Site to function and do not need consent.
• Functional, analytics, and marketing cookies, which may include third-party cookies (such as website analytics or social-media tools), used to understand and improve how the Site is used and to support our communications. Where these cookies are not strictly necessary, we ask for your consent (for example through a cookie banner) before setting them, and you can change or withdraw your choice at any time.

We will update this section as our use of cookies and similar technologies changes.

9. Direct Marketing

We only send newsletters and fundraising updates by electronic means to people who have opted in, as required by POPIA section 69. Every message includes an unsubscribe option, and you can opt out at any time by using that link or emailing [email protected]. Existing donors may receive updates about similar initiatives, with the opportunity to object at the time their details were collected and in every communication thereafter.

10. Security

We implement reasonable and appropriate technical and organisational measures to secure personal information against loss, damage, and unauthorised access (POPIA section 19), including encrypted connections (HTTPS), access controls, and confidentiality obligations on everyone working with us. If a data breach occurs that is likely to cause harm, we will notify the Information Regulator and affected individuals as required by POPIA section 22.

11. Retention

We keep personal information only as long as needed for the purposes described above or as required by law. Donation, Section 18A receipt and tax records are kept for the later of the period required by the Companies Act 71 of 2008 and five (5) years after submission of the relevant return or third-party data submission to SARS under the Tax Administration Act 28 of 2011, and longer while a SARS audit, objection or appeal is open. Where a payment reference is issued but no donation follows, the personal details attached to it are removed after 90 days. Enquiry correspondence that does not lead to an ongoing relationship is deleted within twelve (12) months of the last communication. Children's information is retained no longer than necessary for the purpose for which consent was given.

12. Your Rights

Under POPIA you have the right to:

• be told when your information is collected, and to access the information we hold about you;
• request correction or deletion of inaccurate, irrelevant, excessive, outdated, or unlawfully obtained information;
• object to processing, including for direct marketing;
• withdraw consent at any time (this does not affect processing already carried out);
• complain to the Information Regulator.

If you are in the EU/UK, you have equivalent GDPR rights, including data portability and the right to lodge a complaint with your local supervisory authority.

To exercise any right, contact our Information Officer (Section 1). We will respond within thirty (30) days of receiving a complete request and may need to verify your identity first. Requests for access to records follow the procedure set out in our PAIA Manual.

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Tel: 010 023 5200 | Email: [email protected] | Complaints: [email protected]
Website: https://inforegulator.org.za

13. Third-Party Links

The Site links to third-party platforms, including our LinkedIn evidence archive. Those services have their own privacy policies, and we are not responsible for their processing of your information.

14. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the current version. Material changes will be highlighted on the Site. Where a material change affects processing activities for which we rely on your consent as the lawful basis, we will obtain your fresh consent before implementing such change. Your continued use of the Site following non-consent-related changes constitutes acceptance of the updated Policy.

15. Contact

Questions about this Policy or your personal information:
Mighty Minds Movement NPC, Attention: Information Officer
24 Francolin Road, Cape Town, 8005, South Africa
[email protected]