Skip to main content
BLOCKrBack to BLOCKr

Legal

Privacy notice

Last updated 24 October 2026

This notice explains what personal information BLOCKr collects, why, and what you can do about it. It follows the Protection of Personal Information Act, 2013 (POPIA). In short: we collect only what’s needed to run school campaigns, we don’t sell your information, and we don’t use advertising or tracking cookies. Our campaign statistics are anonymous.

BLOCKr is in its pilot. Our registered company details and contact address are still being finalised; the places they belong are marked on this page. Until then, schools can reach us through the person who set up their account.

1. Who is responsible

  • School accounts and this website: BLOCKr is the responsible party for information about school staff who use BLOCKr and for visits to this site.
  • Supporters of a campaign: when you fund a block or give, the school running the campaign is the responsible party for your information, and BLOCKr processes it on the school’s behalf as its operator (see the School agreement).

Our Information Officer is [Information Officer to be confirmed], reachable at [contact email to be confirmed].

2. What we collect

If you support a campaign

  • the name you want shown on your block;
  • your email address, and your phone number if you choose to give it;
  • which block you funded or how much you gave, when, and whether you chose card or cash/EFT;
  • for card payments, the payment reference and status PayFast sends back. We never receive your card details; you enter them on PayFast’s pages.

If you run a school’s account

  • your email address (used to sign in) and your role at the school;
  • the school’s details: name, area, logo, colours, campaign photos and descriptions;
  • the school’s PayFast merchant details, so payments reach the school’s account.

From everyone who visits

  • your IP address, used briefly to stop abuse such as automated sign-ups or repeated failed payments;
  • technical logs kept by our hosting providers (for example browser type and pages requested), used to keep the site running and secure;
  • anonymous campaign statistics: when you open a campaign page, tap a block or share it, we count it, together with the website you came from (just its name, such as facebook.com), the type of device (phone or computer) and any campaign tags in the link. We don’t record who you are, your IP address or your location, and nothing is stored on your device. Each page visit gets a random number that is forgotten when you leave the page. Schools see these counts as totals, for example how many visits came from WhatsApp;
  • sign-in cookies for school staff. See our Cookie policy.

3. What is shown publicly

A campaign page is public so the school can share it. It shows the school’s name and logo, the project, the amount raised, and the name you entered on each funded block. Use a nickname, initials or a family name if you’d rather not show your full name. Email addresses and phone numbers are never shown publicly.

4. Why we use it

  • To run the campaign: to reserve and record your block, show your name on it, confirm your payment, and let the school thank you or contact you about your gift.
  • To run school accounts: to sign staff in, keep each school’s data separate, and send service emails such as sign-in links.
  • To show schools what’s working: anonymous totals of visits, shares and funded blocks per campaign.
  • To keep BLOCKr safe: to prevent fraud and abuse and fix problems.
  • To meet legal duties: for example keeping records of payments.

We rely on these grounds under section 11 of POPIA: the information is needed to carry out what you asked for (your gift or the school’s account), to comply with the law, or for the legitimate interests of the school and BLOCKr in running a safe fundraising service. We will not send you marketing unless you’ve agreed to it, and you can unsubscribe at any time.

5. Who we share it with

We don’t sell personal information. We share it only with:

  • The school running the campaign: your name, contact details and gift.
  • PayFast (South Africa): processes card payments for the school.
  • Supabase: stores our database and handles sign-in; our database is hosted in Frankfurt, Germany.
  • Vercel: hosts the website; requests may be processed in the United States or other regions.
  • Upstash: keeps short-lived counters (including IP addresses) used to limit abuse.
  • Our email providers: send sign-in emails to school staff and, once set up, payment receipts to supporters.
  • Authorities, only when the law requires it.

These providers may only use the information to provide their service to us.

6. Information stored outside South Africa

Some of our providers store or process information outside South Africa, mainly in the European Union and the United States. Section 72 of POPIA allows this where the information is protected by law or binding agreements that give protection similar to POPIA. Our database is in the EU, which is covered by the General Data Protection Regulation, and our providers are bound by data-protection terms with us.

7. How we protect it

  • All connections to BLOCKr are encrypted (HTTPS).
  • Database rules keep each school’s information separate, so staff can see only their own school’s data.
  • School staff sign in with one-time email links; we don’t store passwords.
  • Card payments happen on PayFast’s pages; card details never reach BLOCKr.
  • If we believe personal information has been accessed by someone unauthorised, we’ll notify the Information Regulator and the people affected as POPIA requires (and the school, where it concerns its supporters).

8. How long we keep it

  • Records of gifts and payments: for as long as the school needs them and at least five years after the campaign closes, because financial records must be kept that long.
  • School staff accounts: while the account is active; removed when a school removes the person or closes its account.
  • Abuse-prevention counters: they expire automatically, within an hour.
  • Anonymous campaign statistics: individual events are deleted after 13 months; schools keep the daily totals.

After that, we delete the information or remove anything that identifies you.

9. Children

BLOCKr is meant for adults. Supporters paying by card must be 18 or older or have a parent’s or guardian’s permission. Schools must have a parent’s or guardian’s consent before uploading photos in which learners can be identified. If you think we hold a child’s information without the right consent, contact us and we’ll remove it.

10. Your rights

Under POPIA you can:

  • ask whether we hold information about you, and for a copy of it;
  • ask us to correct information that is wrong, or delete information we no longer need or shouldn’t have;
  • object to us using your information, including for marketing;
  • complain to the Information Regulator.

If your request is about a gift to a school, you can contact the school directly or ask us and we’ll pass it on. We may ask you to confirm your identity first. How to make a formal request is set out on our Access to information page.

11. Contact and complaints

Questions or requests: [contact email to be confirmed].

If you’re not happy with how we’ve handled your information, you can complain to the Information Regulator of South Africa: inforegulator.org.za.

If we change this notice, we’ll update the date at the top. Significant changes will also be shown on the site.