- Status
- Published
- Version
- 1.0
- Effective
- 4 August 2026
- Last reviewed
- 4 August 2026
- Review cycle
- Annually
- Last updated
- 4 August 2026
Purpose
To ensure that personal, operational and safeguarding information is kept only for as long as it is needed for a lawful, contractual or safeguarding purpose, and is then deleted or securely disposed of.
Scope
All information held by the Sister EF Legacy of Purpose Foundation, including website enquiries, newsletter subscriptions, donation records, volunteer and partner records, employment and service-delivery records, safeguarding records and support requests.
Responsibilities
The Founder and Chief Executive Officer holds overall accountability. Administrators with role-based access are responsible for applying retention rules within their area of responsibility.
Retention principles
Information is collected for defined operational, safeguarding, contractual and reporting purposes. It is retained only while that purpose remains valid, or for as long as South African law requires it to be kept.
- Information is not retained "just in case" it may one day be useful.
- Access is limited according to role and responsibility.
- Mental-health referrals, support requests, employment information, tender documents, donor information and general website enquiries are held separately and are not combined into a single unrestricted dataset.
- No Foundation dataset is made available to artificial-intelligence services by default.
Retention periods
| Category | Typical retention |
|---|---|
| General website enquiries and contact-form submissions | 24 months from last contact |
| Newsletter subscriptions | Until the subscriber unsubscribes, then a suppression record only |
| Donation and financial records | Five years, as required by South African financial and tax law |
| Volunteer, partner and supplier records | Duration of the relationship plus three years |
| Employment, placement and occupational health and safety records | As required by applicable labour and OHS legislation |
| Support requests and referral records | Kept only as long as the support pathway is active, plus a minimal closure record |
| Safeguarding and child-protection records | Retained for the longer statutory period applicable to protection matters |
| Website security and access logs | 12 months |
Where a longer period is required by law, a contract, a funder agreement, an audit or an ongoing investigation, the longer period applies and the reason is recorded.
Deletion, correction and objection
You may ask us to confirm what information we hold about you, to correct it, or to delete it. Requests are acknowledged within five working days and completed within 30 days unless a lawful reason prevents deletion, in which case the reason is explained to you.
Requests should be sent to info@eflegacy.org with the subject line "Data request".
Secure disposal
- Electronic records are deleted from live systems and removed from backups on the normal backup-expiry cycle.
- Documents in private storage are deleted; tender, health and safeguarding files are never held in public storage.
- Paper records are shredded.
- Access and administrative actions are logged securely.
Incidents
If information is lost, exposed or accessed without authorisation, our incident-reporting pathway is followed, affected people are informed where required, and the Information Regulator is notified where the law requires it.
Questions about this policy? Email info@eflegacy.org and a member of our team will respond within five working days.