Privacy
What we hold, and why
Giving to a charity should not cost you your privacy. This page says exactly what Operation Hunger collects, what we do with it, who else ever sees it, and how long we keep it. It is written to be read rather than to be agreed to.
Last changed 16 September 2026
What we collect
Almost everything here is something you typed in yourself. We do not buy lists, we do not enrich your record from anywhere else, and we do not build a profile of you from your browsing.
When you give
Your name, email address and phone number. The amount, the currency, what you chose to support, and whether it is a once-off or a monthly gift. If you asked to be shown on a supporters list, the name you chose to be shown as and any message you wrote.
We never see your card. Card and bank details are entered on PayFast's or PayPal's own pages, not ours. What comes back to us is a reference and a yes or no.
If you want a section 18A tax certificate
SARS requires a certificate to carry the donor's identity or registration number, income tax reference number and address, so if you ask for one we have to collect those. They are encrypted in our database, they are shown masked in our admin, and every time a staff member reveals one it is written to an audit log with their name against it.
If you do not want a certificate, do not tick the box, and we never ask for any of it.
If you set up a debit order
Your bank, branch, account number and identity number, and the mandate you signed: its wording, the date, and the address your browser connected from, which together are what proves you agreed to it. The account details are encrypted, and only the last four digits are shown anywhere in the admin.
Everything else
- The newsletter: your email address, and a record of when you confirmed it and from where.
- The contact form: what you wrote, and how to reply to you.
- A Hunger Hero page: your name, your story, and any photograph you upload.
- Emails we send you: whether it was delivered, opened, and whether a link was clicked.
- Our own logs: the address your browser connected from and what it asked for. Email addresses, identity numbers and account numbers are stripped out of these before they are written down.
Why we hold it
Under POPIA, every use needs a lawful reason. Ours are:
- To do what you asked. Take the gift, send the receipt, issue the certificate, run the monthly collection, publish your fundraiser.
- Because the law says so. SARS requires us to keep donation and section 18A records and to report on them twice a year.
- Because you said yes. The newsletter, and anything else you ticked. You can untick it whenever you like and nothing else changes.
- To keep the money safe. Checking that a payment notification really came from the gateway, and that an amount has not been tampered with.
We do not sell personal information, and we never will. We do not share it with other charities, and we do not run advertising that targets you because you gave.
Who else sees it
Only the organisations that have to, and only the part they need. Each of these is bound by a contract with us and by POPIA.
| Who | What they get |
|---|---|
| PayFast (South Africa) | Your name, email and the amount, so a card or instant EFT payment can be taken. |
| PayPal | The same, for gifts from outside South Africa. |
| Our bank | Debit order instructions: the account, the amount and the date. |
| Our email provider | Your email address and the message being sent to you. |
| SARS | Section 18A certificate records, twice a year, because we are required to file them. |
| Our auditors | Donation records, during the annual audit. |
The map on our contact page is drawn by OpenStreetMap, which will see the request for the map tiles. Videos are embedded through YouTube's and Vimeo's no-cookie domains, so watching one does not follow you afterwards.
How long we keep it
Not "as long as necessary". These are the actual periods, and the system deletes on them by itself rather than waiting for somebody to remember.
| What | How long |
|---|---|
| Donations and tax certificates | Five years, which is what SARS requires |
| Debit order mandates | Five years after the last collection |
| Contact form messages | Two years |
| Newsletter opens and clicks | Eighteen months |
| Payment notifications from the gateways | Ninety days |
| Sign-in links | Thirty days, and each one expires fifteen minutes after it is sent |
| Server logs | Fourteen days |
When you ask to be deleted, everything that can go, goes. The financial record of a gift stays, because we are not allowed to destroy it, but your name, email, phone number, address and identity number are removed from it and it becomes an anonymous line in the books.
Your rights
POPIA gives you these, and we will not make you fight for any of them:
- A copy of everything. Ask, and we send you a file with every record we hold about you, usually within a week.
- A correction. Tell us what is wrong and we fix it.
- Deletion. As described above.
- To stop the emails. One link at the bottom of any of them, no sign-in and no questions.
- To object, or to withdraw a consent you gave.
- To complain to the Information Regulator of South Africa, whether or not you have raised it with us first.
If you have an account you can download your own donation history and every certificate at any time from your giving. For anything else, email us and say what you want.
The Information Regulator can be reached at inforegulator.org.za or on complaints.IR@justice.gov.za.
Contact
Our Information Officer is named in our registration with the Information Regulator. Write to them about anything on this page and they will answer.
Operation Hunger, NPO 001-306 NPO. If we change this policy we will change the date at the top of this page, and if the change affects something you consented to we will ask you again rather than assume.