Privacy Policy

Puku Children’s Literature Foundation NPC — www.puku.co.za

Effective date: 13 August 2026

Last updated: 13 August 2026

Registration number: 2010/021586/08 (Non-Profit Company / Section 21 Company Not-for-Gain)

1. Introduction

The Puku Children’s Literature Foundation NPC (“Puku”, “the Foundation”, “we”, “us” or “our”) is a South African non-profit organisation dedicated to promoting children’s literacy and literature in all South African languages. We operate the website www.puku.co.za and related digital platforms, including Pukupedia (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information, in compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). It applies to visitors to our Services, members of the public who engage with our programmes, donors, partners, volunteers, and — because our work centres on children — to the children and young people who take part in our literacy programmes, events and publications, and their parents or guardians.

We are committed to protecting the privacy and dignity of everyone we work with, and to being especially careful with information relating to children, in line with the heightened protections POPIA gives to children’s personal information.

2. Who We Are — The Responsible Party

For the purposes of POPIA, the “responsible party” that determines the purpose and means of processing personal information described in this Policy is:

Puku Children’s Literature Foundation NPC

Registration number: 2010/021586/08 (NPC)

Website: www.puku.co.za

General enquiries:reception@puku.co.za

We have appointed an Information Officer who is responsible for compliance with POPIA and PAIA on our behalf. Contact details for our Information Officer are set out in “Contact Us and Our Information Officer” below.

3. Scope of This Policy

This Policy applies to personal information we collect through:

The puku.co.za website and Pukupedia, and any other website or app that links to this Policy.
Registrations, forms, competitions, surveys and newsletter sign-ups on our Services.
Our literacy programmes, workshops, book donations, school visits and community events.
Correspondence with us by email, phone, social media or post.
Photographs, video and audio recordings taken at our programmes and events.
Donor, funder, partner and supplier relationships.

This Policy does not apply to third-party websites or platforms we link to, or to information collected by schools, publishers or partner organisations under their own privacy policies.

4. Definitions

Words used in this Policy carry the meanings given to them in POPIA. The key terms are:

Personal information — information relating to an identifiable, living natural person (and, where applicable, an identifiable existing juristic person), including names, contact details, images, biometric information, and opinions about that person.

Processing — anything done with personal information, including collecting, recording, storing, using, disseminating or deleting it.

Data subject — the person to whom personal information relates.

Child — a natural person under the age of 18 who does not have full legal capacity to act without the assistance of a competent person.

Competent person — a person legally competent to consent to any action or decision on behalf of a child — ordinarily a parent or legal guardian.

Special personal information — information concerning a person’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or criminal behaviour.

Operator — a third party who processes personal information on our behalf under a contract or mandate, such as our hosting, email or payment service providers.

Consent — a voluntary, specific and informed expression of will by which permission is given for personal information to be processed.

5. The Information We Collect

5.1 Information You Provide to Us

Contact and identity details: name, email address, telephone number, postal address, organisation, and, where relevant to a programme, the name of a school or community group.
Programme information: details you give us when registering for a workshop, competition, book donation, or when submitting a manuscript, review or content for publication.
Donor and payment information: billing details and, where you donate online, payment information processed by our accredited payment provider (we do not store full card details ourselves).
Communications: information contained in emails, forms, or messages you send us, including support and media enquiries.
Special or sensitive information you volunteer: for example, medical or dietary needs disclosed for the purposes of running a safe event, which we treat as special personal information under “Special Personal Information” below.

5.2 Information We Collect Automatically

Log and device information: IP address, browser type, device identifiers, referring pages, and date/time of access, collected when you use our Services.
Usage information: pages visited, links clicked, and search terms used on our Services, collected to understand and improve how our Services are used.
Approximate location: derived from your IP address, used only in aggregate to understand where our audiences and beneficiaries are based.
Cookies and similar technologies, described further in “Cookies and Similar Technologies” below.

5.3 Information We Receive From Other Sources

Schools, teachers, community organisations and publishing partners who refer participants to our programmes or submit content on their behalf.
Funders and partner organisations, such as UNESCO and other literacy bodies, in connection with joint programmes and reporting.
Publicly available sources, such as a publisher’s public author profile, where relevant to our book cataloguing and ONIX metadata work.

5.4 Photographs, Video and Audio (Adults and Children)

Photography, video and audio recording are a routine part of our literacy programmes, events, school visits and reporting to funders. A recognisable photograph, video or voice recording of a person is personal information under POPIA, and where the person is a child it receives the additional protections described in “Personal Information of Children” and “Images and Recordings of Children” below.

We may photograph or record adults (staff, volunteers, authors, partners, donors, members of the public) at our events, workshops and public engagements.
We may photograph or record children taking part in our literacy programmes, book donations, competitions and school visits, strictly in accordance with the consent requirements set out in this Policy.
Images and recordings may be used on our website, Pukupedia, social media, printed publications, annual reports and funder reports, in each case for the purpose disclosed to the data subject or competent person at the time consent was obtained.

6. Purpose and Lawful Basis for Processing

In line with POPIA’s conditions for lawful processing, we only process personal information where we have a lawful basis to do so, and only for the purpose for which it was collected (or a purpose compatible with it). We rely on one or more of the following bases:

Consent — where you or, for a child, a competent person, has given consent (for example, to a newsletter, a photograph, or a workshop registration).
Performance of a contract — to fulfil a donation, purchase, event booking or partnership agreement.
Legal obligation — to comply with tax, funding, or other statutory requirements.
Legitimate interests — to run and improve our Services, protect the security of our Services, and pursue our public-benefit literacy mission, provided this does not override the data subject’s rights and interests.
Protection of a legitimate interest of the data subject — for example, keeping emergency contact or medical information on hand during a children’s event.

We use the personal information we collect to:

Register and administer participation in programmes, competitions, workshops and book donations;
Operate, maintain and improve puku.co.za and Pukupedia;
Communicate with you about our programmes, events and, where you have opted in, our newsletter;
Report to funders, partners and regulators on the impact of our programmes, using de-identified or aggregated information wherever possible;
Process donations and maintain accurate financial and donor records;
Protect the safety, rights and property of Puku, our beneficiaries, staff, volunteers and the public; and
Comply with our legal, tax and regulatory obligations.

We do not sell personal information to any third party.

7. Special Personal Information

POPIA prohibits the processing of special personal information (such as health, religion, or biometric data) unless a specific exception applies. Where we collect special personal information, we do so only where:

You or a competent person has given explicit consent (for example, disclosing a child’s allergy or medical condition so that we can run a safe event); or
Processing is otherwise necessary to comply with a legal obligation or to protect a vital interest of the data subject (such as an emergency requiring urgent medical information).

We limit collection of special personal information to what is strictly necessary, restrict access to staff who need it to run the relevant programme or event safely, and do not use it for any other purpose without further consent.

8. Personal Information of Children

POPIA generally prohibits the processing of a child’s personal information unless a specific exception applies. Because Puku’s programmes are aimed at children, we rely on the following exceptions, and we do not process a child’s personal information outside of them:

Prior consent of a competent person (ordinarily the child’s parent or legal guardian) has been obtained before we collect or use the child’s personal information;
The processing is necessary to establish, exercise or defend a legal right or obligation;
The processing is for historical, statistical or research purposes that serve the public interest (for example, measuring the literacy impact of our programmes), where it is not reasonably practicable to obtain consent and we put safeguards in place so the child’s privacy is not disproportionately affected, and we favour de-identified or aggregated data wherever this is possible; or
The information has been made public by the child themselves with the consent of a competent person.

Where we rely on the consent of a competent person, we will, on request:

Explain what personal information of the child we hold and how it is processed;
Allow the competent person to review that information and to withdraw consent to further processing at any time; and
Correct or delete the child’s personal information where appropriate.

We do not encourage or persuade a child to disclose more personal information than is reasonably necessary for the purpose of the programme they are taking part in, and we apply reasonable procedures to protect the integrity and confidentiality of personal information we collect from children, including restricting staff and volunteer access on a need-to-know basis.

Where a programme is run through a school and the school collects consent on our behalf (for example, as part of an in-loco-parentis school activity), we require the school or partner organisation to confirm that appropriate parental or guardian consent has been obtained before personal information is shared with us. Wherever practicable, we seek to obtain consent directly from a parent or legal guardian rather than relying solely on a school’s authorisation.

9. Images and Recordings of Children and Adults — Special Safeguards

Because photography and video are central to how we document and report on our work, and because a recognisable image of a child is that child’s personal information, we apply the following safeguards to mitigate risk to the children we work with and to Puku:

9.1 Consent

We obtain written or recorded consent (paper or digital) from a competent person before capturing, publishing or sharing an identifiable image, video or audio recording of a child, using a consent form that explains where and how the image may be used.
For adults, we rely on their own informed consent, given verbally or in writing before or at the time of the event, or on a legitimate interest basis for incidental crowd or venue shots where individuals are not the clear focus of the image.
Consent for a child’s image is specific to the purposes disclosed at the time (for example, our website, social media, printed and funder reports). We seek fresh or renewed consent before using an existing image for a materially different or commercial purpose.

9.2 Minimising Identifying Detail

We do not publish a child’s full name, home address, school name, or exact location alongside their photograph unless a competent person has given specific, separate consent for this, and we avoid combinations of detail that could allow a child to be traced or identified without such consent.
Where consent for a named credit is not obtained or not required, we use a first name only, an initial, or no name at all.

9.3 Withdrawal and Removal

A competent person (or an adult data subject) may withdraw consent and request that an image be removed from our Services at any time, free of charge, by contacting us using the details in “Contact Us” below. We will act on such a request as soon as reasonably possible, noting that we may not be able to recall material already shared by others outside our control (for example, if reshared on third-party social media).

9.4 Third-Party and Partner Submissions

Where photographs or recordings of children are supplied to us by a school, partner organisation, freelance photographer or volunteer, we require written confirmation that the necessary parental or guardian consent has been obtained before the image is used on our Services, and we reserve the right to decline or remove any image where this cannot be confirmed.
Volunteers and contracted photographers working on our behalf are required to follow this Policy and our internal child-safeguarding guidance.

9.5 Storage, Access and Use

Images and recordings are stored securely and access is limited to staff and volunteers who need it for the purpose for which it was collected.
We do not license or sell images of children to third parties for commercial or advertising purposes, and we do not use a child’s image in a manner unrelated to our literacy mission without further specific consent.

If you are a parent or guardian and are concerned about an image of a child on our Services, please contact us immediately using the details in “Contact Us and Our Information Officer” below. We treat such requests as a priority.

10. How We Share Your Information

We do not sell personal information. We share personal information only in the following limited circumstances, and only to the extent reasonably necessary:

Operators and service providers who process information on our behalf under a written agreement, such as our website hosting, email, payment processing and analytics providers, subject to confidentiality and security obligations consistent with this Policy;
Funders and partner organisations, such as UNESCO and other literacy bodies, for reporting on programme outcomes, using de-identified or aggregated data wherever possible, and named or identifiable information of children only with prior consent;
Schools, publishers and community partners with whom we run joint programmes, limited to the information needed to deliver that programme;
Professional advisers, auditors and regulators, where necessary for our legal, financial or governance obligations;
Law enforcement or regulatory authorities, where required or permitted by law, such as to comply with a court order, or to protect the safety of a child or member of the public; and
A successor organisation, in the unlikely event of a merger, restructuring or transfer of Puku’s operations, subject to that successor being bound by equivalent privacy protections.

Where a service provider or partner processes personal information on our behalf, we take reasonable steps to ensure they maintain the same conditions for lawful processing that apply to us under POPIA.

11. Cross-Border Transfers of Information

Some of our service providers, funders and partners (for example, cloud hosting providers, international literacy bodies, or a foreign publisher) may be located outside South Africa. Where we transfer personal information to a recipient in another country, we only do so where at least one of the following applies, in line with section 72 of POPIA:

The recipient is subject to a law, binding corporate rules, or agreement that provides an adequate level of protection substantially similar to the conditions for lawful processing under POPIA;
You (or, for a child, a competent person) has consented to the transfer;
The transfer is necessary to perform a contract with you, or to take pre-contractual steps at your request; or
The transfer is for your benefit and it is not reasonably practicable to obtain consent, but consent would likely be given.

12. Cookies and Similar Technologies

We use cookies and similar technologies on puku.co.za to operate the website, remember your preferences, and understand how our Services are used (for example, through privacy-conscious analytics tools). Cookies do not give us access to your device beyond the information you choose to share.

You can control or disable cookies through your browser settings; please note that some features of our Services may not function properly if cookies are disabled. Where required by law, we will request your consent before placing non-essential cookies.

13. Data Security

We take appropriate technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure, in line with section 19 of POPIA. These include restricting access on a need-to-know basis, using reputable and contractually bound service providers, and applying reasonable safeguards to our systems and physical records.

No method of transmission over the internet or electronic storage is completely secure. While we work hard to protect personal information, we cannot guarantee its absolute security, and any transmission is at your own risk.

If we become aware of a security compromise that has resulted, or may reasonably be believed to have resulted, in unauthorised access to or acquisition of personal information, we will notify the Information Regulator and affected data subjects (or, in the case of a child, the relevant competent person) as soon as reasonably possible, as required by section 22 of POPIA.

14. Retention of Information

We keep personal information only for as long as is reasonably necessary to fulfil the purpose for which it was collected, or as required by law, whichever is longer, in line with section 14 of POPIA. Programme, donor and financial records are generally retained for the periods required by applicable South African tax, company and non-profit legislation. Where information is no longer needed, we securely delete, destroy or de-identify it.

Public reviews, published content, and de-identified or aggregated impact data may be retained indefinitely, as they no longer identify a specific individual.

15. Your Rights as a Data Subject

Subject to POPIA, you (or, for a child, a competent person acting on the child’s behalf) have the right to:

Be notified that your personal information is being collected, and of any unauthorised access to it;
Establish whether we hold personal information about you and to request access to it;
Request the correction, destruction or deletion of your personal information where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
Object to the processing of your personal information on reasonable grounds relating to your particular situation;
Object, at any time and free of charge, to the processing of your personal information for direct marketing purposes;
Not be subject to a decision based solely on automated processing that significantly affects you;
Withdraw consent, where processing is based on consent, at any time (this does not affect the lawfulness of processing carried out before withdrawal); and
Submit a complaint to the Information Regulator, or institute civil proceedings, regarding an alleged interference with the protection of your personal information.

To exercise any of these rights, please contact our Information Officer using the details in “Contact Us and Our Information Officer” below. We may need to verify your identity (or, for a child, the identity and authority of the competent person) before giving effect to a request.

16. Direct Marketing

We will only send you electronic direct marketing (such as our newsletter) where you have opted in, or where you are an existing supporter or contact and are given a clear opportunity to opt out at the time your details were collected and with every subsequent communication, consistent with section 69 of POPIA and the Electronic Communications and Transactions Act.

You can withdraw consent or opt out of direct marketing at any time, free of charge, by using the unsubscribe link in any email, or by contacting us using the details below. We do not send direct marketing to children.

17. Links to Other Websites

Our Services may contain links to third-party websites, including those of publishers, partners, funders and social media platforms. We are not responsible for the privacy practices or content of third-party sites, and we encourage you to review their privacy policies before providing any personal information.

18. Children Using Our Website Directly

Where children access age-appropriate content on puku.co.za or Pukupedia directly (for example, browsing a book catalogue), we do not require children to create an account or submit personal information to use these features. Where a feature does require personal information from a child (such as a competition entry or content submission), we require the involvement and consent of a competent person before that information is processed, as described in “Personal Information of Children” above.

19. Complaints and the Information Regulator

If you believe we have not handled your personal information in accordance with POPIA, please contact our Information Officer first so that we can try to resolve your concern. You also have the right to lodge a complaint directly with South Africa’s Information Regulator:

The Information Regulator (South Africa)

Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Complaints: POPIAComplaints@inforegulator.org.za

General enquiries: enquiries@inforegulator.org.za

Website: www.inforegulator.org.za

20. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or the law. We will post the updated Policy on this page and update the “Last updated” date above. Where a change materially affects how we process children’s personal information, or your rights, we will take reasonable steps to bring this to your attention, such as a notice on our website or, where you have opted in, by email.

21. Contact Us and Our Information Officer

For any questions, requests or concerns about this Policy or how we handle personal information, including requests relating to a child’s personal information or images, please contact our Information Officer:

Puku Children’s Literature Foundation NPC — Information Officer

Email: education@puku.co.za