Privacy Policy

This Privacy Policy explains how Capital Flow For Good (Pty) Ltd (trading as “me-you-us”; “we”, “us” or “our”) collects, uses, shares and protects your personal information when you use our website and marketplace platform (the “Platform”). We are committed to processing your personal information lawfully, and this policy describes your rights and how to exercise them.

1. Who we are

Capital Flow For Good (Pty) Ltd is a private company (Pty Ltd) incorporated in the Republic of South Africa, registration number 2026/347064/07. For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”) we are the Responsible Party, and for the purposes of the EU/UK General Data Protection Regulation (“GDPR”) we are the Data Controller in respect of the personal information described below.

Our Information Officer can be contacted at jarred@capitalflowforgood.com for any question or request relating to this policy or your personal information.

2. Scope and legal framework

This policy is governed primarily by POPIA. Because we host and process personal information within the European Union, and may serve individuals located in the EU/UK, the GDPR also applies to that processing. Where the two frameworks use different terms for the same idea (for example “Responsible Party” and “Data Controller”, or “data subject” and “you”), we treat them as equivalent.

3. What personal information we collect

We collect only the information we need to operate the Platform. Specifically:

Information you give us

• Account details — your email address, display name and country (an ISO country code) when you register, and a password (which we never store in readable form — see Security below).
• Profile preferences — your preferred display currency and your per-project notification settings.
• Donation details — the amount, currency and the projects you choose to sponsor. Payment card details are entered on our payment provider’s systems and are never collected or stored by us.
• Sponsorship location — the point you select on the map when creating a sponsorship, and (optionally) the what3words address derived from it.
• Support and correspondence — the content of support requests and any emails you send us.
• Partner contacts — if you represent a conservation partner organisation, the contact name, email and phone number you provide for that organisation.

Information we collect automatically

• Authentication and security data — sign-in timestamps, session tokens, and limited technical data (such as your IP address) used for rate-limiting and to protect accounts from abuse.
• Engagement data — the projects you like or subscribe to, and whether you have opened certain project-update emails, so we can send relevant updates and digests.

Information we receive from others

Our payment provider confirms the status of your donation (for example, whether a payment succeeded) and provides a payment reference and, for recurring donations, a subscription token. We do not receive your card number.

4. Why we process your information and our lawful basis

Under POPIA (section 11) and the GDPR (Article 6) we must have a lawful basis for each processing purpose. Ours are:

• To provide the Platform and your account (registration, sign-in, managing sponsorships and donations) — necessary for the performance of our agreement with you.
• To process donations through our payment gateway to the chosen beneficiary organisation and manage recurring donations — necessary for the performance of our agreement with you and to comply with financial record-keeping obligations in respect of the platform service fee we earn.
• To send transactional emails (verification, password reset, account and security notices) — necessary to provide the service and to protect your account.
• To send project updates and digests for projects you subscribe to — based on your consent, which you can withdraw at any time by changing your subscription settings.
• To display sponsorship locations and derive a what3words address — based on your consent, given when you create a sponsorship.
• To keep the Platform secure and prevent abuse (rate-limiting, session management) — our legitimate interest in protecting the service and its users.
• To understand donor engagement in aggregate and support our conservation partners — our legitimate interest in running the organisation effectively.

5. Who we share your information with

We do not sell your personal information. We share it only as described here. The following service providers act as our Operators (POPIA) / Processors (GDPR) and process personal information on our instructions under written agreements:

• Our payment gateway (Paystack) — receives your name, email and donation amount to process payments, split the transaction at the network layer between the chosen beneficiary organisation and the Company, and manage recurring donations.
• Resend (email delivery) — receives your email address and the content of the emails we send you.
• what3words — receives the map coordinates of a sponsorship in order to return a corresponding what3words address; it does not receive your identity.
• Cloudflare R2 (media storage) — stores project images we publish; it does not store your account or donation data.
• An exchange-rate service — used to convert currencies for display and payment; it does not receive personal information.

Beneficiary organisations

Our payment gateway routes the beneficiary share of each donation directly to the beneficiary organisation responsible for the protected area associated with a project; we do not hold or pool charitable funds. When you donate, your name, email address and donation amount are shared with the chosen beneficiary organisation so it can receive and account for your donation, and — where the beneficiary is a Public Benefit Organisation with Section 18A approval — so a Section 18A tax certificate can be prepared on its behalf. The beneficiary organisation is an independent Responsible Party in respect of the information it receives, and its own privacy terms apply to its use of that information.

Information visible to other users and partners

• Other users may see the map area you have sponsored, your display name and the date of the sponsorship. Your email address and other contact details are never shown to other users.
• Conservation partners may see aggregated donor statistics for their own projects (such as donation counts and totals). These statistics are used to run and report on the projects.

We may also disclose personal information where required by law, to establish or defend a legal claim, or to protect the rights and safety of our users or the public.

6. International transfers of information

We host and process personal information within the European Union. If you are located in South Africa, this means your information is transferred outside South Africa. Some of our service providers (for example, our email provider) may process limited information in other countries.

We only transfer personal information across borders where the recipient is subject to laws or binding agreements that provide an adequate level of protection comparable to POPIA (section 72) and the GDPR (Chapter V), or where the transfer is necessary to perform our agreement with you.

7. How we protect your information

We take appropriate, reasonable technical and organisational measures to safeguard your personal information, including:

• Passwords are stored only as strong one-way hashes (bcrypt) — we never store or can read your actual password.
• Encrypted connections (HTTPS) for data in transit.
• Sign-in sessions protected by secure, HTTP-only cookies that are not accessible to scripts in your browser.
• Role-based access controls limiting who within the organisation can access personal information.
• Rate-limiting and account-locking mechanisms to defend against unauthorised access.

No system is completely secure. If we become aware of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by POPIA and, where applicable, the GDPR.

8. How long we keep your information

• Account information — kept while your account is active. When you delete your account, it is deactivated for a 30-day grace period (during which you can reactivate it) and then anonymised.
• Donation and financial records — retained for at least seven years to comply with South African company and tax record-keeping obligations (including the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011), after which they are anonymised or deleted.
• Sponsorship records — retained for the historical record of a project; the link to your identity is anonymised when your account is deleted.
• Email delivery logs — retained for approximately six months.

9. Your rights

Subject to POPIA and the GDPR, you have the right to:

• Access the personal information we hold about you.
• Correct or update your information — you can change your name and email in your account settings, or contact us for other corrections.
• Delete your account and information — you can do this from your account settings, subject to the retention periods above.
• Object to or restrict certain processing, and to withdraw consent (for example, by turning off project subscriptions).
• Data portability — download a copy of the personal information we hold about you, in a commonly used machine-readable format (JSON), from your account settings.
• Lodge a complaint with the Information Regulator (South Africa) or your local supervisory authority.

To exercise any right, email info@meyouus.org. We may need to verify your identity before acting on a request. Where the law requires it, formal requests may be made using the process set out in our PAIA Manual.

10. Children

The Platform is intended for adults. By registering or donating, you warrant that you are at least 18 years of age or have the consent of a parent or guardian to use the Platform. We do not knowingly collect the personal information of a child without the consent of a competent person. If we learn that we have done so, we will delete that information.

11. Cookies and similar technologies

We use a small number of strictly necessary and functional cookies and browser-storage items, and no third-party advertising or analytics trackers. See our Cookie Policy for details.

12. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, where the change is significant, take reasonable steps to notify you.

13. How to contact us and the Regulator

For any privacy question or to exercise your rights, contact our Information Officer at info@meyouus.org.

You also have the right to complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Complaints email: complaints.IR@inforegulator.org.za
• POPIA/PAIA enquiries: enquiries@inforegulator.org.za

Please verify the Information Regulator’s current contact details on their website before relying on them.