In terms of Section 14 of the Bill of Rights of the Constitution, you have the constitutional right to data privacy.
Impact & Legacy Collective is committed to protecting this right and ensures that any personal information we hold about you is processed appropriately and in accordance with applicable laws.
By accepting our Terms and Policies, you give us your informed consent to process your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).
Please note: This notice applies to all interactions via email, our website, and social media platforms.
1. Defining the Terms Used Throughout This Policy
The following terms are listed alphabetically and are commonly used throughout this Policy. Unless used in a clearly different context, they carry the meanings as defined below:
1.1 “Impact & Legacy Collective” – refers to us, the company Impact & Legacy Collective, with registration number n/a, and our registered physical address at: Sonia Street, Gillview, Johannesburg, Gauteng, 2091.
1.2 “Child” – any person under the age of eighteen (18) years.
1.3 “Cookies” – a cookie is a small text file sent by a web server and stored in the browser used to access a website. Some cookies ensure proper website functionality, while others store user preferences or collect anonymous usage and behavioural statistics.
1.4 “Data Breach” – refers to the compromise of personal information through either physical or digital means. This may include unauthorised access, loss, disclosure, or alteration of the personal information held by Impact & Legacy Collective.
1.5 “Data Subject” – as cold as it may sound, this refers to you, the individual reading this document or using this website.
1.6 “Direct Marketing” – unsolicited emails, phone calls, or other communications intended to sell you a product or service – the modern version of hawking.
1.7 “Direct Marketer” – any person or business that uses direct marketing to promote products or services.
1.8 “Employees” – all individuals employed by Impact & Legacy Collective.
1.9 “SA Government” – the Government of the Republic of South Africa (RSA).
1.10 “Operator” – a person or entity that processes personal information on behalf of a Responsible Party, without being under the authority of that Responsible Party.
1.11 “PAIA” – stands for the Promotion of Access to Information Act, No. 2 of 2000.
1.12 “Personal Information” – any information that can be used to identify you as a Data Subject. This includes, but is not limited to: names, contact details, company information, religious and political views, personal opinions, correspondence, health and employment records, and financial information.
1.13 “Policy” – this Privacy Policy you are reading.
1.14 “POPIA” – the Protection of Personal Information Act, No. 4 of 2013.
1.15 “Processing” – any operation or activity (automated or manual) involving personal information, including:
(a) Collecting, recording, storing, retrieving, altering, or consulting data;
(b) Distributing, sharing, or making information available;
(c) Linking, merging, or destroying data.
1.16 “Regulator” – the Information Regulator established under POPIA, responsible for monitoring and enforcing compliance with the Act.
1.17 “Responsible Party” – an individual or entity that determines why and how personal information is processed.
1.18 “Special Personal Information” – sensitive personal data, including biometric information, criminal records, ethnic origin, race, health data, union membership, political or philosophical beliefs, and sexual orientation.
1.19 “Third Party” – any agent, consultant, contractor, sub-contractor, or service provider engaged by the Responsible Party.
2. The Purpose of This Policy
2.1 The primary purpose of this Policy is to inform Data Subjects how Impact & Legacy Collective collects and processes Personal Information.
2.2 Acting as the Responsible Party (and/or Operator, where applicable), Impact & Legacy Collective is committed to observing and complying with all obligations set out under the Protection of Personal Information Act (POPIA). We follow recognised principles, practices, and guidelines when processing Personal Information, whether on our own behalf or on behalf of any Data Subject.
2.3 Impact & Legacy Collective collects only the information necessary to deliver our services and products effectively. This Policy applies to all Personal Information obtained:
Directly from you, the Data Subject; or
Indirectly through a third party who acts on your behalf or provides services to us.
2.4 In certain cases, we use third-party service providers to assist in delivering our services. Please note that this Privacy Policy does not extend to those providers, as they operate under their own policies. We make use of the following third-party tools and services:
Google Analytics, Mailchimp, Google Ads, PayFast / PayGate
3. How We Collect Personal Information
3.1 Impact & Legacy Collective collects relevant Personal Information directly from Data Subjects in order to perform a service or complete a purchase. We may also collect Personal Information that the Data Subject has made publicly available or that forms part of public records.
3.2 Impact & Legacy Collective will always collect Personal Information in a lawful and responsible manner. We are committed to safeguarding this information and will only process it on legitimate legal grounds.
3.3 In certain cases, Impact & Legacy Collective may obtain Personal Information from third parties. However, this will only be done with the Data Subject’s consent or where permitted in terms of clause 3.1 above.
3.4 Examples of third-party sources include:
Public resources (e.g. Companies and Intellectual Property Commission),
Clients whom Impact & Legacy Collective provides services to, and
Recruitment agencies.
4. How We Process Personal Information
4.1 When acting as the Responsible Party, Impact & Legacy Collective will only process a Data Subject’s Personal Information (excluding Special Personal Information) under one or more of the following legal bases:
4.1.1 The Data Subject has given consent, or in the case of a child, a competent person has provided consent;
4.1.2 Processing is necessary to take steps to conclude or perform a contract with the Data Subject;
4.1.3 Impact & Legacy Collective is legally obligated to process the information;
4.1.4 Processing protects a Data Subject’s legitimate interests; and/or
4.1.5 Processing is necessary for the legitimate interests of Impact & Legacy Collective or a third party receiving the information.
4.2 Impact & Legacy Collective will only process Personal Information where one of the above lawful bases applies.
4.3 Impact & Legacy Collective will always strive to ensure that Data Subjects are informed about why and how their Personal Information is being processed.
5. Personal Information of Children and Special Personal Information
5.1 Impact & Legacy Collective will generally not process the Personal Information of a Child or any Special Personal Information unless one or more of the following conditions apply:
5.1.1 The Data Subject has given explicit consent;
5.1.2 Processing is necessary for the establishment, exercise, or defence of a legal right or obligation;
5.1.3 Processing is required for historical, research, or statistical purposes, with appropriate safeguards in place;
5.1.4 The Personal Information has been made public by the Data Subject; or
5.1.5 Specific authorisation is granted under POPIA.
5.2 In line with POPIA, Impact & Legacy Collective may not process a Child’s Personal Information without the consent of a legal guardian or parent. All such processing will be carried out in full compliance with the applicable laws.
6. The Purpose for Processing Personal Information
6.1 In fulfilment of its POPIA obligations, Impact & Legacy Collective ensures that Data Subjects are fully informed about how their Personal Information is collected and processed.
6.2 Impact & Legacy Collective will process Personal Information only for clear, lawful purposes and will ensure that Data Subjects are aware of those purposes.
6.3 A legal basis will always exist for the Processing of Personal Information, and such information will not be used for any other purpose beyond what has been communicated to the Data Subject.
6.4 Processing of Personal Information will be directly related to Impact & Legacy Collective’s business operations and will always consider the Data Subject’s best interests. This includes, but is not limited to, the following purposes:
6.4.1 Providing products, services, support, and conducting credit vetting where necessary;
6.4.2 Onboarding suppliers and service providers;
6.4.3 Facilitating procurement and supply chain operations;
6.4.4 Processing payments to suppliers and service providers;
6.4.5 Facilitating delivery of orders;
6.4.6 Monitoring and analysing the use of Impact & Legacy Collective’s electronic systems (this may include third-party tools or services);
6.4.7 Preventing, detecting, or investigating violations of this Policy, legal provisions, or internal company policies;
6.4.8 Employment-related activities such as recruitment and background checks;
6.4.9 Internal audits and risk mitigation processes;
6.4.10 External audits where Personal Information may be shared with third-party auditors;
6.4.11 Internal administrative purposes;
6.4.12 Compliance with any applicable law, court order, government, or regulatory authority requirements.
7. Maintaining Personal Information
7.1 Impact & Legacy Collective is committed to ensuring that all Personal Information in its possession is accurate, up to date, and complete to the extent reasonably possible, based on the information collected.
7.2 While Impact & Legacy Collective may not routinely request updates from Data Subjects, it reserves the right to do so where it deems it necessary to maintain accuracy.
7.3 It is expected that Data Subjects will take responsibility for notifying Impact & Legacy Collective of any changes to their Personal Information to ensure the data remains current and correct.
8. Processing and Storing Personal Information by Impact & Legacy Collective and Third Parties
8.1 Impact & Legacy Collective may store Personal Information in electronic or hard copy format. Data may also be stored on secure third-party servers, cloud platforms, or technology providers contracted to support Impact & Legacy Collective’s operations in website development, graphic design, digital marketing, and hosting services.
8.2 Third-party servers and cloud storage providers engaged by Impact & Legacy Collective may process Personal Information solely for the original purpose for which it was collected.
8.3 Impact & Legacy Collective will ensure that all Third Party Service Providers who handle Personal Information do so in accordance with this Policy, internal security protocols, and the provisions of POPIA.
8.4 Such Third Party Service Providers are required to process Personal Information only for the purposes specified by Impact & Legacy Collective, and to implement appropriate data security measures equivalent to those employed by Impact & Legacy Collective itself.
8.5 Impact & Legacy Collective, its affiliates, and service providers may be located in South Africa or internationally. As a result, Personal Information may be processed outside the borders of South Africa. Regardless of geographic location, Impact & Legacy Collective will take all reasonable precautions to ensure that such information is handled with a standard of protection equal to, or higher than, that required by applicable laws including POPIA.
9. The Use of Personal Information for the Purpose of Direct Marketing
9.1 Impact & Legacy Collective, acting in its capacity as a Direct Marketer, will strive to comply with its POPIA obligations when undertaking any direct marketing activities.
9.2 Impact & Legacy Collective acknowledges that a Data Subject must first provide permission — as indicated in {uses_direct_marketing} — in order to receive Direct Marketing communications from Impact & Legacy Collective.
9.3 Where consent is provided, Impact & Legacy Collective may use Personal Information to contact a Data Subject and promote its products and services using the selected methods in {marketing_methods} (e.g., email, SMS, WhatsApp, phone calls).
9.4 If the Data Subject is an existing client, Impact & Legacy Collective will only use the Personal Information collected during the provision of a product or service in relation to similar services offered by Impact & Legacy Collective.
9.5 Impact & Legacy Collective will give a Data Subject the opportunity to object to their Personal Information being used for Direct Marketing purposes. If a Data Subject previously gave consent and no longer wishes to receive such communication, they can unsubscribe using a clearly visible link provided in each Direct Marketing message.
9.6 If a Data Subject has opted out or requested not to receive Direct Marketing, Impact & Legacy Collective will respect this request and immediately cease all Direct Marketing communication.
10. Retaining Personal Information
10.1 Impact & Legacy Collective is allowed to keep a record of Personal Information, whether in electronic or hardcopy format. This may include, but is not limited to:
{personal_data_collected}
This data is retained strictly for purposes such as:
{data_usage}
10.2 Impact & Legacy Collective may not retain Personal Information longer than necessary for the purpose it was collected. Once the purpose has been fulfilled, the data must be securely destroyed in a manner that prevents reconstruction or re-identification.
This retention limitation does not apply where:
10.2.1 The Personal Information is required by law or a regulatory authority;
10.2.2 It is necessary for Impact & Legacy Collective to carry out its lawful functions and activities;
10.2.3 A valid contract exists between Impact & Legacy Collective and the Data Subject requiring retention;
10.2.4 The Data Subject has explicitly consented to the retention;
10.2.5 The information is being retained for archival, analytical, research, historical, or statistical purposes — provided that it remains safeguarded against use for any other reason and complies with the limitations set out in this Policy and applicable law.
10.3 Where the record is retained for research, historical or analytical purposes, all reasonable safeguards will be in place to ensure the continued protection of the Data Subject’s rights and to prevent misuse.
10.4 Impact & Legacy Collective will ensure that any personal information is securely destroyed as soon as the original purpose has been met. Destruction methods will ensure the information cannot be reconstructed or linked back to the Data Subject. Non-identifiable, anonymised data may be retained and used indefinitely by Impact & Legacy Collective.
11. Failure to Provide Personal Information
11.1 In order to deliver products and services effectively, Impact & Legacy Collective is required to collect Personal Information lawfully from its Data Subjects. Failure to provide such information may result in Impact & Legacy Collective being unable to fulfil the requested service or product.
11.2 Without the necessary Personal Information, Impact & Legacy Collective may not be able to perform its duties — including providing services or products to clients, or fulfilling its responsibilities as an employer.
12. Keeping Personal Information Safe
12.1 Impact & Legacy Collective is committed to safeguarding all Personal Information from loss, damage, alteration, and unauthorised access by third parties.
12.2 To protect the Personal Information of its Data Subjects, Impact & Legacy Collective has implemented appropriate security measures — including physical, digital, and contractual safeguards — designed to prevent loss, theft, unauthorised use, disclosure, copying, alteration, or destruction of such data.
13. Breach of Personal Information
13.1 A Data Breach refers to any incident where there are reasonable grounds to believe that Personal Information has been compromised, acquired, or accessed by an unauthorised third party.
13.2 Data Breaches may result from various incidents, including but not limited to:
(a) Cyberattacks such as hacking, phishing, or malware
(b) Equipment failure
(c) Loss or theft of devices containing Personal Information
(d) Natural disasters or unforeseen events (e.g., flooding)
(e) Human error
13.3 In the event of a breach, Impact & Legacy Collective will respond in accordance with POPIA guidelines.
13.4 Where applicable, Impact & Legacy Collective will notify both the affected Data Subjects and the Information Regulator as soon as reasonably possible, unless advised otherwise by authorities in writing.
13.5 Notifications will be issued promptly once Impact & Legacy Collective becomes aware of a Data Breach involving Personal Information.
13.6 If Impact & Legacy Collective acts as an Operator, it will notify the relevant Responsible Party immediately upon becoming aware of any breach involving a Data Subject’s Personal Information.
14. Providing Personal Information to Third Party Service Providers
14.1 Impact & Legacy Collective may disclose Personal Information to third-party service providers, provided they have agreed to process such information in line with this Policy and POPIA requirements.
14.2 These third-party providers may support Impact & Legacy Collective in the following capacities:
14.2.1 Data storage and hosting
14.2.2 Accounting, auditing, and bookkeeping services
14.2.3 Staff training and skills development
14.2.4 Communication and notifications to Data Subjects regarding relevant matters
14.3 Personal Information will not be shared with any third party without the Data Subject’s consent, unless otherwise required or permitted by law.
14.4 In some cases, Personal Information may be transferred outside of South Africa for storage or processing.
14.5 Impact & Legacy Collective will obtain the necessary consent from the Data Subject before transferring Personal Information across borders, in accordance with the cross-border data flow provisions of POPIA.
14.6 Data Subjects should note that Personal Information processed in a foreign jurisdiction may be subject to that country’s laws and could be accessed by government agencies, courts, or law enforcement as permitted by local regulations.
15. Website Cookies
15.1 This website makes use of cookies to enhance the user experience and anonymously track website usage and behaviour. Cookies help us to understand how users interact with our content and services. This includes cookies from Google Analytics, Mailchimp, Google Ads, PayFast / PayGate, which are essential for the website to function properly.
15.2 You may refuse the use of cookies by adjusting your browser settings to block or disable them. However, please note that certain functions or sections of the website may become inaccessible or may not function correctly without cookies.
15.3 By continuing to use this website, accepting cookies, or failing to disable them, you consent to the processing of your personal information collected via cookies, in accordance with the provisions of this Privacy Policy.
16. Accessing Personal Information
16.1 In terms of the Promotion of Access to Information Act (PAIA), No. 2 of 2000, Data Subjects have specific rights regarding access to their personal information. These include:
16.1.1 Right of Access
A Data Subject, upon providing positive identification, has the right to:
(i) Enquire whether Impact & Legacy Collective holds any Personal Information about them;
(ii) Request confirmation and details of what information is held;
(iii) Know which third parties may have access to that information.
Specifically, a Data Subject may request:
16.1.1.1 Impact & Legacy Collective to confirm, free of charge, whether it holds any Personal Information about them.
16.1.1.2 A record or description of that information, provided (a) within a reasonable timeframe and (b) in a clear and understandable format.
16.1.2 Right to Request Correction or Deletion
A Data Subject may request Impact & Legacy Collective to:
16.1.2.1 Correct or delete Personal Information that is outdated, inaccurate, irrelevant, excessive, misleading, incomplete, or unlawfully obtained.
16.1.2.2 Destroy information that Impact & Legacy Collective is no longer authorised to retain.
On receiving such a request, Impact & Legacy Collective will:
16.1.2.2.1 Delete or destroy the Personal Information;
16.1.2.2.2 Correct the inaccurate details;
16.1.2.2.3 Provide supporting evidence regarding the retained information; or
16.1.2.2.4 Where there is a dispute, attach a note to the record indicating that a correction request was made but not accepted.
Note: Impact & Legacy Collective’s PAIA Manual will be published in due course. In the meantime, requests may be submitted using the contact details provided at the end of this Policy.
16.1.3 Right to Withdraw Consent or Object to Processing
A Data Subject may withdraw consent previously granted or object to the processing of their Personal Information.
16.2 Impact & Legacy Collective may request positive identification before granting access or confirming any details related to the Data Subject’s Personal Information.
16.3 Data Subjects may submit written requests to review, update, or delete their Personal Information collected, disclosed, or utilised by Impact & Legacy Collective.
16.4 In accordance with POPIA and PAIA, Impact & Legacy Collective will respond to all such requests and provide access to the requested Personal Information.
16.5 A Data Subject has the right to challenge the completeness or accuracy of their Personal Information and request amendments as outlined in the PAIA Manual.
16.6 If a Data Subject indicates that their Personal Information is inaccurate or incomplete, Impact & Legacy Collective will ensure the necessary corrections are made or that the data is deleted by either Impact & Legacy Collective or its Third Party Service Providers.
17. Time Frame for Responses
17.1 Impact & Legacy Collective will respond to any written request regarding Personal Information within 30 days of receipt. In certain justified cases, a further 30-day extension may be granted. No additional extensions will be allowed beyond this.
17.2 If a Data Subject feels that the time taken to respond is unreasonable, they may lodge a complaint using the contact details provided in Section 20.
18. Access to Personal Information – Fees
18.1 A Data Subject or Requester may be charged a reasonable access fee for the search, preparation, reproduction, or transmission of records.
Fees may vary based on the format requested and will be detailed in the Impact & Legacy Collective PAIA Manual once published.
18.2 All queries relating to access fees and procedures may be directed to Impact & Legacy Collective using the contact details provided below.
19. Changes to This Policy
19.1 Impact & Legacy Collective reserves the right to update or amend this Privacy Policy at any time. Any significant changes will be communicated via appropriate means and announced at least 30 days prior to implementation.
19.2 The most recent version of this Privacy Policy will apply to all interactions between Impact & Legacy Collective and the Data Subject. By accessing Impact & Legacy Collective’s website at https://impactnlegacy.org or using its services, the Data Subject agrees to the terms of the version in force at the time of access.
20. Contacting Us
20.1 For any queries, comments, concerns, or complaints regarding the processing of Personal Information, you may contact Impact & Legacy Collective using the details below:
By Mail: Sonia Street, Gillview, Johannesburg, Gauteng, 2091
By Phone: Contact our Information Officer, Dr Phindi Msomi, on 0824744612
20.2 If you are not satisfied with how Impact & Legacy Collective handles your complaint or request, you may escalate the matter to the Information Regulator using the following details:
Website: http://justice.gov.za/inforeg/
Tel: 012 406 4818
Fax: 086 500 3351
Email: inforeg@justice.gov.za
© 2026 – Impact & Legacy Collective – All rights reserved.