Privacy policy
This policy describes the personal information handled through the website for events, tickets, donations, contact and administration.
Who this policy applies to
This policy covers visitors, event attendees, ticket holders, donors, contact form users, and staff or admin users who access or use the Autism Allyship Foundation website and related project systems.
The website is run by Active Autism & Neuro-Diversity Allyship Foundation.
Active Autism & Neuro-Diversity Allyship Foundation (AANDAF), known as the Autism Allyship Foundation NPC. NPC registration number 2023/657319/08.
What personal information we collect
The website supports the following categories of personal information:
- Contact form information, such as name, email address, phone number and message.
- Event and ticket registration details, such as name, email address, quantity, and ticket token information.
- Donation information, such as donor name, email address, amount, message, and payment reference information.
- Admin and staff account information used for sign-in and system access.
- Information stored in Firestore for website content, tickets, contact submissions, donations, and related administration.
- Technical information processed when the website uses Firebase, Cloudflare, or related infrastructure, subject to the relevant provider configuration.
- The website may provide links to an external WhatsApp destination. Messages sent after following a link are handled by the relevant external service and the person's interaction with it; this website does not receive the message content through the link itself.
Why we collect it
We collect personal information to respond to enquiries, administer events and tickets, process donations, maintain the website and admin tools, communicate with supporters, and fulfil our legal and operational responsibilities.
Google Analytics and advertising tracking are not implemented on this website.
How we use it
The website is designed to use personal information for the tasks it supports, including:
- To respond to contact messages and support requests.
- To manage event registrations and validate booked tickets.
- To send ticket or confirmation emails where the relevant email service has been configured.
- To process and record donations and payment references.
- To maintain the resource directory, event information, blog content and admin records.
- To protect the security of the website, admin accounts and data in the project systems.
Retention and deletion
The following retention periods apply:
- Contact submissions are retained for 12 months.
- Ticket records are retained for 12 months after the event.
- Donation records are retained for five years.
- Admin and staff account records are retained for as long as the person administers the foundation, and are removed when that ends.
Third parties and service providers
The website includes or connects to the following services where they are relevant to the task being carried out:
- Firebase and Google Cloud services for authentication, Firestore data storage, and related project infrastructure.
- Cloudflare Pages and Cloudflare Workers for hosting, website delivery, file handling and automation.
- Brevo for transactional email messages where email delivery is configured.
- The foundation's own bank, for donations and merchandise payments made by electronic transfer. No payment gateway is used, and no card details are collected by this website or the app at any point.
Data processed outside South Africa
Some technology providers may process information outside South Africa, depending on their infrastructure and configuration.
Where that happens, it is permitted under section 72 of POPIA because the provider is bound by rules or a contract that uphold principles for lawful processing substantially similar to those in the Act, or because the transfer is necessary to perform a contract with you or in your interest.
Your rights
Under the Protection of Personal Information Act, 2013, a person may have rights to request access to personal information, ask for correction of inaccurate information, and ask for deletion or restriction where the law allows it.
Requests may be directed to the Information Officer using the details below.
Contact the Information Officer
PAIA defines the head of a private body as its chief executive officer or equivalent officer, or the person acting as such, and POPIA adopts that definition for the Information Officer. The Information Officer of the foundation is therefore the head of the foundation.
If you are not satisfied with how the foundation has handled your personal information, you may complain to the Information Regulator, whose contact details are published on its website.
Security and safeguards
The project uses Firebase Authentication for admin access, Firestore for data storage, and Cloudflare-hosted services for website delivery and related API endpoints. These technical components have their own configuration and access controls.
No website or service can guarantee that all security risks are eliminated.