Privacy Policy &
POPIA Compliance

The Progressive Women's Movement of South Africa (PWMSA) operates as an incorporated broad-based national civil movement established in 2006 in Bloemfontein. This comprehensive Privacy Policy governs the collection, processing, storage, dissemination, and destruction of personal information by PWMSA in rigorous compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Promotion of Access to Information Act 2 of 2000 (PAIA), and the Constitution of the Republic of South Africa. This policy applies without exception to all natural persons and juristic entities whose personal information is processed by PWMSA, including registered members, campaign participants, donor organisations, corporate CSI partners, event attendees, digital website visitors, and survivors accessing our legal assistance and referral desks.

PWMSA is the 'Responsible Party' as defined in Section 1 of POPIA. The organisation determines the lawful purpose and technical means for processing personal information. In accordance with Sections 55 and 56 of POPIA, PWMSA has registered an Information Officer with the Information Regulator of South Africa. All statutory notices, data access requests, or regulatory queries must be directed to: • Designated Information Officer: Office of the Chief Executive Officer / National Administrative Desk • Attention: Sophia Hlonipha Koko / ALulama Nare • Physical Address: PWMSA National Secretariat, Republic of South Africa • Electronic Mail: info@pwmsa.org.za / popia@pwmsa.org.za • Telephone: 061 942 0421 / +27 79 554 4302

PWMSA adheres strictly to the eight statutory conditions for lawful processing set out in Chapter 3 of POPIA: 1. Accountability: Ensuring full compliance at all stages of data handling. 2. Processing Limitation: Processing is conducted lawfully, reasonably, and with informed consent or statutory justification. 3. Purpose Specification: Personal information is collected solely for explicit, defined, and lawful organizational purposes. 4. Further Processing Limitation: Information is not repurposed in a manner incompatible with the initial collection consent. 5. Information Quality: Taking reasonable measures to ensure personal information remains complete, accurate, and up to date. 6. Openness: Full transparency regarding collection practices and Information Officer registration. 7. Security Safeguards: Maintaining state-of-the-art administrative and digital safeguards against unauthorized access, destruction, or breach. 8. Data Subject Participation: Ensuring accessible mechanisms for individuals to access, verify, or demand deletion of their personal records.

Depending on the nature of your interaction with PWMSA, we collect and process the following categories of data: • Identifiers: First name, surname, national identity number or passport number, date of birth, and nationality (primarily for formal membership registers, bursary applications, and enterprise incubator compliance). • Contact Information: Physical residential address, postal code, mobile telephone numbers, and email addresses. • Civic & Demographic Profile: Provincial residence, local municipal ward, language preference, and organizational affiliation. • Financial & CSI Information: For donors, sponsors, and cooperative grant beneficiaries—banking details, B-BBEE verification certificates, tax compliance documentation, and accounting records. • Sensitive & Victim Support Information: Where survivors of Gender-Based Violence voluntarily engage our victim support desk, we may record case docket numbers, police precinct references, medical referral records, and court attendance logs under strict special-personal-information confidentiality rules.

Under Section 26 of POPIA, the processing of Special Personal Information (including health data, biometric data, religious beliefs, or criminal behavior allegations) is strictly prohibited unless specific statutory exemptions apply. PWMSA processes Special Personal Information exclusively under the following conditions: • Explicit, voluntary written consent granted by the data subject or legal guardian. • For the establishment, exercise, or defense of legal claims concerning victims of sexual violence, abuse, or constitutional human rights violations. • In historical, statistical, or research contexts where the information is completely anonymised and de-identified so individual identification is impossible.

PWMSA maintains an absolute policy never to sell, commercialise, monetize, rent, or lease any personal information to commercial marketing brokers, data aggregators, or unauthorized third parties. Personal data is disclosed only to verified third parties strictly under formal written Data Processing Agreements: • Accredited psychosocial care facilities, shelter networks, and Thuthuzela Care Centres when assisting a survivor with explicit consent. • Registered pro-bono attorneys and advocate chambers representing victims in ongoing legal and court proceedings. • Statutory law enforcement authorities (SAPS, National Prosecuting Authority) when formally compelled by a valid subpoena or court warrant. • Certified cloud infrastructure and encrypted database service providers bound by strict confidentiality and POPIA-equivalent security protocols.

PWMSA implements robust multi-layer technical and physical security defenses to prevent data loss, unauthorized access, identity theft, or cyber manipulation: • 256-bit Secure Socket Layer (SSL/TLS) encryption on all website forms and communications. • Role-based access control restricting sensitive registers strictly to authorized National Working Committee executives. • Routine security audits, penetration assessments, and encrypted offsite backups. • Comprehensive physical locking mechanisms for paper files, court logs, and archivist records at national and provincial desks.

In accordance with Section 14 of POPIA, PWMSA does not retain personal information for longer than is necessary to achieve the designated purpose for which it was acquired. Our standardized retention schedule specifies: • General Website Inquiries & Contact Forms: Retained for 24 months, followed by permanent electronic deletion. • Membership & Volunteer Directories: Maintained for the duration of active affiliation plus 5 years for historical movement continuity. • Financial, Donor, and B-BBEE Audit Packs: Retained for 5 to 7 years in strict compliance with the Companies Act and SARS requirements. • GBVF Victim Support Files: Archived under high-security encryption for a minimum of 10 years to support ongoing legal appeals, subsequent civil litigation, or historical justice research.

Under POPIA, all individuals whose data is processed by PWMSA possess enforceable statutory rights: • Right to Confirmation & Access: You may request written confirmation of whether we hold personal information concerning you, and obtain an unredacted copy thereof. • Right to Rectification: You have the unconditional right to request the correction, amendment, or updating of inaccurate, irrelevant, or obsolete data. • Right to Erasure / Destruction: You may request the destruction or permanent deletion of your personal records where processing is no longer justified. • Right to Object: You may object on reasonable grounds to the processing of your personal information. • Right to Withdraw Consent: Where processing was grounded solely in consent, you may withdraw that consent at any juncture without penalty.

Our website utilizes essential session cookies and aggregated analytics to ensure smooth technical navigation, responsive form handling, and accessibility compliance. We do not deploy invasive third-party cross-site behavioral tracking cookies. Visitors may adjust their web browser settings to reject or delete cookies; however, certain interactive portals (such as the partnership submission form) may experience reduced operational functionality.

If you believe that PWMSA has processed your personal information in violation of POPIA, or has failed to respond adequately to your statutory rights request, you have the right to lodge a formal complaint with the Information Regulator of South Africa: • The Information Regulator (South Africa) • JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 • Postal Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017 • Complaints Email: POPIAComplaints@inforegulator.org.za • General Inquiries: enquiries@inforegulator.org.za • Website: https://inforegulator.org.za