How we handle your personal information.

1. Who we are

Overberg Choir is a community choir based in Onrus, Hermanus, in the Western Cape of South Africa. For the purposes of POPIA, Overberg Choir is the Responsible Party in respect of the personal information we collect from you.

Our Information Officer is Cliff van Tonder, founder and Musical Director.

2. What information we collect

When you register your interest in joining the choir, we ask you to provide:

• Your first name and last name
• Your email address
• Your phone number (optional)
• The suburb or town where you live
• Your preferred voice part (or that you'd like help finding out)
• Whether you've sung in a choir before, and a short description if you have
• What prompted you to consider joining
• How you heard about us
• Whether you'd be interested in helping behind the scenes
• Anything else you'd like to share with us
• Your consent to the processing of this information and (optionally) to receiving choir email updates

We may also automatically collect basic technical information about your visit (such as the date and time of submission, and your IP address at the moment of submission) for security and abuse-prevention purposes.

Once membership subscriptions begin, we also process information about your payments. Your card details are entered directly with our payment processor (see Section 5) and are never seen or stored by us. We receive only confirmation of your payment, such as the amount, the date, and a masked reference like your card type and its last four digits.

3. Why we collect it

We use the information you give us strictly for the running of the choir:

• To contact you with information about the choir, rehearsal dates, fees, concerts and events
• To plan voice balance, repertoire and rehearsal logistics
• To understand where our members come from across the Overberg
• To send you newsletters and updates, only if you have opted in
• To respond to questions, requests or concerns you raise with us
• To process your membership subscription payments once subscriptions begin
• To keep records that may be required by South African law (for example, financial records once subscriptions begin)

We do not sell your personal information. We do not use it for profiling or automated decision-making.

4. Our lawful basis

Under section 11 of POPIA, we process your personal information on the basis of your consent, which you provide when you tick the consent box on our registration form. For newsletter emails, we rely on a separate, optional opt-in.

You may withdraw your consent at any time (see Section 9). Withdrawing consent does not affect the lawfulness of any processing we did before the withdrawal.

5. Who else sees it

Your personal information is handled by a small number of trusted third parties who help us run the choir. Each of them has their own privacy and security commitments.

• Krystal Hosting (United Kingdom), our website and database server. They host the form submissions and back-end systems on our behalf.
• Microsoft Corporation (Microsoft 365), our email system. Email notifications and any correspondence with you flow through Microsoft 365.
• Paystack (a Stripe company), our payment processor for membership subscriptions. When you pay, your card details are entered directly on Paystack’s secure systems; we never see or store your full card number. Paystack processes your name, email and payment details in order to take the payment, in line with its own security and data-protection commitments, including PCI-DSS.
• Our volunteer committee, a small group of choir members who help run the society and who may need to see your contact details for choir administration. They are bound by the same confidentiality expectations as the Information Officer.

We will never share your information with anyone else for marketing or any other purpose without your express consent, unless we are required to do so by law.

6. Where it's stored & cross-border transfer

Because our website and database are hosted by Krystal in the United Kingdom, your personal information is transferred outside South Africa for storage. In line with section 72 of POPIA, we have satisfied ourselves that this transfer is lawful because:

• The United Kingdom is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which provide a level of protection for personal information that is substantially similar to POPIA.
• You have consented to this transfer when you tick the consent box and submit our form.

Microsoft 365 likewise processes data across infrastructure that is bound by equivalent international data-protection commitments.

Our payment processor, Paystack, is a licensed payment provider in South Africa and part of the Stripe group. It processes payment data on secure, PCI-DSS-compliant systems, which may involve processing outside South Africa under equivalent international data-protection safeguards.

7. How long we keep it

We keep the information you provide for as long as you remain interested in or a member of the choir, and for a reasonable period afterwards (usually no more than three years) so that we can let you know about new seasons, special events or anniversaries you might want to be part of.

If you ask us to delete your information sooner, we will do so promptly, except where we are legally required to keep certain records (for example, financial records once subscriptions begin must be kept for the period required by SARS).

8. How we keep it safe

We take reasonable, appropriate technical and organisational measures to protect your personal information against loss, unauthorised access, interference, modification or disclosure. These include:

• Encrypted (HTTPS) connections for every form submission
• Secure server-side storage in a database that is not publicly accessible
• Restricting access to the database to the Information Officer and authorised committee members
• Strong, unique passwords and, where supported, multi-factor authentication on administrative accounts
• Regular software and security updates on our hosting environment

If a security breach happens that puts your personal information at risk, we will notify both you and the Information Regulator as required by section 22 of POPIA.

9. Your rights under POPIA

You have the following rights in respect of the personal information we hold about you. To exercise any of them, simply email privacy@overbergchoir.co.za.

• The right to be notified when your information is being collected and what we will do with it (which this notice exists to do).
• The right to access the personal information we hold about you.
• The right to correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• The right to withdraw your consent to our processing of your information, at any time.
• The right to object to processing on reasonable grounds.
• The right to unsubscribe from our newsletter emails at any time (every newsletter will include a one-click unsubscribe link).
• The right to complain to the Information Regulator (see Section 12).

We will respond to any request as soon as we reasonably can, and within 30 days at the latest.

10. Cookies

Our website does not use tracking cookies or third-party advertising cookies. We may use a single session cookie strictly to keep the website working as you move between pages. We do not use Google Analytics or any other tracking pixel without telling you.

11. Changes to this notice

From time to time we may update this notice, for example, if our processing activities change or if the law changes. When we do, we will update the "Last updated" date at the top of the page. If the changes are substantial we will email registered members directly to let them know.

12. Contact & complaints

If you have any questions about how we handle your personal information, or you would like to exercise any of your rights, please contact our Information Officer:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa: