Privacy Notice - DonorMS

1. Introduction

DonorMS is a donor management system that processes personal information on behalf of Non-Profit Organisations (NPOs) registered in South Africa. This privacy notice explains how your personal information is collected, used, and protected in accordance with the Protection of Personal Information Act (POPIA).

2. Who We Are

Operator: DonorMS (operated by Webcafe) acts as an "Operator" under POPIA, processing personal information on behalf of NPO clients.

Responsible Party: The NPO/NGO organisation that uses DonorMS to manage donor records is the "Responsible Party" under POPIA. They are accountable for ensuring lawful processing of your information.

3. Personal Information We Process

The following categories of personal information may be processed:

Identity Information: Name, ID number, passport number, title, initials
Contact Information: Email address, phone numbers, physical and postal addresses
Financial Information: Donation amounts, payment references, income tax numbers
Demographic Information: Language preference, gender (if provided)

4. Purpose of Processing

Your personal information is processed for the following purposes:

Recording and tracking donations to the NPO
Issuing Section 18A tax certificates as required by SARS
Communicating with you about your donations
Generating reports and statistics for the NPO
Complying with legal and regulatory requirements

5. Legal Basis for Processing

We process your information based on:

Consent: You have given consent for processing (POPIA s11(1)(a))
Contract: Processing is necessary to fulfil a donation agreement
Legal Obligation: We must comply with SARS requirements for Section 18A certificates
Legitimate Interest: The NPO has a legitimate interest in managing donor relationships

6. Data Retention

Your personal information is retained for:

Active donors: As long as you maintain a relationship with the NPO
Tax records: Minimum 5 years as required by SARS for Section 18A certificates
After erasure request: Data is soft-deleted but retained for the legal retention period, then permanently removed

7. Your Rights Under POPIA

You have the following rights regarding your personal information:

Right of Access: Request a copy of all personal information held about you
Right to Correction: Request correction of inaccurate or incomplete information
Right to Erasure: Request deletion of your personal information (subject to legal retention requirements)
Right to Object: Object to the processing of your personal information
Right to Lodge a Complaint: Submit a complaint to the Information Regulator

To exercise any of these rights, please contact the NPO that holds your donor record.

8. Data Recipients

Your personal information may be shared with:

SARS: Tax information as required for Section 18A compliance
Service Providers: Cloud hosting providers (with appropriate data protection agreements)
Auditors: For financial audits of the NPO

We do not sell or share your personal information with third parties for marketing purposes.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

Encryption of data in transit (HTTPS/TLS)
Role-based access control and per-organisation data separation
Password hashing, login rate limiting and audit logging
Encryption of stored payment-gateway credentials
Daily database backups

10. Contact Information

For privacy-related inquiries:

NPO Information Officer: Contact the NPO directly using the details on your correspondence
DonorMS Support: [email protected]
Information Regulator: https://inforegulator.org.za

11. Changes to This Notice

This privacy notice may be updated from time to time. The current version will always be available at this URL. Last updated: 28 September 2026. See also our Terms of Service and PAIA Manual.

Back to DonorMS