01Who we are and what this covers
DonorAssured is a service of Tax A Sured (Pty) Ltd ("we", "us"), a registered tax practice (SARS practitioner number PR-0005815) at Unit 31, Muirfield House, Midpark Business Village, 2 Greens Close, Cape Town, 7500. Under the DonorAssured name we file IT3(d) third-party data returns with the South African Revenue Service (SARS) and issue Section 18A certificates on behalf of public benefit organisations and non-profits ("organisations", "you"). To do that we handle personal information about the organisation's people and about its donors.
This policy is specific to the DonorAssured service. Tax A Sured's general privacy policy covers its other work.
This policy covers that information, and the information we collect when you use this website or send us an enquiry. It applies alongside our terms of service.
02What we process
| Category | Examples | Where it comes from |
|---|---|---|
| Organisation contacts | Names, roles, email addresses and phone numbers of the people we deal with; the authorised signatory named on certificates | You |
| Organisation details | Registered and trading names, registration numbers, PBO exemption reference, income tax reference, addresses, logo | You |
| Donor information | Donor names, identity or passport numbers, company registration numbers, income tax reference numbers, addresses, email addresses and phone numbers | You, from your donation records |
| Donation records | Receipt numbers, dates, amounts, whether a donation was cash or in kind | You |
| SARS responses | What SARS accepted or queried on a return | SARS, through your return |
| Enquiries | What you send us through the form on this website: name, organisation, email address, approximate donation volume, message | You |
| Website use | Aggregated visit statistics from Google Analytics with IP addresses anonymised | Your browser |
We do not process banking details, and we do not collect anything about children knowingly. Donor records occasionally include a minor's details where a parent donated in a child's name; we process those only because SARS requires them on the return.
03Why we process it, and on what basis
- To do the work you engaged us for. Checking your donation records, preparing and filing your IT3(d) return, issuing Section 18A certificates and handling SARS's response. The basis is our contract with you.
- Because the law requires it. Section 18A of the Income Tax Act and SARS's third-party data rules set out what must be reported for each donation and what a certificate must contain. We process donor information to that specification and no further.
- To run the service. Keeping records of what was filed and issued, answering your questions, invoicing you, and keeping our systems secure. The basis is our legitimate interest in running the service properly and yours in having a record of what was filed.
- To answer your enquiry. If you contact us through the website, we use what you send to reply. The basis is that you asked us to.
We do not use personal information for marketing, profiling or any automated decision that affects a person. We do not sell it.
04Our role under POPIA
For donor information and donation records, your organisation is the responsible party and DonorAssured is your operator. We process that information only on your instruction and for the purposes above. You remain responsible for having the right to give it to us, which for Section 18A donations you do: a donor who asks for a certificate is asking for their donation to be reported.
For the details of your organisation's own people and for website enquiries, DonorAssured is the responsible party.
05Who we share it with
- SARS. Your IT3(d) return, containing the donor and donation details SARS requires, is filed with SARS. That is the purpose of the service.
- Infrastructure providers. We use cloud infrastructure located in South Africa to store and process information. Those providers hold it on our behalf under their own security commitments and do not use it for anything else.
- Nobody else, unless a law, court order or regulator requires it, in which case we tell you where we lawfully can.
Certificates are issued in your organisation's name. How they reach your donors is between you and them; we do not contact your donors directly unless you ask us to.
06Where it's kept and how it's protected
Donor information and donation records are stored and processed in South Africa. They are encrypted in transit and at rest, access is limited to the people who need it to do the work, and every system that handles them is logged. We do not transfer donor information outside South Africa.
Email with you travels the way email does, through our and your email providers. Please don't send donation records through the public enquiry form; we will give you a secure way to send them once we are working together.
07How long we keep it
| Information | Kept for | Why |
|---|---|---|
| Donation records and donor information | The tax year they relate to, plus the time SARS allows for corrections and queries on that year's return; then deleted | So corrections can be filed and SARS queries answered without asking you for the records again |
| Record of what was filed and issued | Five years from the end of the tax year | SARS and audit requirements; so a certificate can be verified if a donor or SARS asks |
| Organisation details and contacts | While we work for you, plus one year | To run the service and answer questions after it ends |
| Invoices and payment records | Five years | Tax and accounting law |
| Website enquiries | Twelve months, or until we start working together | To follow up |
| System logs | Up to twelve months | Security and troubleshooting |
You can ask us to delete donation records earlier. We will, unless a return they appear on is still open with SARS or the law requires us to keep them, and we will tell you which.
08Your rights
Anyone whose information we hold, whether an organisation's contact or a donor, can ask us:
- whether we hold information about them, and for a copy of it;
- to correct it if it is wrong;
- to delete it, subject to the retention rules above;
- to object to processing based on our legitimate interests.
Email info@donorassured.co.za. We will need enough to confirm who you are. Where the information was given to us by an organisation as its operator, we will also tell that organisation, because the request is really to them and the correction usually has to be made in their records. We respond within 30 days.
09This website
The site uses Google Analytics to count visits and see which pages are read, with IP addresses anonymised. It sets a cookie for that purpose. The site sets no other cookies and has no accounts or logins. If you prefer not to be counted, a browser extension that blocks analytics will do it.
The enquiry form sends what you type to us by email and nowhere else.
10Security incidents
If personal information we hold is accessed or disclosed without authorisation, we will notify the Information Regulator and the affected organisation as soon as reasonably possible after we become aware of it, as POPIA requires, and tell you what happened, what information was involved and what we are doing about it.
11Changes to this policy
If we change this policy in a way that matters, we will email the organisations we work for and update the date at the top of this page. Earlier versions are available on request.
12Contact and complaints
Questions about this policy or about how we handle information: info@donorassured.co.za.
Our Information Officer is Tracey Jones, tracey@taxassurance.co.za, 087 379 5962.
If you are not satisfied with our answer, you may complain to the Information Regulator of South Africa: inforegulator.org.za, complaints.IR@justice.gov.za.
13PAIA manual
As required by section 51 of the Promotion of Access to Information Act 2 of 2000, Tax A Sured (Pty) Ltd maintains a manual describing the records it holds, including those held for the DonorAssured service, and how access to them may be requested. The manual names the Information Officer and sets out the company's address.
You can download the manual as a PDF from taxassurance.co.za, or request a copy free of charge from info@donorassured.co.za.
Requests for access must be made on the prescribed form and sent to the Information Officer at tracey@taxassurance.co.za. The forms and the fee schedule are published by the Information Regulator.