Privacy Notice

1. Who we are

Webster Malatji Foundation NPC is the responsible party for the personal information described in this notice, as that term is used in POPIA. We are a non-profit company registered in South Africa.

Write to our Information Officer at the privacy address above about anything in this notice, including a request to see, correct or delete your information.

2. What this notice covers

This notice applies to:

• This website, webstermalatjifoundation.org, and the information you send us by email or WhatsApp.
• WMF Career Mentor, our career development and mentorship app, at app.webstermalatjifoundation.org and in any app store version of it.

It explains what we collect, why, who else sees it, how long we keep it and what you can require of us. It does not cover other organisations' websites or services that we link to; their own notices apply there.

3. Adults only

WMF Career Mentor is for people aged 18 years or older. We do not knowingly collect personal information from children. If we learn that we hold information about a person under 18, we will delete it and close the account. If you believe a child has given us their information, tell us at privacy@webstermalatjifoundation.org and we will act promptly.

4. What we collect

We collect only what the programme needs. We do not ask for your identity number, your race, your health information or your financial details, and you should never send them to us.

On this website

• Whatever you choose to put in an email or WhatsApp message to us — typically your name, contact number and what you are asking about.
• Standard web server records kept by our hosting provider, such as the date and time of a request and the network address it came from. We do not use these to identify you.

In the WMF Career Mentor app

Category	What it is
Account details	Your name, email address, and the credentials you use to sign in.
Employment details	Your current employer, job title and industry. We use these to match you with a suitable mentor and to understand who the programme is reaching.
Your career plan	The goal you set, your milestones and weekly actions, your own rating of your skills, and the notes and evidence you record as you go.
Mentoring	Your session requests, whatever you choose to send with them, and notes kept about a session.
Technical	Device type, app version and error reports, so that we can fix faults.

Your career plan is yours. Nobody at the Foundation reads it as a matter of course; we access it only where this notice says so, such as to fix a fault you have reported or to investigate a complaint.

5. Why we process it, and on what basis

POPIA requires us to have a lawful justification for everything we do with your information. Ours are set out below.

What we do	Why	Lawful basis under POPIA
Create and run your account	So you can use the app at all	Necessary to carry out the agreement between us (s11(1)(b)); your consent (s11(1)(a))
Deliver the programme — plan, skills map, evidence	This is the service you signed up for	Necessary to carry out the agreement (s11(1)(b))
Match you with a mentor and pass on what you send	So mentoring can happen	Your consent (s11(1)(a))
Reply to you and provide support	So we can help when you ask	Our legitimate interests (s11(1)(f))
Keep the service safe and enforce our terms	To prevent abuse and protect users	Our legitimate interests (s11(1)(f))
Report on the programme to our board and funders	To account for how the programme is doing	Our legitimate interests (s11(1)(f)) — in aggregate form only, see section 9
Meet legal and regulatory duties	Company, tax and other obligations	Compliance with an obligation of law (s11(1)(c))

6. Consent and choice

Where we rely on your consent, you give it freely and you can withdraw it at any time by writing to privacy@webstermalatjifoundation.org or by changing your choices in the app. Withdrawing consent does not undo anything we lawfully did before you withdrew it, and it may mean we can no longer provide part of the programme — for example, we cannot arrange mentoring if you withdraw consent to share anything with a mentor.

You are not obliged to give us your employment details, but without them we cannot match you sensibly with a mentor.

7. Who we share it with

We do not sell your personal information, and we do not use it for advertising. We share it only as follows:

• Mentors — only what you choose to send. See section 8.
• Service providers who act on our instructions (operators under POPIA s21), such as our hosting and email providers. They may process your information only for us, under a written contract that requires them to keep it confidential and secure.
• Our professional advisers — such as our accountant, auditor or attorney — where they need it to advise us, and under a duty of confidentiality.
• Authorities, where the law requires it or to protect someone's safety.

If the Foundation ever merges with or transfers its programme to another organisation, we will tell you before your information moves, and you will be able to delete your account first.

8. Mentors and what they see

Mentors are volunteers. They are not employees or agents of the Foundation, and they are outside our organisation, so anything they see about you is a disclosure to another person.

Every mentor agrees to our mentor code of conduct, which requires them to keep what you share confidential, to use it only for mentoring you, and not to copy, keep or pass it on. If a mentor breaks that undertaking, tell us at privacy@webstermalatjifoundation.org. We can remove a mentor from the programme, and a serious breach may also be reportable to the Information Regulator.

We cannot control what a mentor does with information you give them directly, outside the app — for instance in a personal email, a phone call or a meeting. Share only what you are comfortable sharing.

9. Funder and board reporting

We report to our board and to funders on how the programme is doing. Those reports use aggregate figures — how many people are on the programme, how many sessions took place, what progress looks like overall. They do not name you and do not contain your plan or your evidence.

We do not collect race, gender, age or identity numbers. If a funder ever requires verified beneficiary information of that kind, we will ask you separately and explicitly, explain exactly what is needed and why, and update this notice before collecting anything. You will be free to decline and stay on the programme.

10. Where your information is stored

Your information is stored on servers in South Africa. We do not transfer it to another country.

Two qualifications, so that this is complete:

• This website loads its typefaces from Google Fonts, which means your browser connects to Google's servers when a page loads. No account information is sent in that connection.
• If we later offer sign-in through another provider, or move any part of our systems outside South Africa, we will update this notice first and meet the requirements of POPIA section 72 for transfers across borders.

11. How long we keep it

Information	How long
Your account and career plan	For as long as your account is open
After you delete your account	Removed from our live systems within 30 days; removed from backups within a further 90 days
An account left unused	After 24 months of inactivity we email you; if you do not respond within 30 days we delete the account
Emails and WhatsApp messages to us	24 months from our last exchange, unless the matter is ongoing
Records the law requires us to keep	For the period the law prescribes — for example, financial records for seven years under the Companies Act 71 of 2008

You can ask us to delete your information sooner. See section 13.

12. How we protect it

POPIA section 19 requires us to secure the integrity and confidentiality of your information with appropriate, reasonable technical and organisational measures. Ours include:

• Encrypted connections (HTTPS) between your device and our systems.
• Access limited to the people who need it to do their work, under confidentiality undertakings.
• Written contracts with every service provider that processes information for us.
• Regular review of who has access, and removal of access when it is no longer needed.

No system is perfectly secure. If your information is accessed or acquired by an unauthorised person, POPIA section 22 requires us to notify the Information Regulator and to notify you, in writing, as soon as reasonably possible after discovering it. We will tell you what happened, what it means for you and what we are doing about it.

13. Your rights

Under POPIA you may:

• Ask what we hold about you and ask for a copy (sections 23 and 25). We must confirm, free of charge, whether we hold information about you. A copy of the record itself may carry the fee prescribed under the Promotion of Access to Information Act 2 of 2000 (PAIA).
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
• Object to our processing your information on legitimate-interest grounds, on reasonable grounds relating to your situation (section 11(3)).
• Withdraw consent you have given (section 11(2)).
• Not be subject to a decision based solely on automated processing that has legal consequences for you (section 71). We do not make decisions about you that way.
• Complain to the Information Regulator, or to a court (section 74).

To exercise any of these, email privacy@webstermalatjifoundation.org. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not give your information to someone else. Formal access requests under PAIA are made on the prescribed form and are dealt with under our PAIA manual, available on request from the same address.

14. Complaints

Please raise a concern with our Information Officer first — most things are quickest to fix directly. If you are not satisfied, you may complain to:

Complaining to the Regulator costs you nothing, and we will not treat you differently for doing it.

15. Cookies and tracking

This website uses no tracking cookies, no advertising tags and no analytics. We cannot see who visits it.

The app stores information on your own device so that it works offline and remembers where you were. That storage sits in your browser or on your phone, under your control; clearing your browser or app data removes it. We use no third-party advertising or tracking software in the app.

16. Changes to this notice

We will update this notice when what we do changes. The version number and effective date at the top always tell you which version you are reading. If a change materially affects you — for example, collecting something new or sharing with someone new — we will tell account holders by email before it takes effect.