CraigPark Residents Association

Privacy and POPIA Notice

Last updated: 16 June 2026

1. Introduction

The CraigPark Residents Association (“CRA”, “we”, “us” or “our”) is a voluntary residents association and registered non-profit organisation serving residents, property owners, tenants, businesses and other stakeholders in the CRA area.

NPO registration number: 049-767-NPO
Website: www.cra.org.za
General email: admin@cra.org.za

CRA’s communications, WhatsApp groups, newsletters, emails, website updates, resident databases and community initiatives exist for the benefit of the suburbs we serve and for the broader community and public benefit. They are intended to help residents stay informed, participate responsibly, raise issues, coordinate around local matters, and protect the interests of the community.

CRA is run by volunteers. We do our best, in good faith, with limited time and resources. We have no intention of misusing residents’ personal information, and we aim to handle information in a practical, respectful, lawful and community-minded way.

This notice explains how CRA collects, uses, stores and shares personal information in terms of the Protection of Personal Information Act, 4 of 2013 (“POPIA”). It applies to our website, email communications, newsletters, WhatsApp groups, community notices, resident submissions, town-planning and heritage processes, public-space initiatives, safety communications, events, membership records, volunteer activities and other CRA-related work.

This notice is intended to be practical and resident-facing. It does not replace any specific consent form, PAIA Manual, membership terms, event terms, website terms, WhatsApp group rules or other notice that may apply in a particular context.

2. CRA’s role as responsible party

For most CRA activities, CRA is the “responsible party” under POPIA because CRA decides why and how personal information is collected and used.

Where CRA uses service providers, platforms or professional advisers to process information on CRA’s behalf, those parties may act as “operators” or independent responsible parties, depending on the circumstances.

CRA will take reasonable steps to ensure that people who handle personal information for CRA do so only for proper CRA purposes and in a responsible manner.

3. What personal information CRA may collect

Depending on how you interact with CRA, we may collect and process information such as:

• your name and surname;
• your cellphone number, email address and physical or street address;
• your suburb, street, property, erf or municipal reference details, where relevant;
• whether you are a resident, property owner, tenant, business owner, service provider, volunteer, contributor or stakeholder;
• information you provide when joining a WhatsApp group, mailing list, newsletter, resident database, event, survey, objection process, heritage process or CRA initiative;
• correspondence, queries, complaints, reports, documents, photographs, screenshots or other material you send to CRA;
• contribution, donation, payment or administrative information, where applicable;
• website-related technical information, such as cookies, device information, browser information and basic analytics information, where enabled.

CRA tries not to collect identity numbers, banking details, medical information, information about children, criminal allegations, political views, biometric information or other sensitive information unless it is genuinely necessary and appropriate for a specific purpose.

4. Why CRA processes personal information

CRA processes personal information primarily to support the interests of the suburbs we serve, the residents and stakeholders who live and work here, and the broader community and public benefit connected to CRA’s civic, safety, planning, heritage, environmental and public-space work.

CRA may process personal information to:

• communicate with residents and stakeholders about local issues;
• administer CRA membership, contributor records, donations, events and volunteer initiatives;
• manage WhatsApp groups, mailing lists, newsletters and other communication channels;
• respond to queries, complaints, resident reports and requests for assistance;
• assist with town-planning, land-use, heritage, municipal, enforcement, safety, public-space, environmental and civic matters;
• coordinate with ward councillors, municipal departments, SAPS, CPF structures, security providers, legal or professional advisers, contractors, service providers and other relevant stakeholders;
• submit, support, oppose or comment on applications, proposals, developments, municipal matters or public issues affecting the CRA area;
• keep proper records of matters handled by CRA;
• protect the lawful interests of CRA, residents, property owners, tenants, businesses and the broader community;
• comply with legal, regulatory, governance, accounting or administrative requirements.

CRA does not sell residents’ personal information. CRA does not provide resident contact lists to commercial marketers or political parties.

5. Legal basis for processing

CRA processes personal information only where there is a lawful basis to do so. Depending on the circumstances, this may include:

• your consent, for example where you join a mailing list, WhatsApp group, event, resident database or volunteer initiative;
• the legitimate interests of CRA, residents, property owners, businesses, affected persons or the community;
• performance of an agreement or arrangement with you, for example where you are a contributor, volunteer, contractor, service provider or event participant;
• compliance with legal, regulatory, accounting, governance or administrative obligations;
• protection of a legitimate interest of you, CRA, another resident, an affected stakeholder or the broader community;
• where information has deliberately been made public or forms part of a public record;
• where processing is necessary for legal proceedings, enforcement of rights, incident reporting, engagement with public bodies, or the proper administration of CRA’s activities.

Where consent is the basis for processing, you may withdraw your consent. Withdrawal of consent does not affect lawful processing that took place before withdrawal, or processing that CRA is otherwise permitted or required to continue.

6. WhatsApp groups and community communication channels

CRA uses WhatsApp groups and similar platforms to communicate with residents and stakeholders. These groups are created and administered for community benefit. They are intended to support constructive communication, suburb safety, resident coordination, civic participation and responsible information-sharing.

Access to a CRA WhatsApp group is a privilege, not a right. CRA may create, close, merge, split, moderate, restrict or rename groups where we consider it necessary or appropriate for the proper administration of the group, the protection of residents, privacy, safety, relevance, group purpose or the broader interests of the community.

By joining a CRA WhatsApp group, you understand that:

• your cellphone number, WhatsApp name, profile image and messages may be visible to other group members;
• other members may save, forward or screenshot messages, even though CRA discourages misuse of information;
• WhatsApp and other platforms process information according to their own terms and privacy policies;
• CRA admins may moderate groups, remove inappropriate posts, restrict posting rights, or remove members where necessary;
• CRA may limit membership to residents, property owners, tenants, businesses, stakeholders or other persons relevant to the purpose of a particular group;
• CRA may remove members who misuse information, behave abusively, post irrelevant or harmful content, compromise privacy or safety, or act contrary to the purpose of the group.

CRA administers its groups to improve safety, privacy, relevance and community usefulness — not to undermine them. Group administration is not intended to silence reasonable participation, but to keep the groups functional, lawful, respectful and aligned with their purpose.

Please do not post identity numbers, private addresses, medical information, children’s information, unverified allegations, graphic material, defamatory statements, or information about another person unless it is necessary and appropriate for the group’s purpose.

Where a matter is sensitive, please rather contact CRA privately.

7. Newsletters, emails and donation requests

CRA may send newsletters, civic updates, community notices, meeting notices, event information, contribution reminders or donation requests to people who have subscribed, contributed, joined a CRA channel, engaged with CRA, or are reasonably connected to CRA’s community work.

Because POPIA treats some donation requests and promotional communications as direct marketing, CRA will aim to ensure that bulk electronic communications are sent on a lawful basis and include a practical way to unsubscribe or ask us to stop sending those communications.

You may ask CRA to remove you from a mailing list by using the unsubscribe function, where available, or by contacting us at the details below.

Unsubscribing from newsletters or bulk updates will not necessarily stop direct administrative communications where CRA still needs to communicate with you about a specific matter you raised, a payment or contribution, a volunteer role, an active objection or submission, a governance matter, or a legal or administrative issue.

8. Town-planning, heritage, municipal and objection matters

If you send CRA information for a town-planning, land-use, heritage, municipal, enforcement, objection or public-participation matter, CRA may use that information to assess the issue, communicate with you, brief professional advisers, coordinate resident input, and engage with the relevant authority.

Where you ask CRA to submit, support or assist with an objection, representation, complaint, comment or submission, your name, property details, contact details, objection content or supporting documents may need to be sent to a municipality, public authority, applicant, tribunal, court, councillor, adviser or other relevant party.

Some submissions may become part of a public or municipal record. CRA cannot control how a public body, applicant, tribunal, court or other recipient processes information once it has been lawfully submitted to that body.

9. Safety, security and incident reports

Residents may send CRA information about crime, suspicious activity, by-law issues, illegal dumping, vandalism, traffic issues, damaged infrastructure, fire risks, public-space issues or other community safety matters.

CRA may share relevant information with SAPS, CPF structures, security providers, municipal departments, councillors, emergency services, professional advisers or affected residents where this is necessary and appropriate.

Please avoid sharing unnecessary personal information, graphic material, unverified accusations, identity numbers, private addresses, or information that could endanger another person.

If you are reporting a crime, emergency or active safety risk, you should still contact SAPS, emergency services or your security provider directly. CRA is not an emergency service.

10. Photographs, videos, screenshots and images

CRA may receive or use photographs, screenshots, videos or images for community purposes, including municipal fault reporting, public-space projects, safety alerts, event reporting, heritage matters, newsletters, website content or social media.

Where possible, CRA will avoid publishing unnecessary personal information, close-up images of children, private information, private residences, vehicle registration numbers or identifiable individuals unless there is a lawful and appropriate reason to do so.

If you believe CRA has published an image or information about you that should be removed, corrected or limited, please contact us.

11. Children and sensitive personal information

CRA does not intentionally collect children’s personal information unless there is a lawful and appropriate reason, such as a community event, safety matter, school-related issue, parent-authorised submission, emergency-related communication or other legitimate community purpose.

Please do not post photographs, names, school details, medical details or other identifying information about children in CRA groups unless it is necessary and appropriate. Where a child’s information must be shared, it should preferably be sent privately and with the involvement of a parent or guardian.

CRA also tries to avoid collecting special personal information, including information about health, religion, race, trade union membership, political persuasion, sex life, biometric information or criminal behaviour, unless there is a lawful and appropriate basis to do so.

12. Sharing personal information

CRA may share personal information only where reasonably necessary for a lawful community, administrative, safety, civic, municipal, planning, heritage, legal or public-interest purpose connected to CRA’s work.

This may include sharing information with:

• CRA committee members, portfolio volunteers and authorised administrators;
• municipal departments and other public bodies;
• ward councillors and officials;
• SAPS, CPF structures, security stakeholders and emergency services;
• town planners, attorneys, heritage practitioners, consultants, contractors and other professional advisers;
• website, email, newsletter, database, cloud-storage or IT service providers;
• event organisers, project partners or service providers involved in a CRA initiative;
• courts, tribunals, regulators, applicants, objectors or authorities where required or appropriate;
• affected residents or stakeholders where this is necessary and appropriate for the matter concerned.

CRA does not share information for private gain. Where information is shared, it is done for a practical community, administrative, legal, safety, civic, municipal, planning, heritage or public-interest purpose connected to CRA’s work.

13. Service providers and online platforms

CRA may use third-party service providers and platforms to operate its website, mailing lists, cloud storage, email, newsletters, forms, payment records, WhatsApp groups, documents, analytics or other systems.

These providers may process information according to their own terms, privacy policies and security measures. CRA will take reasonable steps to use reputable providers and to limit access to information to what is necessary for CRA purposes.

Some providers may store or process information outside South Africa. Where this occurs, CRA will take a practical and reasonable approach to using providers that are generally appropriate for community organisations and that offer suitable safeguards.

14. Storage and retention

CRA keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where required or permitted for legal, governance, record-keeping, dispute, accounting, historical, community-reference or public-interest purposes.

Because CRA is a voluntary community organisation, some records may need to be retained to preserve institutional memory, track recurring municipal or planning issues, evidence prior engagement, support ongoing civic work, or protect CRA and residents in future disputes.

Where information is no longer needed, CRA will take reasonable steps to delete, de-identify, archive or restrict access to it.

15. Security

CRA will take reasonable technical and organisational steps to protect personal information against loss, unauthorised access, misuse, alteration or disclosure.

These steps may include access controls, password protection, limiting administrative access, using reputable service providers, keeping records in controlled systems, and restricting access to information to people who need it for CRA purposes.

No email, website, WhatsApp group, cloud platform or online system is completely risk-free. Residents should avoid sending unnecessary sensitive information through open group channels.

If CRA becomes aware of a security compromise affecting personal information, CRA will take reasonable steps to assess the incident, contain it, and notify affected persons and/or the Information Regulator where required by POPIA.

16. Your rights

You may ask CRA to:

• confirm whether we hold personal information about you;
• provide access to your personal information, subject to applicable law;
• correct or update your personal information;
• delete or restrict personal information where CRA no longer has a lawful basis to retain it;
• object to processing where POPIA allows you to object;
• withdraw consent where processing is based on consent;
• unsubscribe from newsletters, donation requests or non-essential bulk communications;
• raise a complaint about how CRA has handled your personal information.

CRA may need to verify your identity before acting on a request. Some requests may be refused or limited where CRA is legally entitled or required to retain, use or refuse access to the information.

17. How to contact CRA about personal information

For privacy, POPIA or personal-information queries, please contact CRA’s Information Officer:

Information Officer: Albert de Bondt
Email: albertdb@cra.org.za
General CRA email: admin@cra.org.za
Website: www.cra.org.za

Please use “POPIA Request”, “PAIA Request” or “Privacy Query” in the subject line where possible.

CRA may need to verify your identity before responding to requests involving access to, correction of, deletion of, or objection to the processing of personal information.

18. Complaints to the Information Regulator

If you are not satisfied with CRA’s response to a privacy concern, you may contact the Information Regulator of South Africa.

Information Regulator of South Africa
Website: www.inforegulator.org.za
Email: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Toll-free: 0800 017 160

19. Updates to this notice

CRA may update this notice from time to time as our systems, communication channels, legal obligations or community activities change.

The latest version will be published on CRA’s website.