Inherited Mess

I inherited a website for a non-profit organization from the previous media coordinator. No one who previously created/worked on the website ever installed wordpress or backed up the website. They have no information other than they pay to have a custom domain.

Does anyone know if it is safe to update wordpress and my theme without losing anything?

I have never worked with wordpress before, so please be kind.