Privacy Notice

1. Summary

SD-LINK helps people find, pay for and complete skills-development courses. To do that we process personal information — including, for learners, details such as your ID number and the documents you upload to prove who you are and what you have studied. This notice explains what we collect, why, who sees it, how long we keep it, and the rights you have under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

• We collect what we need to run your account, enrol you, take payment, assess you and issue certificates.
• The training provider (SDP) you join sees the information it needs to teach and administer you. HR partners see only a limited set of applicant details.
• We use trusted service providers (for example Amazon Web Services, Paystack and Vercel). We do not sell your personal information.
• We only send you marketing if you opt in, and you can opt out at any time.
• You can ask to see, correct or delete your information, object to its use, and complain to the Information Regulator.

2. Who we are and who to contact

The “responsible party” for the SD-LINK Platform is {{COMPANY_REGISTERED_NAME}} (registration number {{CIPC_REGISTRATION_NUMBER}}), {{PHYSICAL_ADDRESS}}.

Training providers are responsible parties too. When you apply to, join or study with a training provider (SDP), that SDP also receives and uses your information for its own purposes — to run your course and meet its own legal duties. For that use the SDP is a responsible party in its own right and its privacy practices apply alongside this notice. “Applicant” information that an HR partner sees is likewise used by that HR partner for its recruitment.

3. What personal information we collect

What we collect depends on your role. We collect information you give us, information created as you use the Platform, and information given to us by SDPs and HR partners who add or invite you.

Information about other people. If you give us someone else’s details (for example an emergency contact, or a class list an SDP uploads), you confirm you are entitled to do so and that the person knows.

4. Why we use your information and our lawful basis

POPIA lets us process personal information only on a lawful basis. We rely on these, and we never use your information for a purpose incompatible with the one we collected it for.

Consent. Where we rely on your consent you can withdraw it at any time by contacting us or, for marketing, using the unsubscribe link. Withdrawing consent does not affect processing done before you withdrew, and it may mean we can no longer provide a feature that needs the information.

Why we ask for your ID number. Accredited training providers must be able to identify each learner and may be required to report learner records (which include ID numbers) to bodies such as SETAs, the QCTO and SAQA. Providing your ID number is optional on the Platform until an SDP needs it for your enrolment.

5. Who we share information with

We do not sell your personal information. We share it as follows.

Training providers (SDPs) and their facilitators. The SDP you apply to, enrol with, or join through a signup link can see the information it needs to teach and administer you: your name and contact details, your learner profile, documents you share with it, progress, attendance, results and certificates. Facilitators in that SDP see what the SDP allows.

HR partners. If you apply for an opportunity published by an HR partner, it sees a limited applicant view — for example your name, relevant qualifications, programme results and location — and not your ID number, date of birth, gender, disability information or emergency contacts.

Other people on the Platform. Your display name and posts in the community forum, and your name in live sessions, are visible to other participants.

The public. Anyone with a certificate’s credential ID can see the learner’s name, programme, provider and issue date on the verification page. SDP profiles and published courses are public.

Funders. If you apply for a bursary or a sponsor pays for your course, we may confirm your enrolment and progress to that funder with your consent.

Our service providers (operators). They process information for us under written agreements and only on our instructions:

Legal and business reasons. We may disclose information where the law requires it, to the Information Regulator or other authorities, to protect rights and safety, to our professional advisers under confidentiality, or to a successor if the business is sold or restructured (we would tell you).

6. Transfers outside South Africa

Our primary hosting is in South Africa (AWS Cape Town). Some providers we use — for example Vercel (hosting and analytics), Paystack (payments) and our AI service provider — may process information outside South Africa.

Where that happens we make sure it is allowed by POPIA section 72: the recipient is bound by law, binding corporate rules or an agreement that gives your information a level of protection substantially similar to POPIA; or the transfer is necessary to perform our agreement with you; or you have consented.

7. How long we keep information

We keep personal information only for as long as we need it for the purposes above or the law requires, and then delete or de-identify it.

When you close your account we remove or de-identify what we are not required to keep. Records an SDP holds under its own legal duties are governed by that SDP’s retention rules.

8. How we protect your information

We take reasonable technical and organisational measures to prevent loss, damage or unauthorised access to personal information, as POPIA section 19 requires. These include:

• encryption of data in transit (HTTPS/TLS);
• sign-in handled by Amazon Cognito, with passwords never stored in readable form;
• role-based access and tenant isolation, so SDPs, facilitators, HR partners and learners can only see what their role allows;
• private storage for identity and qualification documents, delivered only through short-lived signed links;
• restricted staff access, least-privilege service accounts and activity logging; and
• security and dependency reviews as we build and update the Platform.

No system is perfectly secure. If a security compromise affects your personal information we will notify the Information Regulator and you as POPIA section 22 requires, as soon as reasonably possible.

9. Your rights

Under POPIA you have the right to:

• Know and access — ask whether we hold personal information about you and get a copy of it;
• Correct or delete — ask us to correct inaccurate information, or to delete information we are no longer entitled to keep;
• Object — object, on reasonable grounds, to our processing based on legitimate interests, and object at any time to direct marketing;
• Withdraw consent — where we rely on it;
• Human review of automated decisions — some multiple-choice assessments are marked automatically. You can ask your SDP for a person to review a result, and AI suggestions are never the only basis for a decision about you; and
• Complain — to us, and to the Information Regulator.

How to use your rights. Email our Information Officer at {{INFORMATION_OFFICER_EMAIL}} (or {{SUPPORT_EMAIL}}). We may ask you to prove your identity first so we do not give your information to someone else. We aim to respond within 30 days, and where the law allows a prescribed fee for an access request we will tell you before we charge it. You can update much of your information yourself in your profile.

Requests about information an SDP or HR partner holds should go to that organisation; we will help pass them on.

Complaints to the Regulator. If you are unhappy with how we handle your information, you may complain to the Information Regulator:

10. Children

SD-LINK is intended for people aged 18 and over. We do not knowingly collect personal information about a child (under 18) unless a parent or legal guardian has consented, or the law otherwise allows, as POPIA sections 34 and 35 require — for example where an SDP enrols a learner under 18 on a programme designed for them and obtains that consent. If you believe a child has given us information without consent, contact our Information Officer and we will delete it.

11. Direct marketing

We send electronic marketing (such as newsletters, new-course alerts and offers) only to people who have opted in — for example by ticking the optional box when they sign up. Every marketing email has an unsubscribe link, and you can also change your choice by contacting us. We will keep sending service messages that you need (for example payment receipts or session reminders) even if you opt out of marketing.

12. Cookies and analytics

We use essential cookies to keep you signed in and remember your preferences, and — only if you choose “Accept all” — privacy-friendly analytics that do not use cookies and are not used for advertising. See the Cookie Policy for details and how to change your choice.

13. AI features

The AI career advisor sends the text you type (and the last few messages of your conversation) to our AI service, which uses a third-party language model to write an answer from our published course and bursary catalogue. We do not send your name, email or account details with your question.

When an SDP or HR partner asks for AI-assisted applicant ranking, we send the AI service the applicants’ names, motivation text and programme results so it can suggest an order. The ranking is advice only — a person makes the decision, and an applicant can ask that person to explain it.

AI output can be wrong. Please do not put ID numbers, bank details or other sensitive information into the advisor.

14. Changes to this notice

We may update this notice. The version date is at the top of the page. If a change is material we will tell you by email or in the Platform, and where the law requires it we will ask for your consent again.

15. Contact us

Information Officer: {{INFORMATION_OFFICER_NAME}}, {{INFORMATION_OFFICER_EMAIL}}. Postal address: {{POSTAL_ADDRESS}}. Telephone: {{SUPPORT_PHONE}}.