Last updated: 4 August 2026

Who we are

Grow NPO provides professional vetting, compliance and advisory services to South African non-profit organisations, and helps corporate funders identify credible NPOs to partner with. In terms of the Protection of Personal Information Act (POPIA), Grow NPO is the responsible party for the personal information described in this notice.

What we collect

We only collect what we need in order to vet an organisation:

• Contact person details — name, title, position, email address and phone number.
• Organisation details — organisation name, registration type and numbers, tax and PBO numbers, address, website, focus areas, description of work, mission and areas of operation.
• Compliance documents — the documents you upload, such as your NPO certificate, tax clearance, financial statements, trust deed and bank confirmation letters.
• Account information — your username (your email address) and an encrypted form of your password. We never store your password itself and cannot see it.
• Usage information — a record of pages visited within the portal, and the date, time, IP address and browser used when you gave consent.

Why we collect it

• To verify that your organisation is registered, compliant and legitimate.
• To review the documents you submit and tell you what has been approved or needs to be corrected.
• To contact you about your application, including a short verification call.
• To identify where Grow NPO may be able to assist your organisation with the services we offer.
• To keep an audit record proving that vetting was carried out properly.

We do not use your information for automated decision-making. A person from the Grow NPO team reads and judges every document.

Your consent

We process this information on the basis of the consent you give when you register. We store the exact wording you agreed to, together with the date, time and IP address, so that both you and we have a clear record of it.

You may withdraw your consent at any time by contacting us using the details below. Withdrawing consent means we can no longer vet or represent your organisation, and we will close your account.

Who we share it with

Once your organisation is vetted, the details of your organisation and your vetting outcome may be made visible to corporate funders through our directory. This covers your organisation's information, not the personal information of your contact person beyond the business contact details needed to reach you.

We do not sell your information. We do not share your compliance documents with funders or any other third party without your instruction, except where we are required to do so by law.

How long we keep it

We keep your account, profile and documents for as long as your organisation has an active account with us. After an account is closed we keep the vetting record and its supporting documents for a further five years, so that we can evidence that a vetting was properly carried out. After that period it is deleted.

Records of documents and status changes are never silently altered. Superseded versions of a document are retained as part of the audit trail.

How we protect it

• The portal is accessible only with a username and password, and passwords are stored in encrypted form.
• Uploaded documents cannot be reached by a web address. They are served only to a signed-in user who is entitled to see them.
• Your organisation's documents are visible only to you and to the Grow NPO team.
• Access to the portal is logged.

Your rights

Under POPIA you have the right to:

• Ask what personal information we hold about you.
• Ask us to correct information that is wrong or incomplete. You can correct most of it yourself from your Home page.
• Ask us to delete information we no longer have a lawful reason to keep.
• Withdraw your consent.
• Object to how we process your information.
• Complain to the Information Regulator of South Africa.

Contact us

For anything relating to this notice, or to exercise any of the rights above, contact us:

• Email: info@grownpo.co.za
• Phone: +27 82 652 0988

You may also complain directly to the Information Regulator (South Africa) at inforegulator.org.za.