1. Who we are

Kloof & Highway SPCA is a South African non-profit organisation that works to prevent cruelty to animals and promote animal welfare. For the processing described in this policy, Kloof & Highway SPCA is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA), because we determine why and how personal information is processed.

Our principal place of business is 29 Village Road, Kloof, KwaZulu-Natal, South Africa, 3640. Our main telephone number is 031 764 1212/3 and our website is www.kloofspca.co.za.

2. Personal information we collect

Depending on how you interact with us, we may collect and process the following categories of personal information:

• Identity and contact information: name, surname, email address, telephone or mobile number, postal or physical address and, where genuinely required, identifying details.
• Donation and payment information: donation amount, frequency, campaign, transaction identifiers, payment status, recurring-payment status, tax-certificate details and related accounting or audit records. Payment providers process payment credentials on their own systems; we generally receive transaction and status information rather than full card details.
• Membership and subscription information: programme membership status, start and end dates, communication preferences, list membership and lifecycle information.
• Consent and preference records: the choices you make, the wording or version presented, timestamps, withdrawal or opt-out requests, and the current status of email or WhatsApp consent.
• Enquiry and service information: messages, correspondence, forms, attachments, complaints, adoption or volunteer interactions, event participation and records needed to respond to or fulfil a request.
• Website and device information: IP address, browser or device information, security and access logs, cookie identifiers and information about how the website is used.
• Operational information: records relating to suppliers, contractors, staff, volunteers and other people who interact with our operations, where applicable.

We aim to collect only information that is adequate, relevant and not excessive for the purpose concerned. If information is mandatory, we will try to explain why it is needed and what may happen if it is not provided.

3. How we obtain personal information

We usually obtain personal information directly from you when you use our website, make a donation, join a programme, subscribe, contact us, attend an event, apply, volunteer or otherwise interact with us. We may also receive information from payment and communication providers, authorised representatives, referrals, public records or other lawful sources where appropriate. We do not treat publicly available information as permission for unrestricted marketing.

4. Why we process personal information

We process personal information only where POPIA permits it. Depending on the activity, our justification may include your consent, performing an agreement or taking steps at your request, complying with law, protecting a legitimate interest of you or another person, or pursuing our legitimate organisational interests where your rights and interests do not override them.

We may process personal information for purposes including:

• processing donations, recurring payments, refunds, tax certificates and donor records;
• administering memberships, subscriptions, events, volunteer activities, adoptions, enquiries and other services;
• sending communications you have selected and maintaining reliable consent and opt-out records;
• responding to questions, complaints, access requests and other correspondence;
• preventing fraud, abuse and security incidents and maintaining the integrity of our website and systems;
• meeting legal, tax, accounting, governance, reporting and audit obligations;
• measuring and improving our website, programmes, fundraising and supporter experience using appropriately limited data; and
• establishing, exercising or defending legal rights and resolving disputes.

5. Donations and recurring payments

Our website uses Charitable software to record and administer donations. PayFast processes online payments and recurring-payment instructions. PayFast’s own privacy terms apply to the personal information it processes for payment services, while we remain responsible for the donor and membership records under our control.

We may retain the cancellation and transaction record where required for payment administration, audit, tax, legal or dispute purposes.

6. Highway Heroes membership and WhatsApp

Highway Heroes is a WhatsApp-based recurring-donor membership programme. If you join, we may process your name, email address, telephone number, donation and recurring-payment information, programme status, communication choices, consent evidence and operational records needed to administer your membership.

If you give WhatsApp consent, Kloof & Highway SPCA may contact you from its dedicated WhatsApp Business number, +27 82 411 7303, with Highway Heroes membership updates, behind-the-scenes content, event invitations, hero perks and occasional related appeals. WhatsApp participation is optional and is not a condition for maintaining the recurring donation itself.

You may withdraw WhatsApp consent at any time by replying STOP or otherwise asking us to stop, by blocking the account, by leaving the relevant Community or group, or by contacting us. We will action the request as soon as reasonably practicable and maintain a limited suppression or audit record where necessary to respect it. Withdrawal applies to WhatsApp communications; it does not cancel the PayFast recurring donation.

WhatsApp and Meta process information through their own services. Depending on the WhatsApp feature, your settings and your participation, your display name, profile information, telephone number or message content may be visible to Meta, programme administrators or other participants as described by WhatsApp. Please avoid sending payment-card details, identity numbers, medical information or other unnecessary sensitive information through WhatsApp.

7. Email and other direct marketing

Email consent is managed separately from WhatsApp consent. We use MailPoet for relevant email subscriptions and delivery. For the Highway Heroes member email list, the website integration sends only the subscriber’s email address and first and last names to MailPoet; WhatsApp numbers and detailed consent audit fields are not mapped to that list.

We will send direct marketing by electronic communication only with valid consent or where another limited basis under applicable law permits it. Marketing messages will include a reasonable way to opt out. You may unsubscribe from email using the link in a message or contact us. An email unsubscribe does not automatically withdraw WhatsApp consent or cancel a recurring donation, and a WhatsApp opt-out does not automatically unsubscribe email.

8. Service providers, operators and disclosures

We may provide relevant personal information to trusted service providers, operators and advisers that support our website, hosting, security, payments, email, communications, administration, professional services and legal obligations. They may process information only for the relevant service, under our authority or their applicable legal role, and subject to appropriate confidentiality and security requirements.

Access by iKind Media is limited to authorised assigned personnel and approved operational purposes. A dedicated programme mailbox is used for authorised campaign administration. We require information accessed through that role to be kept confidential, protected with appropriate access controls and multi-factor authentication where supported, and not used for iKind’s own purposes or disclosed to unrelated people or social-media tools.

We may also disclose information where required or permitted by law; to regulators, courts, law-enforcement bodies, auditors or professional advisers; to protect rights, safety or security; or as part of an organisational restructuring subject to appropriate safeguards. We do not sell personal information and do not give it to third parties for their own unrelated marketing without valid permission or another lawful basis.

9. Cross-border processing

Some service providers, including providers supporting email, hosting, payments or WhatsApp/Meta services, may process or store information outside South Africa. Where personal information is transferred across borders, we will take reasonably appropriate steps required by POPIA, such as using contractual, organisational or legal safeguards and limiting the information transferred to what is necessary for the service.

10. Security

We use reasonable and appropriate technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, interference, alteration, disclosure or destruction. Measures may include role-based access, least-privilege permissions, confidentiality obligations, authentication controls, security monitoring, backups, patching and incident response.

Highway Heroes WhatsApp numbers and consent details are not intended for public display or inclusion in public receipts, certificates or reports. Operational alerts are designed to be data-minimised, and consent or contact details should not be placed in public URLs or unnecessary logs. No system is completely secure; if we identify a security compromise, we will investigate and make notifications where POPIA requires them.

11. Retention and deletion

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, and afterward where needed to comply with legal, tax, accounting, governance, audit, donation-administration, consent-evidence, security, complaint or dispute-resolution requirements.

Highway Heroes membership and consent records may be retained while the membership is active and for an appropriate period afterward to administer the donation, prove communication choices, respect opt-outs and resolve disputes. Email or WhatsApp opt-outs may require us to retain a minimal suppression record so that we do not contact you again through that channel. When information is no longer required, we will securely delete, destroy or de-identify it, subject to lawful exceptions and our approved retention schedule.

12. Cookies and website technologies

Our website may use cookies and similar technologies that are necessary for security and core functionality, and may use preference, performance or analytics technologies where configured. Where the law requires consent for non-essential technologies, we will request it before using them. You can manage cookies through available website controls and your browser settings, although disabling necessary cookies may affect website functions.

13. Children

Our general website and donor communications are not intended to invite children to provide personal information independently. Where we knowingly need to process a child’s personal information, we will do so only with the authorisation of a competent person or another justification permitted by POPIA. A parent or guardian may contact us if they believe a child has provided information without appropriate authority.

14. Your rights

Subject to POPIA and other applicable law, you may ask us to:

• confirm whether we hold personal information about you and request access to it;
• correct or update information that is inaccurate, incomplete or misleading;
• delete or destroy information that we are no longer authorised to retain;
• object to particular processing where POPIA permits an objection;
• withdraw consent for future processing that relies on consent;
• stop direct-marketing communications through the relevant channel; and
• explain or address a concern about how your information has been processed.

We may need to verify your identity before acting on a request. Some rights are subject to lawful limitations, including records that we must retain. Withdrawing consent does not affect processing that was lawful before withdrawal and does not cancel a separate payment instruction unless you also request that cancellation through the appropriate process.

15. How to contact us or complain

Please send POPIA enquiries, access or correction requests, consent withdrawals and privacy complaints to:

We encourage you to contact us first so that we can try to resolve the matter. You also have the right to lodge a complaint with the Information Regulator (South Africa). The Regulator’s current complaint and contact details are available at inforegulator.org.za/complaints/ and inforegulator.org.za/contact-us/.

16. Third-party terms

When you use PayFast, MailPoet or WhatsApp/Meta services, those providers’ own terms and privacy notices may also apply to their processing. Current information is available from their official websites:

• PayFast privacy policy
• WhatsApp Business Messaging Policy
• WhatsApp privacy information
• MailPoet privacy information

17. Changes to this policy

We may update this policy when our services, systems, providers or legal obligations change. The current version will be published on our website with its last-reviewed or effective date. Material changes may also be communicated through an appropriate channel where reasonably necessary.