Privacy Policy

1. Introduction

The Sparks Impact Fellowship NPC (“Sparks”, “we”, “us” or “our”) is committed to protecting the personal information of everyone we work with: our fellowship participants, our employees, and the representatives of our business partners. This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to it.

This policy is prepared in accordance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), South Africa’s data protection law.

2. Who This Policy Covers

This policy applies to personal information we process about:

• Fellowship participants: individuals who apply to, are selected for, or complete our fellowship programmes;
• Employees: our staff and, where applicable, contractors; and
• Business partners: the companies we contract and work with, and the individual contact people who represent them.

POPIA extends certain protections to the personal information of juristic persons (companies) as well as natural persons, so our business customers’ information is covered by this policy in addition to that of individuals.

The fellowship is open to applicants aged 18 or older only. We do not knowingly collect personal information from children, and if we become aware that we have, we will delete it.

3. Our Information Officer

Our Information Officer is responsible for ensuring our compliance with POPIA, handling data subject queries, and managing any data breaches.

• Name: Rowan Spazzoli
• Email: rowan@the-sparks.io
• General enquiries: team@the-sparks.io
• Registration Number: 2026-066408

4. Personal Information We Collect

4.1 Fellowship applicants and participants

Name, email address, phone number, CV, LinkedIn profile, current location, education history, your responses to our application questions, sector interests, and how you heard about us. We welcome applications from South Africa and internationally. If you are selected, we also keep programme and post-programme engagement records.

4.2 Employees

Name, identification number, banking details, contact information, employment and performance records, and, where relevant, medical certificates supporting extended sick leave.

4.3 Business customers

Company name and registration number, and the name, email address, and other contact details of the individuals who represent the company to us.

4.4 Special personal information

Employee medical certificates fall into POPIA’s category of “special personal information”, which receives extra protection. We collect these only to support sick-leave records, and access is restricted to management/HR.

4.5 The high school question

On our fellowship application, we ask which high school you attended. This is not itself “special personal information” under POPIA, but we use it as one indicator of socio-economic background, so it can function as an indirect proxy for characteristics such as race or historical disadvantage. We ask it in support of our commitment to redress and inclusion, consistent with the equity purposes recognised under POPIA. You may select “prefer not to say” if you do not wish to answer, and this will not affect how the rest of your application is assessed. We limit access to this field and keep it only as long as needed for the purpose above.

4.6 Website enquiries

When you use a form on our website, we collect your name, your email address, your message, the option you choose to tell us what you are interested in, and, on some forms, your organisation. We use this only to respond to you. Please do not include sensitive personal information in the message field.

5. How We Collect Your Information

We collect personal information directly from you — for example, through fellowship applications, employment contracts, or business agreements — and, occasionally, from third parties such as referees or partner organisations, with your knowledge.

6. Why We Process Your Information, and Our Lawful Basis

We process personal information for purposes including:

• Assessing and administering fellowship applications and delivering our programmes — on the basis that this is necessary to take steps toward, and perform, an agreement with you (or, before selection, our legitimate interest in fairly assessing applications);
• Managing our employment relationships, including payroll and performance — on the basis of your employment contract and our legal obligations;
• Contracting and delivering services to and with our business customers — on the basis of that contract; and
• Meeting our legal, tax, and regulatory obligations — on the basis of the relevant legal obligation.

Where we ask for your consent — for example, to keep an unsuccessful application on file for future opportunities — that consent is separate, specific to that purpose, and can be withdrawn at any time without affecting the processing already carried out, or the assessment of your current application.

7. Providing Your Information: Voluntary or Mandatory

The fields marked as required on our application form, employment contracts, and customer agreements are necessary for us to assess your application, employ you, or contract with you — if you don’t provide them, we may be unable to proceed. Any optional fields (such as the talent-pool preference) are entirely your choice, and declining them will not affect your application, employment, or contract.

8. Sharing Your Information

We do not sell personal information. We share it only where necessary, including with:

• Service providers who process data on our behalf (our “operators” under POPIA): Airtable (data management), SimplePay (payroll), Xero (accounting), Google Workspace (email/documents), Slack (internal communication), and Zoom (video calls), and Netlify (website hosting, and receiving the enquiries submitted through our website forms);
• Professional advisors, auditors, or regulators, where required by law; and
• Any party you have specifically consented to us sharing your information with.

Where we use third-party service providers, we take reasonable steps to ensure they protect your information to a standard consistent with POPIA, including through written agreements.

9. Cross-Border Transfers

Some of our service providers store data outside South Africa. Our primary data management system, Airtable, is configured to host data in the European Union. We also use other service providers (including for payroll, accounting, email, communication, and video calls), our website hosting provider (Netlify), and the third-party services described in Section 13, which may process data outside South Africa. Where personal information is transferred outside South Africa, we take steps to ensure it remains subject to a comparable level of protection, whether through the receiving country’s own data protection laws or through contractual safeguards with the provider, and we are working through vendor-by-vendor confirmation of these safeguards.

10. How Long We Keep Your Information

We keep personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. As a general guide:

• Unsuccessful fellowship applications: 12 months after the relevant round closes, unless you opt in to being kept on our talent-pool list.
• Talent-pool applicants: kept for a maximum of 24 months from when you opt in, at which point we will ask you to confirm you’d still like to be kept on file — if we don’t hear back, your details are deleted. You may withdraw at any time by emailing team@the-sparks.io.
• Selected fellows and alumni: for as long as we maintain an active relationship with you, with a review roughly every three years to confirm your details and preferences.
• Employee records: generally 5 years after your employment ends, though some record types carry their own specific statutory retention period (for example under tax or labour legislation), which we apply where it differs from this default.
• Business customer records: 5 years after our contractual relationship ends.

11. How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and misuse, including restricting access on a need-to-know basis and using secure systems for storage and processing.

12. Your Rights

Under POPIA, you have the right to:

• Be told what personal information we hold about you and why;
• Request access to your personal information;
• Request that we correct or delete inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained information;
• Object to the processing of your personal information in certain circumstances, including for direct marketing; and
• Lodge a complaint with the Information Regulator if you believe we have not complied with POPIA.

To exercise any of these rights, please contact our Information Officer using the details in Section 3. Where the Information Regulator has published prescribed forms for correction, deletion, or objection requests, we will make these available on request and accept submissions made using them.

13. Cookies and Website Tracking

Our website does not use tracking cookies, analytics tools, or advertising pixels.

Our fonts and animation code are hosted on our own website, so loading them does not send your information to a third party. Some features load from or link to third-party providers: an embedded Google Map on our contact page, Google reCAPTCHA, which protects our website forms from spam, and our open application form, which is hosted by Airtable and opens in a new tab. When your browser loads these, the provider receives your IP address and basic browser information, and may set its own cookies. We do not control how these providers handle that information, and we recommend you read their privacy policies.

If we add analytics, a newsletter sign-up, or any other tracking in future, we will update this policy and, where required, ask for your consent before any tracking begins.

14. Changes to This Policy

We may update this policy from time to time. We will post the updated version on our website with a revised date, and, where changes are material, we will take reasonable steps to notify you directly.

15. How to Lodge a Complaint

If you believe we have handled your personal information unlawfully, you may contact our Information Officer in the first instance. You may also lodge a complaint directly with the Information Regulator, including using their prescribed complaint form:

• Email: complaints.IR@justice.gov.za
• Website: inforegulator.org.za

16. Contact Us

If you have any questions about this policy or how we handle your personal information, please contact:

• Rowan Spazzoli, Information Officer
• Email: rowan@the-sparks.io