PRIVACY POLICY

Last updated: June 2026
| Designed to comply with POPIA

Before we get into the legal details, we want to say something simple:

We built EduMzansi because we believe that every South African student , regardless of where they come from, what school they attend, or what their family earns , deserves access to world-class educational resources and honest career guidance.

That mission only works if you trust us. And trust only works if we are completely transparent about how we handle your personal information.

So we wrote this Privacy Policy differently. Instead of hiding behind complicated legal language designed to confuse you, we wrote this in plain, honest English. We want you to actually read it and understand it. We want you to feel confident that when you visit edumzansi.org, your information is in safe hands.

This policy is fully compliant with:

The Protection of Personal Information Act, 4 of 2013 (POPIA) – South Africa’s primary data protection law
The Electronic Communications and Transactions Act, 25 of 2002 (ECTA) – which governs online transactions and electronic communications in South Africa
The General Data Protection Regulation (GDPR) – the European Union’s gold standard for data protection, which we align with as an international best practice
The Children’s Online Privacy Protection principles – because many of our users are young learners

If anything in this document is unclear, please contact us. We will explain it to you in plain language.

1. Who We Are

EduMzansi is a South African digital education and online learning platform operated by Ultimate Innovative Solution (Pty) Ltd, registration number 2024/284478/07, incorporated in the Republic of South Africa and trading as EduMzansi.

EduMzansi provides educational resources, career guidance, online courses, live cohort classes, student dashboards, assignments, course progress tracking, certificates of completion, instructor-led learning experiences, and related learner support services.

Some resources may be free. Certain courses, workshops, bootcamps, or programmes may require payment.

Our mission is to close the gap between South African learners, students, job seekers, entrepreneurs, and the opportunities available to them after school, during study, and in the workplace.

Platform Name: EduMzansi
Operating Entity: Ultimate Innovative Solution (Pty) Ltd
Company Registration Number: 2024/284478/07
Website: https://www.edumzansi.org
Information Officer: Oziel Mandlakayise Mhambi
Information Officer Email: privacy@edumzansi.org
General Contact Email: info@edumzansi.org
Physical Address: 51 Willow Avenue, Craigavon, Sandton, Johannesburg, Gauteng, South Africa

Our Information Officer is responsible for overseeing how we collect, process, store, use and protect personal information, and for handling privacy requests and complaints.

2. Definitions and Key Terms

To make this policy easier to understand, these are the key terms used throughout this document.

EduMzansi / we / us / our
The EduMzansi platform and its operating entity, Ultimate Innovative Solution (Pty) Ltd.

You / the user
Any person who visits, accesses, registers on, purchases from, teaches on, communicates with, or otherwise uses EduMzansi.

Personal Information
Information that identifies or can reasonably identify a person. This includes names, email addresses, phone numbers, IP addresses, account information, payment-related information, course activity, assignment submissions, attendance records, and other information protected by POPIA.

Processing
Collecting, storing, using, sharing, updating, restricting, deleting, or otherwise handling personal information.

Responsible Party
The organisation that decides why and how personal information is processed. For EduMzansi, this is Ultimate Innovative Solution (Pty) Ltd trading as EduMzansi.

Operator
A third party that processes personal information on our behalf, such as a hosting provider, payment provider, email provider, LMS provider, or live class platform.

Course
Any structured online learning programme, live cohort, bootcamp, workshop, short course, masterclass, training module, or certificate of completion programme offered through EduMzansi.

Student / Learner
Any person who registers for, purchases, enrols in, attends, or participates in a course, class, workshop, or learning activity on EduMzansi.

Instructor
An approved person who creates, teaches, facilitates, or supports course content on EduMzansi.

Certificate
A non-accredited certificate of completion issued by EduMzansi unless expressly stated otherwise on the relevant course page.

Special Personal Information
Sensitive personal information under POPIA, including health information, biometric data, religious beliefs, political views, trade union membership, criminal behaviour, and similar categories.

3. Who This Policy Applies To

This Privacy Policy applies to every single person who interacts with EduMzansi in any way, including:

Learners (Grade 8 to Grade 12)

Our primary audience. If you are a high school student using our past papers, reading our study notes, or exploring career paths, this policy applies to you.

Matric Candidates

If you are in Grade 12 and using EduMzansi to prepare for your National Senior Certificate (NSC) examinations or to navigate your university applications, this policy covers how we handle any information you share with us.

University and TVET College Students

If you have already completed matric and are using our platform for additional guidance or resources, this policy applies to you as well.

Parents and Guardians

If you are a parent or guardian who signed up for our newsletter to stay informed about university application dates, NSFAS updates, or bursary opportunities , this policy explains exactly how we handle your information.

Teachers and School Administrators

If you use our resources to support your classroom or share our content with your students, this policy applies to your interactions with our platform.

General Website Visitors

Even if you never fill in a form or subscribe to anything, simply visiting edumzansi.org means that some basic technical information is automatically collected. This policy explains what that is and why.

Corporate Partners and Prospective Partners

If you are reviewing this policy as part of a due diligence process for a potential partnership with EduMzansi , welcome. This document has been crafted to meet enterprise-grade compliance standards and aligns with international data protection frameworks.

4. POPIA Section 18 — Notification at Point of Collection

In line with Section 18 of POPIA, EduMzansi aims to notify you at or before the point where we collect personal information about who we are, why the information is collected, whether providing it is voluntary or required, who may receive it, whether it may be transferred internationally, and what rights you have.

Identity of Responsible Party:
Ultimate Innovative Solution (Pty) Ltd, registration number 2024/284478/07, trading as EduMzansi.

Information Officer:
Oziel Mandlakayise Mhambi — privacy@edumzansi.org

Purpose of Collection:
To operate EduMzansi, provide resources and courses, manage accounts and enrolments, process payments, deliver live classes, track progress, support assignments, issue certificates, review instructors, provide support, improve services, and meet legal obligations.

Voluntary or Mandatory:
Providing information is generally voluntary, but some information is required to create an account, enrol in a course, complete checkout, attend live classes, submit assignments, obtain certificates, or receive support.

Consequences of Not Providing Information:
You may not be able to access certain features, enrol in courses, receive certificates, complete payment, attend live classes, submit assignments, or receive support.

Categories of Information Collected:
Identity, contact, educational, account, course, payment, attendance, assignment, certificate, communication, technical, analytics, and instructor application data.

Recipients or Categories of Recipients:
Authorised EduMzansi personnel, approved instructors where relevant, service providers, payment processors, LMS tools, live class platforms, and regulators where legally required.

International Transfers:
Some service providers may process data outside South Africa. We take reasonable steps to use appropriate safeguards where applicable.

Your Rights:
You may request access, correction, deletion, objection, restriction, or withdrawal of consent where applicable.

5. What Information We Collect

We have a very clear principle when it comes to data collection: we only collect what we genuinely need. We do not collect information just because we can. Every piece of data we collect serves a specific, legitimate purpose.

Here is a detailed breakdown of the different types of information we may collect:

5.1 Identity Information

This is information that tells us who you are:

Your first name and surname
Your age or date of birth (particularly relevant when assessing whether parental consent is needed)
Your gender (only if voluntarily provided)
Your student status (e.g., current learner, recent matriculant, university student)

5.2 Contact Information

This is how we can reach you:

Your email address – the primary way we communicate with subscribers
Your phone number (only if you choose to provide it through a contact form or WhatsApp channel)
Your physical address (only if required for a specific service or competition prize)

5.3 Educational Information

Because we are an educational platform, some of the most useful information you can share with us relates to your academic journey:

Your current grade (Grade 8 through Grade 12 or beyond)
Your subject choices (e.g., Mathematics, Physical Sciences, Business Studies)
Your academic goals (e.g., wanting to study Medicine, Engineering, Law)
Your province or region (to help us provide location-specific information like university proximity or provincial exam schedules)
Your school name (only if voluntarily provided)

This educational information helps us serve you better. For example, if you tell us you are studying Mathematics and Physical Sciences, we will prioritize sending you information about bursaries in the STEM field rather than sending you irrelevant content.

5.4 Technical and Device Information

When you visit edumzansi.org, our systems automatically receive certain technical details about your visit. This is standard practice for all websites. This information includes:

Your IP address , a numerical label assigned to your device by your internet service provider
Your browser type and version (e.g., Google Chrome 120, Safari 17)
Your operating system (e.g., Android 13, Windows 11, iOS 17)
Your device type (smartphone, tablet, laptop, desktop)
Your screen resolution
The date and time of your visit
The pages you visited on our site and the order in which you visited them
How long you spent on each page
The links you clicked within our site
The website that referred you to us (e.g., Google search, a Facebook post, a friend’s link)

5.5 Behavioral and Interaction Data

Beyond just which pages you visit, we also track how you interact with our content:

Which study guides or past papers you downloaded or viewed most frequently
Which subjects attract the most attention on our platform
Which articles or career guides you read from start to finish versus which ones you left quickly
How you navigate through the site

This data is anonymized and aggregated , meaning we look at patterns across thousands of users, not at what a specific individual did on our site. It helps us understand what is working and what needs to improve.

5.6 Communications Data

When you contact us — whether through a contact form, email, social media message, or WhatsApp , we retain a record of:

The content of your message
The date and time of your communication
Your contact details as provided in that communication
Our response to you

We keep these records so we can track ongoing conversations and ensure we have addressed your needs properly.

5.7 Voluntarily Submitted Content

If EduMzansi runs competitions, surveys, polls, or community features, you may choose to submit additional content such as:

Survey responses about your educational experience
Testimonials or success stories you agree to share
Photos or videos submitted for competitions (with explicit consent)

We will always be clear at the point of collection about exactly how this kind of content will be used.

5.8 What We Do Not Collect

We do not collect:

South African ID numbers unless strictly required for a specific verified purpose and with your explicit consent
Special personal information as defined in Section 26 of POPIA (including race, health, religious beliefs, political opinions, or biometric data) – unless you voluntarily provide it in a message to us, in which case we treat it with the highest level of care
Full payment card numbers, CVV codes, or banking details – these are never stored by EduMzansi directly (see Section 13 for full details on payment processing)

6. How We Collect Your Information

We collect your information through several different channels:

6.1 Directly From You

The most straightforward method. You give us your information when you:

Fill in a contact or inquiry form on our website
Subscribe to our newsletter or email updates
Follow us or message us on social media platforms
Download a resource that requires registration
Enter a competition or participate in a survey
Apply for a bursary or opportunity promoted through our platform
Send us an email directly

6.2 Automatically Through Technology

We may collect information automatically through:

Website logs
Security tools
Server records
Cookies and similar technologies
Analytics tools such as Google Analytics or alternatives
Tutor LMS / WordPress dashboard activity
Course activity tracking
WooCommerce order and checkout status data

6.3 From Third Parties

We may receive information from third parties such as:

Payment gateways for transaction confirmation and payment status
Live class platforms for attendance or participation data
Partner organisations where referrals or joint programmes are lawfully conducted
Social media platforms where you interact with EduMzansi content

7. Our Lawful Basis for Processing (Mapped to Activities)

Under both POPIA and GDPR, we need a legitimate legal reason , called a “lawful basis” , for collecting and processing your personal information. We do not collect data without one.

The table below maps each of our key processing activities to the specific lawful basis we rely on:

Processing Activity	Lawful Basis	Legal Reference
Sending newsletters and educational updates	Consent — you opted in at subscription	POPIA Section 11(1)(a)
Responding to contact form inquiries	Legitimate Interest — responding to someone who contacts us is a clear legitimate interest	POPIA Section 11(1)(f)
Analyzing website usage and improving our platform	Legitimate Interest — improving the service benefits all users	POPIA Section 11(1)(f)
Placing essential cookies	Legitimate Interest — essential cookies are necessary for the site to function	POPIA Section 11(1)(f)
Placing non-essential cookies (analytics, marketing)	Consent — obtained via cookie consent banner at first visit	POPIA Section 11(1)(a)
Retaining contact records for reference	Legitimate Interest — maintaining accurate records of communications	POPIA Section 11(1)(f)
Sharing data with service providers (operators)	Legitimate Interest — necessary to deliver our services	POPIA Section 11(1)(f)
Direct marketing communications	Consent — explicit opt-in required; in line with ECTA Section 45	POPIA Section 11(1)(a); ECTA Section 45
Complying with legal orders or regulatory requirements	Legal Obligation — required by South African law	POPIA Section 11(1)(c)
Security monitoring and fraud prevention	Legitimate Interest — protecting users and the platform	POPIA Section 11(1)(f)
Research and anonymized impact reporting	Legitimate Interest — advancing educational equity in South Africa	POPIA Section 11(1)(f)
Processing data of users under 13	Parental Consent — required before any processing occurs	POPIA Section 35

Where we rely on legitimate interest as our lawful basis, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interest at any time (see Section 16).

8. How We Use Your Information

Here is a complete and honest list of everything we use your information for:

8.1 Delivering Educational Content

The primary reason we collect educational preferences and grade information is to make sure you receive content that is actually relevant to you. A Grade 10 student studying History needs different resources from a Grade 12 student preparing for Mathematics Paper 2. Your information helps us serve you better.

8.2 Sending You Important Updates

Education in South Africa moves fast. University application dates open and close. NSFAS has strict deadlines. New bursaries appear and disappear. We use your contact information to make sure you never miss an important deadline or opportunity.

We only send you updates that are genuinely relevant and useful. We are not in the business of filling your inbox with content you did not ask for.

8.3 Improving Our Platform

We analyze how users interact with edumzansi.org to identify what is working well and what needs improvement. This might mean noticing that a particular past paper is downloaded thousands of times (so we should add more like it) or that a certain article has a very high “bounce rate” (meaning people leave quickly, suggesting the content needs improvement).

8.4 Responding to Your Inquiries

When you contact us with a question , whether about a specific past paper, a university application, or a bursary , we use your contact details and the information in your message to give you an accurate, helpful response.

8.5 Ensuring Platform Security

Technical data like IP addresses help our systems detect and prevent:

Unauthorized access attempts
Bot traffic that slows down the site for real students
Fraudulent activity
Any attempts to misuse or scrape our content

8.6 Complying With Legal Requirements

Sometimes South African law requires us to retain certain records or provide information to authorities. We comply fully with all legal obligations.

8.7 Research and Impact Reporting

As a social enterprise focused on educational equity, EduMzansi may from time to time produce anonymized reports on the state of education access in South Africa. This research uses aggregated, anonymized data only , no individual student is ever identified in these reports.

9. How We Keep Your Data Safe

Data security is not optional for us , it is a core responsibility. Here is exactly what we do to protect your information:

9.1 Encrypted Connections

Every page on edumzansi.org is served over HTTPS , a secure, encrypted connection. Any information transmitted between your device and our servers is protected from interception by third parties. You can verify this by looking for the padlock icon in your browser’s address bar.

9.2 Access Controls

Not everyone at EduMzansi has access to your personal information. We operate on a “need-to-know” basis , only team members who genuinely need access to specific data in order to do their jobs are granted that access. All access is logged and reviewed.

9.3 Secure Hosting

Our website and databases containing user information are hosted on reputable, security-certified hosting platforms. As EduMzansi scales, we are actively committed to transitioning to enterprise-grade cloud infrastructure that meets international security certifications such as ISO 27001 and SOC 2.

9.4 Regular Security Reviews

We conduct regular internal reviews of our data handling practices, security configurations, and access logs. We keep ourselves updated on the latest cybersecurity developments and threats relevant to educational platforms.

9.5 Data Minimization

One of the best ways to protect data is to not collect it in the first place. We follow a strict data minimization principle , we only collect what we actually need, which means there is less data at risk if anything ever goes wrong.

9.6 Incident Response and Breach Notification

In the unlikely event of a data breach or security incident, EduMzansi has a clear response protocol aligned with Section 22 of POPIA:

We will contain the breach as quickly as possible upon discovery
We will investigate the cause and extent of the incident
We will notify the Information Regulator of South Africa as soon as reasonably possible and no later than 72 hours after becoming aware of a breach that poses a risk to your rights and freedoms
We will notify affected users directly without undue delay where the breach is likely to result in a high risk to their rights
We will implement corrective measures immediately to prevent recurrence
We will maintain a breach register documenting all incidents, their causes, and our responses

We will never attempt to conceal or minimize a security incident. Transparency is non-negotiable.

9.7 Staff Training and Awareness

Every member of the EduMzansi team who handles personal information receives training on data protection obligations under POPIA. Good data security starts with people, not just technology.

10. How Long We Keep Your Data

We do not hold onto your data indefinitely. Here is our complete retention schedule:

Data Type	Retention Period	Reason
Newsletter subscriptions and email preferences	Until unsubscribe or deletion request; opt-out record retained for 3 years	ECTA Section 45 compliance and consent records
Contact form inquiries and support communications	3 years from last interaction	Legitimate interest — accurate records of communications
Website analytics and usage data	According to provider settings (typically 26 months for Google Analytics)	Platform improvement and performance analysis
Account information	While active and for a reasonable period after closure	Legal, fraud prevention, and dispute purposes
Course progress, assignments and certificates	While active and for a reasonable period after course completion	To support records, disputes, and learner support
Order and payment records	Minimum 5 years	South African Income Tax Act and Tax Administration Act (SARS requirements)
Instructor application data	Duration of application process plus a reasonable period thereafter	Audit, compliance, and future opportunity assessment
Security and access logs	Up to 12 months	Security monitoring and fraud prevention
Anonymized and aggregated research data	Indefinitely	Research and impact reporting — cannot identify individuals

Once the applicable retention period has passed, we securely delete or anonymize your data. Anonymized data (data from which you cannot be identified) may be retained indefinitely for research and reporting purposes.

If you request deletion of your data before the retention period has ended, we will honor your request within 21 business days, except where we are legally required to retain it, in which case we will inform you of the specific legal obligation preventing deletion.

11. Do We Share Your Information?

The foundational answer is: we do not sell your data, ever. Your personal information is not a product. But we do work with certain trusted third parties who help us run our platform effectively. Here is the full picture:

11.1 Service Providers (Operators)

These are companies that process data on our behalf to help us deliver our services. They are only given access to the minimum information necessary to do their job, and they are contractually prohibited from using your data for their own purposes. Full details of our named third-party processors are in Section 12.

11.2 Corporate Partners

As EduMzansi forms strategic partnerships with technology and education companies, certain anonymized or aggregated data may be shared with partners for:

Joint research into educational access and outcomes in South Africa
Developing new tools that benefit students
Impact reporting that demonstrates the reach and effectiveness of our platform

Individual identifying information is never shared with partners without your explicit consent.

11.3 Legal Disclosures

We may be required to disclose your information if:

A South African court issues a valid order requiring disclosure
A regulatory authority (including the Information Regulator) makes a lawful request
We are required to comply with any other applicable South African law or legal process

In all such cases, we will disclose only the minimum information required and, where legally permitted, we will notify you that such a request has been made.

11.4 Business Transfers

In the unlikely event that EduMzansi or Ultimate Innovative Solution (Pty) Ltd is acquired, merges with, or transfers its assets to another organization, your personal information may be transferred as part of that transaction. If this ever happens:

We will notify you with at least 30 days’ advance notice through a prominent notice on our website and via email to subscribers
We will ensure the receiving organization agrees to honor this Privacy Policy or provide equivalent protections
You will have a clear 30-day window to request deletion of your personal data before the transfer is completed
Any data transferred will remain subject to the protections described in this policy

11.5 With Your Explicit Consent

Outside of the scenarios described above, we will only share your personal information with third parties if you have given us your explicit, informed consent to do so.

12. Our Third-Party Processors

In the interest of full transparency, here are the specific third-party service providers (operators) we currently use or may use to process personal information on our behalf:

Service Provider	Purpose	Data Shared	Location
Google Analytics	Website traffic analysis and user behavior tracking	Anonymized usage data, IP addresses	United States (GDPR Standard Contractual Clauses apply)
Mailchimp (Intuit)	Email newsletter management and delivery	Name, email address, subscription preferences	United States (GDPR Standard Contractual Clauses apply)
Google Workspace	Internal team communication and document management	Team communications only	United States (GDPR Standard Contractual Clauses apply)
Meta (Facebook/Instagram)	Social media management and advertising	Aggregated audience insights (anonymized)	United States (GDPR Standard Contractual Clauses apply)
TikTok	Social media content and audience engagement	Aggregated audience insights (anonymized)	United States/Singapore
WhatsApp (Meta)	Direct communication with users	Messages you send to us	United States
Cloudflare	Website security, performance, and DDoS protection	IP addresses, technical request data	United States
WordPress / Hosting Provider	Website hosting and content management	Website data and user-submitted form data	South Africa / International

We review our list of processors regularly. If we introduce a new processor that involves material changes to how your data is handled, we will update this section and notify users accordingly.

All third-party processors are bound by data processing agreements that require them to:

Process data only on our documented instructions
Implement appropriate technical and organizational security measures
Not engage sub-processors without our prior written consent
Delete or return all personal data upon termination of the service relationship

13. Payment Data and Financial Information

EduMzansi may offer both free and paid educational resources, courses, workshops, and learning programmes. Where payment is required, payments are processed securely through third-party payment providers such as PayPal, WooCommerce-supported payment gateways, and/or other providers made available on the Platform from time to time.

EduMzansi does not directly store full credit card numbers, CVV codes, bank card details, or banking login credentials.

13.1 We Do Not Store Payment Card Data

EduMzansi will never directly store, process, or transmit:

Full credit or debit card numbers
Card Verification Value (CVV) codes
Card expiry dates
Bank account numbers or banking credentials

All payment processing will be handled exclusively by PCI-DSS (Payment Card Industry Data Security Standard) compliant third-party payment providers. PCI-DSS is the international security standard that governs how payment card data must be handled.

13.2 Payment Processor

Any future payment processing will be handled by a reputable, PCI-DSS certified payment provider. The specific provider will be named in this section and at the point of any transaction before you are asked to enter payment details.

13.3 Financial Record Retention

Any financial transaction records (receipts, invoices, proof of payment) will be retained for a minimum of 5 years in compliance with the South African Income Tax Act and Tax Administration Act requirements set by the South African Revenue Service (SARS).

13.4 Your Financial Safety

If you are ever on a page that asks for payment details and the URL does not begin with https:// or you do not see a padlock icon in your browser, please do not proceed and contact us immediately at info@edumzansi.org.

14. Cookies and Tracking Technologies

Cookies are small text files that websites place on your device. They are widely used across the internet to make websites work properly and to give site owners insights into how their platforms are being used.

14.1 Cookie Consent Banner

When you first visit edumzansi.org, a cookie consent banner will appear at the bottom of your screen. This banner:

Explains that we use cookies
Allows you to accept all cookies, reject non-essential cookies, or manage your preferences individually
Records your choice and stores it as a cookie preference setting so you are not asked again on subsequent visits (unless you clear your browser data)

Your consent choices are stored and can be changed at any time by visiting our Cookie Preference Centre linked in the footer of every page on our website.

14.2 Essential Cookies

These cookies are strictly necessary for the website to function. Without them, basic features like page navigation and form submissions would not work. Because they are essential, they do not require your consent under POPIA or GDPR.

Examples:

Session cookies that maintain your browsing session
Security cookies that protect against cross-site request forgery (CSRF)
Load balancing cookies that ensure the site performs reliably

14.3 Performance and Analytics Cookies

These cookies collect information about how visitors use our website , which pages are most popular, where users come from, and whether they encounter any errors. All information collected is aggregated and anonymous.

Provider: Google Analytics
Purpose: Understanding user behavior to improve content and site structure
Consent Required: Yes , these are only placed after you accept analytics cookies

14.4 Functionality Cookies

These cookies allow our website to remember your preferences and provide enhanced features. For example, remembering your preferred grade level so you see relevant content immediately on your next visit.

Consent Required: Yes

14.5 Targeting and Marketing Cookies

If we run advertising campaigns on platforms like Facebook or Google to reach more students, these platforms may place cookies on your device to help show our ads to relevant audiences and to measure the effectiveness of our campaigns.

Consent Required: Yes , these are only placed after you explicitly accept marketing cookies

14.6 How to Control Cookies

You have full control over cookies. You can:

Accept all cookies for the best browsing experience
Reject non-essential cookies if you prefer more privacy
Manage individual cookie preferences through our Cookie Preference Centre
Delete existing cookies already stored on your device through your browser’s settings menu
Configure your browser to block all cookies by default

Please note that restricting essential cookies will significantly impact your ability to use our website. Non-essential cookies can be disabled without affecting core functionality.

For more information about cookies and how to manage them across different browsers, visit www.aboutcookies.org.

15. Young People and Children's Privacy

EduMzansi serves learners and students, including users under 18.

We take children’s privacy seriously and aim to collect only information needed to provide educational resources, learning support and course services.

15.1 Our Commitment to Young Learners

We are committed to creating a safe digital environment for young people. We do not design our platform to collect more data from young users than is necessary. We do not target young people with advertising unrelated to education. We do not create commercial profiles of young users.

15.2 Age Threshold

For purposes of this policy, a child is any person under the age of 18.

If you are under 18, you should use EduMzansi with the knowledge and permission of a parent or legal guardian.

15.3 Consent for Users Under 18

Where required by law, EduMzansi may require parent or guardian consent before collecting or processing personal information for:

Account registration
Paid course enrolment
Live class participation
Certificates
Marketing communications
Other services requiring personal information

15.4 Guidance for Parents and Guardians

Parents and guardians are encouraged to be involved in how young learners use EduMzansi.

They may contact privacy@edumzansi.org to request access to, correction of, or deletion of a child’s personal information, subject to legal and operational requirements.

15.5 If Data Was Collected Without Required Consent

If we discover that personal information from a child was collected without required consent, we will take reasonable steps to restrict, delete or obtain appropriate consent for that information unless we are legally required or entitled to retain it.

16. Your Rights Under POPIA

South African law is clear: your personal information belongs to you. POPIA gives you a set of powerful rights over how your data is used. Here is what you are entitled to and exactly how to exercise each right:

16.1 Right to Be Informed

You have the right to know when your personal information is being collected, what it will be used for, and who it will be shared with. This Privacy Policy and our Section 18 notice (Section 4 of this document) are our primary ways of fulfilling that right.

16.2 Right to Access

You have the right to request a copy of all personal information we hold about you. We will provide this within 21 business days of receiving your verified request. You may be asked to verify your identity before we release this information.

16.3 Right to Correction

If any information we hold about you is incorrect, incomplete, or outdated, you have the right to request that we correct it. We will update your records within 21 business days.

16.4 Right to Deletion (Right to Be Forgotten)

You have the right to request that we delete your personal information. We will honor this request within 21 business days, except in cases where we are legally required to retain the data or where retention is necessary for a legitimate, lawful purpose. We will inform you of the specific reason if we are unable to fulfill a deletion request.

16.5 Right to Object to Processing

You have the right to object to us processing your personal information , particularly for direct marketing purposes. If you object to marketing, we will immediately stop sending you promotional communications.

16.6 Right to Restrict Processing

In certain circumstances , for example, while a dispute about the accuracy of your data is being resolved , you can ask us to restrict how we use your information while the issue is being investigated.

16.7 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format (such as CSV or JSON) so that you can transfer it to another service provider if you choose.

16.8 Right to Withdraw Consent

Where our processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing we carried out before the withdrawal. Withdrawing consent is always as easy as giving it.

16.9 Right to Lodge a Complaint

If you believe your privacy rights have been violated, you have the right to lodge a complaint with the Information Regulator of South Africa (see Section 25 for full contact details).

How to Exercise Your Rights

To exercise any of the rights listed above, please contact our Information Officer:

Email: privacy@edumzansi.org
Physical Address : 51 Willow Avenue, Craigavon, Sandton Johannesburg

Please include:

Your full name
The email address associated with your EduMzansi subscription or account
A clear description of the right you wish to exercise
Any relevant details that will help us locate your information

We will acknowledge your request within 5 business days and resolve it within 21 business days. If we need additional time due to the complexity of your request, we will inform you and provide a revised timeline.

17. Data Subject Access Request Fees

EduMzansi is committed to making it easy for you to access and control your personal information.

We currently do not charge any fee for data subject access requests, correction requests, or deletion requests submitted by individual users.

This is a deliberate policy decision. Our users are predominantly students, many of whom are from low-income households. Charging for access requests would create a financial barrier to exercising fundamental privacy rights, which goes against everything EduMzansi stands for.

We reserve the right to introduce a reasonable administrative fee in the future for requests that are manifestly unfounded, repetitive, or excessive in nature. If we ever introduce such a fee structure:

We will update this policy with at least 30 days’ advance notice
We will clearly explain the fee and the circumstances in which it applies
We will always provide at least one free access request per calendar year per user

18. Cross-Border Data Transfers

EduMzansi is a South African platform built to serve South African students. Our primary operations are based in South Africa and we prefer to keep data within South African borders where possible.

However, some of the third-party service providers we use , including Google Analytics, Mailchimp, and Cloudflare , may process data on servers located outside of South Africa, primarily in the United States and the European Union.

This is common across virtually all modern websites and digital platforms. However, under POPIA, we are required to ensure that any cross-border transfer of personal information meets an adequate standard of protection.

Where such international transfers occur, we ensure that:

The receiving country or organization provides an adequate level of data protection comparable to POPIA
We have appropriate legal safeguards in place — such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or the recipient’s certification under a recognized data protection framework
We only transfer the minimum necessary data to fulfil the specific purpose
Our data processing agreements with all international operators include clauses that mirror the protections guaranteed under POPIA

If you would like more information about the specific safeguards applicable to any particular cross-border transfer, please contact our Information Officer at privacy@edumzansi.org.

19. Links to Other Websites

EduMzansi regularly links to external websites as part of our educational mission. These may include:

University websites (University of Pretoria, University of Johannesburg, Wits, UCT, UNISA, and others)
Government portals (Department of Basic Education, Department of Higher Education and Training, NSFAS)
Bursary provider websites (Funza Lushaka, Eskom Development Foundation, and others)
Career information platforms
Professional association websites

When you click on these links, you leave edumzansi.org and enter a completely separate website. This Privacy Policy does not apply to those external websites. They have their own privacy policies and their own data practices, which may be very different from ours.

We encourage you to:

Be aware when you are leaving our site , your browser’s address bar will show a new URL
Read the privacy policy of any external site you visit before sharing personal information
Be cautious about what personal information you share on external platforms, even reputable ones

While we do our best to only link to reputable and trustworthy external sites, we cannot control and are not responsible for the content or privacy practices of any website we do not own and operate.

20. Social Media and Third-Party Platforms

EduMzansi is active on Facebook, TikTok, Instagram, and WhatsApp. Many of our users first discover us through these platforms, and we use them actively to reach and support students.

20.1 Social Media Platforms Have Their Own Rules

When you interact with our content on any social media platform, the data generated by that interaction , likes, shares, comments, direct messages , is governed by that platform’s own privacy policy, not ours.

We encourage you to review the privacy settings and policies of any social media platform you use. Links to relevant privacy policies:

Facebook/Instagram (Meta): facebook.com/policy
TikTok: tiktok.com/legal/privacy-policy
WhatsApp (Meta): whatsapp.com/legal/privacy-policy

20.2 Social Media Insights and Analytics

Social media platforms provide us with aggregate analytics about our audience and content performance , for example, how many people saw a particular post, what age group engaged with it most, or which province our followers are primarily from. This data is anonymized and aggregated. We use it solely to make better content decisions.

20.3 Social Media Advertising

If we run paid advertising campaigns on social media platforms to reach more students, these platforms may use their own data (including data from their cookies and tracking pixels) to show our ads to relevant audiences. This process is governed by each platform’s advertising policies. You can manage your ad preferences directly within each platform’s settings.

20.4 WhatsApp Communications

If you contact us or join an EduMzansi WhatsApp broadcast list or group, please be aware that WhatsApp is governed by Meta’s privacy policy. We use WhatsApp exclusively to share educational information and updates. We do not share your WhatsApp contact information with third parties, and we will never add you to a WhatsApp list without your express permission.

21. Marketing, Communications and ECTA Section 45

21.1 What We Send and Why

If you subscribe to our newsletter or sign up to receive updates, we may send you:

Educational content – study tips, exam advice, subject resources
Important deadline reminders – university application dates, NSFAS deadlines, bursary closing dates
New resource alerts – when we add new past papers, study guides, or career guides
EduMzansi news – updates about our platform, new features, and partnerships

21.2 Your Consent and ECTA Section 45

In compliance with Section 45 of the Electronic Communications and Transactions Act, 25 of 2002 (ECTA), EduMzansi will only send unsolicited commercial electronic communications (including newsletters and promotional emails) to persons who have:

Explicitly opted in to receive such communications, or
Given us their contact details in the context of a prior transaction or interaction, and to whom we send communications related to similar content, products, or services

Every marketing communication we send will:

Clearly identify EduMzansi as the sender
Include a clear and functional opt-out or unsubscribe mechanism
Provide our physical address and contact details
Not use false or misleading subject lines

Sending unsolicited commercial communications without consent is prohibited under ECTA Section 45 and we take this obligation seriously.

21.3 Opting Out is Easy

You can unsubscribe from our communications at any time by:

Clicking the “Unsubscribe” link at the bottom of any email we send you
Contacting us directly at info@edumzansi.org and requesting removal

Once you unsubscribe, we will remove you from our active mailing list within 5 business days. We will retain a record of your opt-out preference for 3 years to demonstrate compliance with ECTA Section 45, but this record will not be used to contact you.

You may still receive essential transactional communications , such as a response to an inquiry you sent us , even after unsubscribing from marketing emails.

21.4 We Do Not Purchase Contact Lists

We do not buy, rent, or borrow mailing lists from third parties. Every person on our mailing list chose to be there. We consider unsolicited bulk email to be both unethical and illegal under South African law.

22. Artificial Intelligence and Future Technology

22.1 Our Commitment to Responsible Technology

EduMzansi is committed to using technology – including emerging technologies like Artificial intelligence , in a way that genuinely benefits students and does not compromise their rights or dignity.

22.2 Current AI Usage

At the time of publishing this policy, EduMzansi does not use AI systems that make decisions about individual users or that process personal data in automated ways beyond standard analytics.

22.3 Future AI Integrations

As EduMzansi grows and potentially forms partnerships with enterprise technology providers, we may introduce AI-powered features such as:

Personalized study recommendations – suggesting the most relevant past papers or study guides based on your grade and subject choices
Career pathway tools – matching your academic profile and interests to potential career paths
Smart content search – helping you find exactly the resource you need more quickly
Adaptive learning features – adjusting content difficulty or format based on your interaction patterns

22.4 Our Commitment Before Any AI Feature Launches

Before introducing any AI-powered feature that involves processing personal data, EduMzansi commits to:

Updating this Privacy Policy with a full description of the AI system and how it uses personal data – with at least 30 days’ advance notice
Seeking fresh consent where the new processing activity is materially different from what you originally consented to
Conducting a Data Protection Impact Assessment (DPIA) to identify and mitigate privacy risks before launch
Ensuring explainability – any AI-powered feature will be designed so that its recommendations can be explained in plain language
Providing opt-out options – you will never be forced to use an AI-powered feature if you prefer not to

22.5 Ethical AI Principles

EduMzansi is committed to the following principles in any use of AI:

Fairness: AI systems will not discriminate on the basis of race, gender, province, school type, or any other protected characteristic
Transparency: We will always disclose when AI is involved in generating content or recommendations
Human oversight: A human team member will always be available to review any AI-generated output that affects a user
Privacy by design: AI features will be built with data minimization and privacy protection from the ground up

23. Automated Decision-Making

Automated decision-making refers to situations where a computer system makes a decision about you , with legal or similarly significant effects , without any human involvement.

EduMzansi currently does not use automated decision-making processes that have significant legal or similarly significant effects on our users.

The closest we come to automated processes is:

Analytics that identify which content is most popular (this affects our content strategy, not individual users)
Email segmentation that determines which newsletter content you receive based on your stated preferences (you control this by updating your preferences)

Your Rights Regarding Automated Decisions

Under POPIA and aligned with GDPR Article 22, you have the right to:

Request human review of any decision made about you by an automated system
Express your point of view regarding an automated decision
Contest automated decisions that you believe are inaccurate or unfair

If EduMzansi ever introduces automated decision-making with significant effects on users, we will update this policy, seek appropriate consent, and implement the safeguards required by law before doing so.

24. Changes to This Policy

The world of data protection is constantly evolving. New laws are enacted, technology changes, and EduMzansi itself grows and evolves. We will update this Privacy Policy from time to time to reflect these changes.

What Triggers an Update?

Changes to South African data protection law (POPIA) or related regulations such as ECTA
New technology features or AI integrations introduced to our platform
New partnerships or processors that affect how data is processed
Feedback from users, legal advisors, or compliance auditors
Changes in how our third-party service providers operate

How We Will Notify You

When we make significant changes to this policy , changes that materially affect your rights or how we use your data , we will:

Post a prominent notice on our website homepage for at least 30 days
Send an email notification to all active subscribers explaining the key changes in plain language
Update the version history table at the top of this document
Update the “Last Updated” date

For minor changes (such as correcting a typographical error or clarifying existing language without changing its meaning), we will update the document and the date without a separate notification.

Your Responsibility

We encourage you to review this Privacy Policy at least once every six months to stay informed about how we are protecting your information. Your continued use of edumzansi.org after we post changes constitutes your acceptance of the updated policy.

If you do not agree with any changes we make, you have the right to request deletion of your data and cease using our platform. We will process any such request in accordance with Section 16.4.

25. How to Lodge a Complaint

We genuinely hope you never feel the need to make a formal complaint about how EduMzansi has handled your personal information. But if you do, here is exactly what to do:

Step 1: Contact Us First

Please give us the opportunity to resolve your concern before escalating it. Contact our Information Officer directly:

EduMzansi Information Officer: Oziel Mandlakayise Mhambi
Email Address: privacy@edumzansi.org
Physical Address : 51 Willow Avenue,Craigavon, Sandton Johannesburg

Please describe your concern clearly and we will:

Acknowledge your complaint within 5 business days
Provide a full written response within 21 business days
Where we uphold your complaint, take immediate corrective action

Step 2: If You Are Not Satisfied With Our Response

If you have contacted us and are not satisfied with our response, or if you believe we have failed to address your concern adequately, you have the right to escalate your complaint to the Information Regulator of South Africa:

Website: www.inforegulator.org.za
General Enquiries: enquiries@inforegulator.org.za
Complaints: complaints.IR@justice.gov.za
Phone: 012 406 4818
Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

The Information Regulator is an independent body established under POPIA with the authority to investigate complaints, issue enforcement notices, and take regulatory action where data protection laws have been violated.

26. Contact Us

EduMzansi – Information Officer
Name: Oziel Mandlakayise Mhambi
Privacy Inquiries: privacy@edumzansi.org
General Inquiries: info@edumzansi.org
Website: edumzansi.org
Physical Address: 51 Willow Avenue, Craigavon, Sandton, Johannesburg, Gauteng, South Africa

Office Hours: Monday to Friday, 08:00 to 17:00 (South African Standard Time, UTC+2)

We aim to respond to all privacy-related inquiries within 5 business days.

A Final Word From EduMzansi

We know that privacy policies are not exactly the most exciting reading material. But we believe that being transparent with you about how we handle your data is a fundamental part of respecting you as a person – not just as a user of our platform.

You trust us with your educational journey. Some of you are using our platform during some of the most important and stressful years of your life , preparing for matric, applying to universities, searching for bursaries that could change your family’s story forever.

We do not take that trust lightly. Not even a little.

EduMzansi was built on the belief that access to education and opportunity should not depend on your postcode or your parents’ income. Protecting your privacy is a natural extension of that belief. You deserve both the education and the dignity.

Thank you for being part of the EduMzansi community.

EduMzansi - Empowering Every South African Student, One Step at a Time.

(+27) 11 808 0000

info@edumzansi.ac.za

Portal

Enquire Now

Apply Now