Last updated: 4 August 2026

1. Who this agreement is between

This agreement is between Grow NPO and the Corporate Sponsor registering on this platform. It takes effect when the Corporate Sponsor accepts it at registration, and it stays in force for as long as the Corporate Sponsor holds an account.

It is entered into in terms of the Protection of Personal Information Act 4 of 2013 (POPIA) and governs how personal information is shared and used between the parties.

2. Roles of each party

• For the Corporate Sponsor's own account information — the contact person's name, position, email address and phone number — Grow NPO is the responsible party.
• For NPO information made available through the directory, Grow NPO is the responsible party and the Corporate Sponsor is an independent recipient. The Corporate Sponsor becomes the responsible party for whatever it does with that information after receiving it.
• Neither party is the other's employee, agent or partner, and neither may bind the other.

3. What Grow NPO collects from a Corporate Sponsor

• Company name, company registration number and website.
• The contact person's name, position, email address and phone number.
• The industries and causes the Corporate Sponsor selects.
• An encrypted form of the account password. Grow NPO never stores or sees the password itself.
• A record of pages visited within the platform, and the date, time, IP address and browser used when this agreement was accepted.

4. Why it is processed

• To create and administer the Corporate Sponsor's account.
• To make the directory of vetted NPOs available, and to prioritise organisations matching the selected industries.
• To contact the Corporate Sponsor about the platform and about organisations relevant to them.
• To keep an audit record of who accessed NPO information and when.

Grow NPO does not sell Corporate Sponsor information, and does not use it for automated decision-making.

5. How a Corporate Sponsor must treat NPO information

The Corporate Sponsor agrees that information obtained through this platform:

• Will be used only to assess and manage potential or actual funding relationships with the organisations concerned.
• Will not be sold, published, or passed to any third party without the written consent of Grow NPO and the organisation concerned.
• Will not be used for marketing unrelated to funding, and will not be used to build or enrich a mailing list.
• Will be kept secure, with access limited to the people within the Corporate Sponsor's organisation who genuinely need it.
• Will be deleted when the Corporate Sponsor no longer has a lawful reason to keep it, or on written request from Grow NPO where an organisation has withdrawn its consent.

Compliance documents belonging to an NPO — tax clearances, financial statements, trust deeds and bank confirmation letters — are not made available to Corporate Sponsors through the directory. They are shared only where the NPO concerned has specifically instructed Grow NPO to do so.

6. Security

• The platform is reachable only with a username and password, and passwords are stored in encrypted form.
• Uploaded documents cannot be reached by web address and are served only to a signed-in user entitled to see them.
• Access to the platform is logged.
• Each party will take reasonable technical and organisational steps to protect personal information in its possession against loss, damage and unauthorised access.

7. Data breaches

If either party becomes aware of unauthorised access to, or disclosure of, personal information received under this agreement, it will notify the other party without undue delay and in any event within 72 hours, describing what happened, what information was affected and what is being done about it. Where POPIA requires it, the Information Regulator and the affected people will be notified.

8. Sub-processors and cross-border transfer

Grow NPO may use service providers, such as hosting and email providers, to operate the platform. Those providers are bound to confidentiality and security terms no weaker than these. Where information is processed outside South Africa, Grow NPO will ensure the receiving country or provider offers protection comparable to POPIA.

9. How long information is kept

Corporate Sponsor account information is kept for as long as the account is active, and for a further five years after it is closed so that access to NPO information can be evidenced. After that it is deleted.

10. Rights

Under POPIA, the Corporate Sponsor's contact person may:

• Ask what personal information Grow NPO holds about them.
• Ask for it to be corrected or completed.
• Ask for it to be deleted where there is no lawful reason to keep it.
• Withdraw consent, which ends access to the platform and closes the account.
• Object to how it is processed.
• Complain to the Information Regulator of South Africa.

11. Ending this agreement

Either party may end this agreement on written notice. On termination, the Corporate Sponsor will stop using NPO information obtained through the platform and will delete it, except where it must be kept by law or to administer a funding commitment already made. Clauses 5, 6, 7 and 9 survive termination.

12. Governing law

This agreement is governed by the laws of the Republic of South Africa, and the parties submit to the jurisdiction of the South African courts.

13. Contact

• Email: info@grownpo.co.za
• Phone: +27 82 652 0988

Complaints may also be made to the Information Regulator (South Africa) at inforegulator.org.za.