Last updated: November 2026
Inala Mental Health Foundation NPC (“Inala”, “we”, “us”) respects your privacy. This policy explains how we collect, use, share and protect your personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who we are
- Responsible party: Inala Mental Health Foundation NPC
- NPC registration number: 2018/470780/08
- PBO number: 930064509
- Information Officer: Siddeeqa Gierdien
- Information Officer email: siddeeqa@inala.org.za
2. Personal information we collect
Depending on how you engage with us, we may collect:
- Contact details, such as your first name, last name, email address and company, when you complete our contact form or email us.
- Donation details, such as your name, email address and the amount you give. Card payments are processed by Payfast. Inala never sees or stores your card or banking details.
- Details needed to issue a Section 18A tax certificate, such as your full name or company name, your ID number or company registration number, your tax reference number and your postal address.
- Information about programme participants, parents and guardians, which may include special personal information such as health information, and personal information about children.
3. How we collect personal information
We collect personal information directly from you when you complete a form, make a donation, email us, attend an event or take part in a programme. Where a participant is a child, we collect information from a parent, guardian or other competent person.
4. Why we use your personal information
- To respond to your enquiries and messages.
- To process donations and issue Section 18A tax certificates.
- To deliver our programmes, counselling and support services.
- To send you updates about our work and events, where you have agreed to receive them.
- To meet our legal, tax and reporting obligations.
- To keep our website secure.
5. Our lawful basis
We only process personal information where POPIA allows it. This includes where you have given consent, where processing is needed to provide a service you asked for, where the law requires it, or where it is in our legitimate interest and does not override your rights.
6. Special personal information and children
Health information and information about children require extra care under POPIA. We only process this information with the consent of the person concerned or of a competent person such as a parent or guardian, or where the law otherwise allows it. Access is limited to the people who need it to provide care and support.
7. Who we share it with
We do not sell your personal information. We may share it with:
- Service providers who help us operate, such as our website host Afrihost, our email provider Microsoft and Payfast for online donations.
- The South African Revenue Service, where needed for Section 18A tax certificates.
- Professional advisers, auditors or authorities, where the law requires it.
Anyone we share information with must keep it confidential and secure.
8. Transfers outside South Africa
Some of our service providers may store information outside South Africa. Where this happens, we make sure the recipient is bound by laws or agreements that give a similar level of protection to POPIA.
9. How we protect your information
We take reasonable technical and organisational steps to protect your personal information from loss, misuse and unauthorised access. These include password protected computers and accounts, access limited to staff who need it, and locked storage for paper records.
10. How long we keep it
We keep personal information only for as long as we need it for the purpose it was collected, or as long as the law requires. Donation, tax and financial records are kept for seven years, in line with the Companies Act and the Tax Administration Act. Programme and counselling records are kept for six years after our last contact with the person. Records about children are kept until the child turns 21, or for six years after our last contact, whichever is longer. After this, we delete or destroy them securely.
11. Your rights
Under POPIA, you have the right to:
- Ask whether we hold personal information about you, and request a copy.
- Ask us to correct or delete information that is inaccurate, out of date or no longer needed.
- Object to us processing your information, including for direct marketing.
- Withdraw your consent at any time. This does not affect processing that took place before you withdrew it.
- Lodge a complaint with the Information Regulator.
To use any of these rights, email our Information Officer at siddeeqa@inala.org.za. We will respond within a reasonable time.
12. Direct marketing
We will only send you newsletters or event updates if you have agreed to receive them. Every message includes a way to unsubscribe.
13. Cookies
Our website does not currently use cookies to track or analyse visitors. If we introduce cookies in the future, we will update this policy to explain what they are used for.
14. The Information Regulator
If you are not satisfied with how we handle your personal information, you may contact the Information Regulator (South Africa) through its website, www.inforegulator.org.za.
15. Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page, with the date it was last updated.