This policy explains what personal information Dlala Nje collects, why we collect it, who sees it and what your rights are. We follow the Protection of Personal Information Act, 2013 (POPIA). We write it in plain language, so if anything is unclear, email info@dlalanje.org.
Who we are
Dlala Nje runs tours, events and a shop in Johannesburg. The Dlala Nje Foundation is a registered non-profit organisation (NPO-159-432). In this policy, “we” means Dlala Nje and the Dlala Nje Foundation. We are the “responsible party” under POPIA, which means we decide why and how your information is used.
Address: Shop 1, Ponte City, 1 Lily Avenue, Berea, Johannesburg 2198. Email: info@dlalanje.org. Phone: +27 67 082 8168.
[NEEDS CONTENT: full legal name and registration details of the entity that runs the tours and the shop, if different from the Foundation]
Our Information Officer
Our Information Officer makes sure we follow POPIA and answers your questions about your information.
[NEEDS CONTENT: Information Officer name]. Contact: info@dlalanje.org.
What information we collect, and why
Tour and event bookings
When you book a tour or event on this website, we collect your name, email address, phone number, the date and size of your group, the ages of guests, any add-ons you choose and the payment status. We use this to confirm your booking, run the tour, contact you if something changes and keep financial records. Our legal basis is that we need the information to carry out the booking you asked for, and that the law requires us to keep financial records.
Shop orders
When you buy something in our online shop, we collect your name, email address, phone number, billing address and delivery address if you choose delivery. We use this to process your order, send it to you or arrange collection, and handle returns. The legal basis is the same: we need it to complete your purchase.
Contact, enquiry, volunteer and trade forms
When you fill in a form, we collect what you type: usually your name, email address, a message and sometimes your phone number, organisation or the date you have in mind. We use it to reply to you. The legal basis is your request.
Indemnity form
The indemnity form collects your full name, email, phone number, tour name and date, booking number and your typed signature. If you sign for children under 18, it also collects their number and names. We keep it as proof that you accepted the risks and rules of the tour. The legal basis is our legitimate interest in running tours safely, and your consent when you submit the form. Do not put health details in the form. If you tell us about a health or mobility need so that we can help you, we use it only for that purpose.
Newsletter
If you sign up for news, we collect your name and email address. We send you news about tours, events and the kids’ centres. The legal basis is your consent. You can unsubscribe at any time with the link in each email, or by emailing us.
Cookies and website analytics
Our website uses cookies that it needs to work, for example to keep items in your basket and remember your booking. We use Google Site Kit and Google Analytics to count visits and see which pages are useful. Google receives your IP address and information about your device and browser for this. [NEEDS CONTENT: confirm which analytics and marketing cookies are switched on at launch, and whether a cookie notice is needed]
Zero Spam checks form submissions to block spam. It may use your IP address and browser details for this check only.
Photos and film
On some tours and events, we take photos and film. We ask for permission before we publish identifiable photos, and we ask a parent or guardian before we publish photos of children. You can ask us to remove a photo at any time.
Who we share your information with
We do not sell your information. We share it only with people who help us run the service, and only what they need:
- payment providers, for card and online payments: PayFast and PayPal [NEEDS CONTENT: confirm which payment providers are live]
- our website host and email provider, who store and send the information on our behalf
- Google, for website analytics and maps
- our tour guides, who see the names and group details they need to run your tour
- our accountants and professional advisers, and public authorities when the law requires it
These companies must keep your information safe and use it only for the work we give them. [NEEDS CONTENT: names of the web host and email service]
Sending information outside South Africa
Some of the companies above, such as Google and our host, store information on servers outside South Africa. We only use providers that protect personal information to a standard similar to POPIA. [NEEDS CONTENT: hosting country and any other countries where data is stored]
How long we keep your information
- Booking, order and payment records: [NEEDS CONTENT: confirm period; tax and company law usually require 5 to 7 years]
- Indemnity forms: [NEEDS CONTENT: retention period for indemnity forms]
- Enquiries and volunteer forms: [NEEDS CONTENT: retention period]
- Newsletter: until you unsubscribe.
- Donor records and Section 18A certificates: [NEEDS CONTENT: retention period, at least 5 years]
After that, we delete the information or make it anonymous.
How we protect your information
The website uses HTTPS, so what you send us is encrypted in transit. Only staff who need your information can open it. We update the website and its plugins regularly. If your information is ever lost or accessed without permission, we tell you and the Information Regulator as POPIA requires. [NEEDS CONTENT: confirm access controls and backup arrangements]
Your rights
Under POPIA, you can:
- ask whether we hold information about you, and ask for a copy
- ask us to correct information that is wrong or out of date
- ask us to delete information we no longer need
- object to us using your information, or withdraw your consent, for example to stop newsletters
- complain to the Information Regulator
To use any of these rights, email info@dlalanje.org. We reply as soon as we can. [NEEDS CONTENT: reply time, for example 30 days] We may ask you to prove who you are first, so that nobody else can ask for your information.
Complaints
Please contact us first and we will try to fix the problem. You can also complain to the Information Regulator (South Africa): website inforegulator.org.za, email POPIAComplaints@inforegulator.org.za. [NEEDS CONTENT: check the Information Regulator’s current contact details before launch]
Children
Our website is for adults. Children under 18 can join tours with a parent or guardian, and the adult gives us the child’s details when booking or signing the indemnity form. We do not knowingly collect information from children through our forms. Photos of children are published only with a parent’s or guardian’s permission.
Changes to this policy
We may update this policy. We put the new version on this page and change the date below. Last updated: [NEEDS CONTENT: date of last update].
Related pages
Booking rules and cancellations: Terms and conditions for tours. Full tour terms: full terms and conditions. Shop returns: return policy for shop orders.
See all our terms and policies in one place.
[NEEDS CONTENT: legal sign-off by our lawyer, and approval by the Information Officer]