Training Academy Privacy Policy

This Privacy Policy explains how SAFCON Group (Pty) Ltd processes personal information in connection with the SAFCON Training Academy, including Academy purchases, learner registration, e-learning access, assessments, certificates and support.

1. Personal information we may collect

• Name and surname.
• Contact details.
• Company or employer information.
• Billing and order information.
• Learner number, employee number or other course-administration information.
• Identification information where legitimately required for a particular training or certification purpose.
• Learner account and access information.
• Course enrolment, progress, assessment results and completion records.
• Certificates and certificate information.
• Communications and support requests.
• Payment-status information supplied by the payment provider.
• Website, security and technical information reasonably required to operate and protect the Academy.

2. Why we process personal information

SAFCON may process personal information to process Academy orders and payments; create and administer learner accounts; enrol learners; deliver training and support; administer assessments and completion; issue and verify certificates; maintain legitimate training and business records; issue quotations, invoices and order communications; respond to enquiries and complaints; protect systems; comply with legal or recordkeeping duties; and send marketing communications where lawful and permitted.

3. Sources of information

Information may be supplied directly by the learner, purchaser or employer, through the Academy website or e-learning platform, or through authorised payment and business-service providers. Where an employer or purchaser supplies learner information, that party is responsible for having an appropriate basis to provide it for the training purpose.

4. Lawful and responsible processing

SAFCON processes personal information in accordance with applicable South African data-protection requirements, including the Protection of Personal Information Act 4 of 2013 (POPIA), for defined and legitimate purposes.

5. Payment information

Online payments are handled through the payment gateway available at checkout. SAFCON does not require customers to send full payment-card credentials by ordinary email. SAFCON generally receives information required to identify and reconcile the payment rather than full card-security credentials.

6. Sharing of information

SAFCON may share personal information with service providers or operators where reasonably required to provide the Academy service, including website and hosting providers, e-learning platform providers or administrators, email and communications providers, payment providers, accounting or administrative service providers, and accreditation, certification, regulatory or professional bodies where applicable and lawfully required.

SAFCON does not sell learner personal information to advertisers. Information may also be disclosed where required or permitted by law, legal process or a competent authority.

7. Information security

SAFCON takes reasonable technical and organisational measures appropriate to the information and service to protect personal information against loss, unauthorised access, misuse, alteration or unlawful disclosure. Learners must protect their own login credentials and notify SAFCON if they reasonably suspect unauthorised use of an Academy account.

8. Retention

Personal information is retained for as long as reasonably necessary for the purpose for which it was collected, including training administration, certificate verification, legal or financial recordkeeping, dispute management and other legitimate business requirements. When information is no longer reasonably required, it will be deleted, de-identified or otherwise dealt with in accordance with applicable requirements and practical system constraints.

9. Learner records and certificates

Training and completion records may need to be retained after course completion so SAFCON can respond to legitimate certificate-verification requests, maintain an audit trail and satisfy applicable recordkeeping requirements. Verification should be limited to information reasonably relevant to confirming authenticity or status.

10. Cookies and website technologies

The Academy website may use cookies and similar technologies required for account sessions, cart and checkout operation, security, preferences and site performance. Where consent is legally required for non-essential technologies, applicable cookie controls should be used.

11. Direct marketing

SAFCON may send marketing communications where permitted by applicable law. Recipients can use the unsubscribe or opt-out method provided in the communication where applicable. Transactional messages such as order confirmations, access instructions and essential learner communications are not optional marketing merely because they are sent electronically.

12. Access, correction and other rights

Subject to POPIA and other applicable law, a person may request access to personal information held about them, request correction of inaccurate information, object to certain processing, request deletion where legally applicable, or exercise another right provided by law. Some records may need to be retained despite a deletion request where SAFCON has a legal obligation or another lawful basis to retain them.

13. Children and learner information

Where training is lawfully provided to a minor, SAFCON will handle the learner’s information with appropriate care and will obtain or rely on the required authorisation or legal basis where applicable.

14. Cross-border or external service providers

Some technology providers may process or store information outside South Africa. Where cross-border processing occurs, SAFCON will use providers and arrangements intended to provide appropriate protection in accordance with applicable data-protection requirements.

15. Security incidents

Where SAFCON has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, SAFCON will investigate and take the steps required by applicable law, including notification where legally required.

16. Contact and privacy requests

Privacy queries or requests should be sent using SAFCON’s published corporate contact details. The requester should provide enough information for SAFCON to identify the relevant record and verify the request appropriately.

17. Policy changes

This Privacy Policy may be updated when SAFCON’s systems, services or legal obligations change. The current version will be published on the applicable SAFCON website.