PRIVACY POLICY

Reference in this policy to “we”, “us”, “our”, or any similar terms is to Feenix Trust.

At Feenix, we value and respect your privacy, strive to protect your Personal Information, promote the Protection of Personal Information, and are committed to processing your Personal Information in a lawful and reasonable manner.

Feenix will only collect, process, store or share your Personal Information in accordance with this Privacy Policy. By providing us with your Personal Information, you agree to this Privacy Policy and authorise us to process your Personal Information for the purposes defined, and in order to provide you with the services this Privacy Policy outlines.

JURISDICTION

The Feenix Trust is a Public Benefit Organisation (930057053) governed by a Trust (IT831/2017), and domiciled in the Republic of South Africa. We process Personal Information in the Republic of South Africa and, as such, comply with the South African Personal Information Act No. 4 of 2013 (POPIA). Our Data Subjects may reside within the Republic of South Africa, or in countries outside of this jurisdiction where the laws of those countries differ to the laws applicable in the Republic of South Africa. The Personal Information we collect may, thus, be transferred to, stored and processed outside of the jurisdiction in which you reside. By accepting this Privacy policy, and then submitting your Personal Information, you agree to the transfer, storing and processing of it outside of your jurisdiction.

• Data subjects with citizenships from jurisdictions other than South Africa and who are also residents outside of South Africa, please note that Feenix complies with all South African data protection laws when processing your personal information pursuant to the Trust’s main operations occurring in South Africa. Should foreign law be applicable in any regard to your use of our Services and/or the Website in any way, including how we may process your personal information, please contact the Feenix Information Officer at sebastian@feenix.org who will gladly engage you on its application and your rights

FEENIX SERVICES

Feenix’s Data Subjects are typically:

• Students applying for funding of their tertiary education fees or outstanding tuition balances at Educational Institutions in South Africa
• Household members of students applying for funding
• Individuals or entities considering, or submitting, donations towards tuition fees
• Educational Institutions where students are registered and to whom students require assistance with tuition fees
• Individuals or entities requesting information on our tertiary education funding programs or campaigns
• Individuals or entities requesting information on our organisation

Responsible Party and Operator roles

Feenix is the “Responsible Party” and is responsible for your personal data in instances where we decide the processing operations concerning your personal data. Sometimes we also operate as an “Operator” of personal data on behalf of a third-party Responsible Party, where that Responsible Party’s privacy terms will apply, but we will draw your attention to them, when applicable.

We have appointed an Information Officer at Feenix who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact the Information Officer using the details set out below.

You have the right to make a complaint at any time to the South African regulator’s office (Information Regulator’s Office of South Africa). We would, however, appreciate the chance to deal with your concerns before you approach any such regulator, so please contact us in the first instance

THIS PRIVACY POLICY EXPLAINS:

• How we collect Personal Information
• What Personal Information do we collect
• How we use your Personal Information
• Sharing of Personal Information
• Payment Services
• Social Media
• Electronic Communications
• Personal Information Accuracy and Completeness
• Security of Personal Information
• Transborder Flow of Personal Information
• Retention of Personal Information
• Children
• Cookies
• Website Links
• Data Subject Rights
• Data Breaches
• Revisions to this Privacy Policy
• Privacy Queries
• Information Officer Details

HOW WE COLLECT PERSONAL INFORMATION

Feenix will collect Personal Information:

• When you provide it to us when you sign-up and create your profile on our Feenix Platform, or when you provide it to us via email for registration on the Feenix Platform
• When you submit it to us through a Social Media platform, or social media communication tool such as Facebook Messenger or WhatsApp
• When you communicate with us or we obtain feedback from you by email, telephone, our website contact/enquiry forms, or any other means of communication
• We provide support and customer services to you as per your request via our support systems
• When you register for any events, workshops or seminars via email, our website, social media channels or in response to any other electronic communications
• When we obtain it from third parties to verify the information provided by you in order to determine your eligibility for our services to the extent that this is permitted by the law
• When we obtain it from payment service providers to verify, reconcile and conclude financial transactions with you
• When we request it from third parties on your behalf as consented to by you in accordance with our Terms and Conditions in order to fulfil our service obligations to you

As you interact with our website and Platform, we may automatically collect technical data about your equipment, browser, browsing actions and patterns. We collect this Personal Information by using cookies, server logs, Google Analytics and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your technical equipment data to calculate the percentage of users accessing a specific Website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

WHAT PERSONAL INFORMATION WE COLLECT

In order to provide our services, we may collect the following Personal Information from you:

• Name and surname
• Photographs
• Social Media Identifiers
• Proof of Identification in the form of an ID or Passport Number (including copies of ID Book or Passport)Age, Date of Birth
  Gender
• Ethnicity
• Email address
• Telephone number (mobile and/or landline number)
• Country of residence
• Physical or Postal address
• Educational Institution name, registration details, academic records and fee statements
• Financial and Credit Information (of household members/family)
• Entity, Business or Organisation Name
• Registration Number
• VAT Number
• Corporate Identity Logo
• Banking Information (in the case of Educational Institutions or donors)
• Platform sign-in details (credentials)
• Technical and website usage information

IF YOU REGISTER AS A STUDENT ON THE PLATFORM, THIS IS HOW WE USE YOUR PERSONAL INFORMATION

We use your Personal Information for one or more of the following purposes:

• Create and manage your profile on the Platform
• Provide the Platform to you which includes sharing your information with our third party platform and infrastructure service providers, both locally and outside the country where the Platform is provided, in the provision of the Platform
• Evaluate the documentation and information that you have provided to us so that we can determine whether you qualify for donations
• Verify the information and documentation you have submitted to us with an educational Institution in order to confirm student status and your current financial commitments
• Request on your behalf from your Educational Institution that they provide us with additional documentation and information, such as your academic records and your financial obligations to your Educational Institution
• Verify, where lawful and reasonable, from public sources and third parties any documentation or information that you provide to us for any legal, compliance or financial purposes
• Publish your name, personal stories and any other information that you have uploaded onto your profile on our Platform, and in any of our marketing material communications
• Pay the whole or a portion of your fees to your Educational Institution and obtain confirmation of said payment for legal, financial and tax purposes,
• Share your information with any donors or potential donors for legal, compliance and financial purposes
• Submit the required information to specific regulatory bodies for tax or BEE purposes as required by South African legislation
• Communicate with you via electronic communications (such as email) with regards to your profile, the Platform, and/or conduct any required administrative and business functions,
• Respond to your queries to us via our Social Media Platforms, Enquiry Form, WhatsApp, Email, Phone or other method of communication
• Reconcile and perform other financial functions related to the collection, processing and allocation of donations
• Perform analytics on the Platform, evaluate statistics and identify trends in order to improve the existing Platform and develop new services, and
• Contact you for research purposes relating to the Platform.

IF YOU USE THE THE PLATFORM AS A FUNDER, THIS IS HOW WE USE YOUR PERSONAL INFORMATION

We use your Personal Information for one or more of the following purposes:

• Create and manage your profile on the Platform
• Provide the Platform to you which includes sharing your information with our third party platform and infrastructure service providers, both locally and outside the country where the Platform is provided, in the provision of the Platform
• Evaluate the documentation and information that you have provided to us so that we can determine whether you qualify for donations, or to be a donor
• Verify, where lawful and reasonable, from public sources and third parties any documentation or information that you provide to us for any legal, compliance or financial purposes
• Submit the required information to specific regulatory bodies for tax or BEE purposes as required by South African legislation
• Communicate with you via electronic communications (such as email) with regards to your profile, the Platform, and/or conduct any required administrative and business functions,
• Respond to your queries to us via our Social Media Platforms, Enquiry Form, WhatsApp, Email, Phone or other method of communication
• Reconcile and perform other financial functions related to the collection, processing and allocation of donations
• Perform analytics on the Platform, evaluate statistics and identify trends in order to improve the existing Platform and develop new services, and
• Contact you for research purposes relating to the Platform.

SHARING OF PERSONAL INFORMATION

We may share Personal Information with:

• any person that works for Feenix, either full time or part time
• any business partner that is under contract to Feenix to assist with the provision of our services
• third party service providers that assist us with fulfilling our legal, financial and compliance obligations such as credit bureaus and identity verification providers
• companies, organisations and entities that provide services to us, including in relation to technical infrastructure, marketing and analytics, Platform hosting, and platform and website development
• third party payment service providers that assist us with fulfilling transactions and financial services that you have consented to engage with in order to make payments of donations to us
• third party communication service providers in order to deliver emails and other communications to you regarding your profile, the Platform, our services, and other business and administrative functions
• suppliers, affiliates, partners or agents in order to provide you with our Platform and services
• our professional advisers, consultants and other similar services
• legal and regulatory authorities that we are required to submit information to for financial, tax, BEE or other statutory purposes as required by an applicable law or regulation
• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation
• any relevant party, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal rights
• any relevant party for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including, but not limited to, safeguarding against and the prevention of threats to public security

We will otherwise treat your Personal Information as private and confidential and will not share it with other parties except:

• Where you have given permission
• Where we believe that it is reasonably necessary to comply with any law or regulation, legal process or governmental request, or to protect the rights, property or safety of us, our customers, or others

When we engage with business partners, third party service providers or affiliates that process your Personal Information in order to provide our services to you, these entities will:

• be subject to binding contractual obligations to only process such Personal Information in accordance with our prior written instructions or contractual agreement with them
• use appropriate measures to protect the confidentiality, integrity and availability of such Personal Information entrusted to them
• comply with our privacy principles and practices when we outsource any services to them
• advise us as soon as possible after the detection of any incidents relating to the Personal Information of our Data Subjects, including unauthorised access to, exfiltration, alteration, destruction or loss of any of the Personal Information, so that we may act swiftly, appropriately and in accordance with our Data Breaches statement below

PAYMENT SERVICES

Feenix has contracted Payment Service Providers (PSPs) in order for our Data Subjects to process donations via our Platform. We do not collect, process, store or share any banking or financial information of our Data Subjects ourselves as this is done by the PSP’s utilising their own secure and PCI Compliant Payment Gateways. Feenix only receives the notification of the financial transactions and the status of the donation from the PSP utilising a unique identifier for each Data Subject. We utilise the provided in the notification to verify the completion of the transaction (donation) and for financial reconciliation purposes.

For payments made through these Payment Service Providers, you are engaging with them separately in your own personal capacity and the PSPs are the Responsible Parties of the personal, banking, financial and any other information which you provide them for the purpose of making any donation. For further information regarding the PSPs, their payment services, privacy and security, or if you have any payment related queries or concerns, please contact them directly through the contact methods specified on their websites.

In order to make a donation, you will need to provide accurate and up to date personal and banking Information requested by these Payment Service Providers at the time of processing the transaction to effect payment. Should you not wish to provide this information to these PSPs, we may not be able to with you.

SOCIAL MEDIA

Feenix also operates and communicates through our Social Media channels and pages to inform, help and engage with interested parties, and to promote our organisation and services. These channels and pages are public and any of the users of the social media sites on which we operate may like, follow or subscribe to them.

When subscribing to, liking or following any of Feenix’s channels or pages on a social media platform, please note the following:

• the general public can access and read any Personal Information posted or shared by your or anyone else on these sites
• we are not responsible for any Personal Information posted or shared by you or other users on these sites
• we are not responsible for any other information posted on these sites other than the information posted by our designated administrators or moderators on our official Feenix channels and pages
• we do not endorse the social media sites themselves, nor any information posted on them by third parties or other users
• When you engage with us through social media, your Personal Information may be processed by the site owner. This processing occurs outside of our control and may take place in a country outside South Africa that may have different privacy regulations.

We regularly update and monitor our social media channels and pages, and welcome feedback and queries sent to us through these sites. We try to join and encourage conversations whenever possible but cannot guarantee that we will read or reply to all messages sent to any of our official social media channels or pages. Relevant feedback on these social media sites, including the details of the individuals who posted comments, may be shared within the organisation for consideration, but we cannot guarantee that any feedback or suggestions will be acted upon by us.

ELECTRONIC COMMUNICATIONS

In order for us to provide you with information about our Platform and our services, you accept and agree that:

• Any communication, agreement, or notice relating to your use of the platform shall be provided to you electronically via the email or phone address provided to Feenix
• You will have access to the necessary hardware and software to receive, access, and retain electronic communications sent to you with regards to our services
• Communication sent to the email or phone address provided will be deemed to have been received by you

Feenix utilises Third-Party Communication Providers to deliver electronic communications to their Data Subjects and these providers operate outside of the Republic of South Africa. The Personal Information provided to Feenix in order to engage our services, utilise our Platform and receive all electronic communications in relation to our Platform and services is, thus, shared with these Third-Party Communication Providers, and processed and stored within their Data Centres in their relevant countries. Should you not wish to have your Personal Information processed by these Third Parties in countries outside of the Republic of South Africa, Feenix may not be able to provide our services to you.

You may withdraw your consent to receiving electronic communications from us at any time by contacting us at support@feenixbursary.org but, should you withdraw consent, you may not receive further communications regarding any current or future services from us.

PERSONAL INFORMATION ACCURACY AND COMPLETENESS

Whilst we take reasonable measures to maintain the quality and accuracy of your Personal Information, all Personal Information you provide to Feenix via our Platform, or via any other methods of collection as outlined above, should be accurate, complete, and up to date. Should your Personal Information change, it is your responsibility to notify us of the change and provide us with up to date information.

Where indicated via our methods of collection, such as on our Platform or via email, it is obligatory for you to provide accurate Personal Information to enable us to provide you with our services. Should you decline to provide such information or should the information you provide be incomplete or inaccurate, we may not be able to provide you with the services you requested.

SECURITY OF PERSONAL INFORMATION

Feenix places great importance on ensuring the security of your Personal Information. Feenix’s Privacy Policy is to meet all local requirements for security measures for the integrity and confidentiality of Personal Information as specified in Section 19 of POPIA.

We promote the protection of Personal Information by maintaining and continuously improving our privacy and security culture. We ensure all employees, contractors, business partners and service providers processing Personal Information are advised on how to handle Personal Information securely, with the utmost respect, and in compliance with POPIA. We provide regular privacy and security training and awareness sessions to all our employees and contractors and, where relevant, to business partners and third-party service providers as well. All employees, contractors, business partners and third-party service providers are made aware of their responsibilities in terms of laws and rules that apply to the processing and to the protection of the Personal Information of our Data Subjects, and with regards to our expectations of them when processing their Personal Information on our behalf.

We make use of appropriate physical, administrative and technical security measures to protect all Personal Information that we collect and in our possession, and when we share Personal Information with other entities as outlined above. We regularly review our organisational security measures and ensure they are effective, up to date and follow best practices.

The Feenix Platform is hosted in an Amazon Web Services Data Centre (“the AWS Data Centre”) in the Republic of South Africa. The AWS Data Centre is ISO 27001 certified which provides further assurance with regards to the physical, logical and environmental security of the Platform and the information processing therein, as well as the business continuity and availability of the Platform. The Platform is developed using secure technologies with Privacy by Design and Security by Default principles at the forefront of its architecture, and can only be accessed for support and administrative purposes by Feenix’s approved employees, and approved third party platform and infrastructure service providers when required.

TRANSBORDER FLOW OF PERSONAL INFORMATION

We may transfer your Personal Information to recipients, business partners, entities, third party service providers or affiliates outside of the Republic of South Africa, as outlined in this Privacy Policy, in order to provide our services to you.

Our Privacy Policy is to meet local country requirements for the flow of information and comply with the Data Protection, Privacy and other related laws and codes of conduct that apply in the countries where we transfer Personal Information to.

Personal Information may be transferred to a third party outside of the Republic of South Africa provided that the third party is subject to a law, binding corporate rules or a binding agreement that seeks to protect the Personal Information in line with this Privacy Policy and the transfer is necessary in order to provide the services that are required by you.

We will take reasonable actions to make sure that appropriate measures are in place before we transfer your Personal Information to other countries if the transfer is necessary to provide services to you.

You may withdraw your consent to us processing or transferring your Personal Information across borders, however, this may mean that we are no longer able to offer our services to you.

RETENTION OF PERSONAL INFORMATION

Feenix will retain your Personal Information in compliance with this Privacy Policy and in accordance with our Terms and Conditions in relation to our services as agreed to by you.

We will retain your Personal Information:

• for as long as is necessary to fulfil the purposes for which it was collected
• for the duration of your relationship with us
• for such a period after the conclusion of our agreement to provide our services to you as may be necessary for our legitimate business purposes and our legal, financial, compliance, and other statutory obligations
• for the purposes of preventing fraud, resolving disputes and enforcing agreements

CHILDREN

When we process the personal information of minors (persons under the age of 18), we will always do so with the consent of their parents, legal guardian or as allowed by law. Feenix has no control over whether children under the age of 18 visit our website and view our content or register on our Platform, and any activity in this regard undertaken by a Data Subject under the age of 18 should be done so under the guidance of, and with the consent of, their parent or legal guardian.

COOKIES

Cookies are small data files that are placed on your computer (or other devices) when you visit a website. Cookies (and other similar technologies) help us give you the best experience of using our website. Cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A Cookie in no way gives us access to your computer, device or any information about you, other than the data you choose to share with us.

Subject always to obtaining your consent, where required, and in accordance with applicable law, when you visit our website, we may place Cookies onto your computer device, or read Cookies already on your computer or device. Our website, thus, also collects Personal Information through the use of cookies. We use Cookies to record information about your computer, device, browser and, in some cases, your preferences and browsing habits. Cookies allow us to remember your actions or preferences over time.

For information on how to delete or reject cookies, you can consult the “help” function within your browser, or visit www.allaboutcookies.org, where you will also find more information about cookies generally.

WEBSITE LINKS

When you visit our website or view the information on our website, you may be able to access or click on links that direct you to other websites that are beyond our control. These websites may send their own cookies to you, collect Personal Information, technical or website usage information from you, or request Personal Information from you in the performance of another service. We do not control the Privacy Policies of these Third Parties and we cannot be held liable for the use of any Personal Information provided by you to them for any reason whatsoever.

DATA SUBJECT RIGHTS

The Personal Information Feenix collects, and the ways in which we use it, are necessary for us to provide our services to you. You may request access to any and all the Personal Information that Feenix has in their possession about you upon provision of sufficient proof and verification of your identity.

You have the right to:

1. Request your Personal Information – This allows you to receive a copy of all your personal information held by us and to check that we are lawfully processing it.
2. Correct your Personal Information – This allows you to have any of your incomplete or inaccurate information corrected, although we may need to verify the accuracy of the new information that you provide.
3. Delete your Personal Information – This allows you to request that we delete or remove your personal information where there is no justifiable reason for us to continue processing the information. In addition, you have the right to request us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information in order to comply with a legal requirement. Please note that for specific legal reasons which will be notified to you, we may not always be able to comply with your request for erasure.
4. Object to the processing of your Personal Information – You may object to our processing of your information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object to where we are processing your personal information for direct marketing purposes. In some cases, we may be able to demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
5. Restrict the processing of your Personal Information – This allows you to request that we suspend the processing of your personal information in the following scenarios:
   • if you want us to establish the accuracy of the information
   • where our use of the information is unlawful but you do not want us to erase it
   • where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims
   • you have objected to our use of your information but we need to establish whether we have overriding legitimate grounds to use it
6. Withdraw consent to the processing of your Personal Information – You may withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before the withdrawal of your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

The above rights are limited in some situations, such as where we are legally required to process or store your data, and may limit your ability to use our services. We will advise you about this at the time of your Data Subject Access Request and take into consideration the type of request.

In order to enact your Data Subject Access Request, you will normally not have to pay a fee to access your Personal Information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to assist us to confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request in order to speed up our response.

We will endeavour to respond to all legitimate requests within 30 days. Occasionally it may take us longer than this if your request is particularly complex or if you have made a number of requests, in which case, we will notify you of the delay and keep you updated.

If you would like to exercise any of your Data Subject Rights, please contact us at support@feenixbursary.org with your request.

DATA BREACHES

As a Responsible Party, Feenix will notify you and the relevant supervisory authority as soon as we become aware of any data breaches or incidents that are likely to result in the unauthorised access to, exfiltration, alteration, destruction or loss of any of your Personal Information, or which may result in any risks to your privacy rights and freedoms.

REVISIONS TO THIS PRIVACY POLICY

We may amend this Privacy Policy from time to time. You should visit our website regularly to check when this Privacy Policy was last updated and to review the current policy.

PRIVACY QUERIES

Should you have any queries in relation to this Privacy Policy or how we collect, process, store or share your Personal Information, please contact us via email at support@feenixbursary.org or email our Information Officer directly.

INFORMATION OFFICER