POPIA & Privacy Policy

1. Scope and responsible party

This policy applies to website visitors, prospective learners, enrolled learners, parents or guardians where relevant, staff applicants, employers, sponsors, partners and other individuals whose personal information we process.

For processing activities we determine, Genius Business College acts as the responsible party under South Africa's Protection of Personal Information Act, 4 of 2013 (POPIA). Some systems and service providers may process information on our behalf as operators.

2. Information we collect

Depending on your relationship with us and the programme involved, information may include:

• Names, title, identity or passport number, date of birth, nationality and contact details.
• Residential address, emergency-contact information and preferred communication methods.
• Previous qualifications, entry requirements, programme choices, applications and uploaded identity or qualification documents.
• Enrolment records, attendance, learning activity, assessments, marks, portfolio evidence, workplace or logbook records, feedback and certification information.
• Invoices, payments, funding or sponsorship details and relevant financial records.
• Technical information such as device, IP address, browser and security or system-usage logs.
• Other information reasonably necessary to provide services or meet lawful education and reporting requirements.

3. How we collect information

We receive information directly when you fill in forms, apply, enrol, upload documents, contact us or use a learner portal. We may also receive it from employers, sponsors, authorised representatives, education and assessment bodies, or service providers when lawful and relevant to your programme.

4. Why we process information

• Respond to enquiries and assess applications, entry requirements and eligibility.
• Manage admissions, enrolments, training, learning support, assessments, attendance and learner progress.
• Issue or facilitate statements of results, certificates and regulatory submissions where applicable.
• Administer invoicing, payments, financial assistance, employer-funded training and contractual obligations.
• Communicate course information, notices, deadlines, support updates and service messages.
• Maintain information security, prevent fraud, investigate incidents and improve our website and learning systems.
• Comply with applicable legal, regulatory, accreditation, record-keeping and quality-assurance requirements.

5. Lawful grounds for processing

We process personal information where permitted by POPIA, including where necessary to conclude or perform an agreement with you, comply with a legal obligation, protect a legitimate interest, or where you have given valid consent. Using the website alone does not mean you consent to every possible processing activity. We will request specific consent when it is required.

6. Sensitive information and children

Some learner processes may require special personal information, such as health, disability or demographic information, or information relating to children. Such information is processed only where a lawful basis or applicable authorisation exists and with appropriate safeguards. Where necessary, we obtain consent or authorisation from a competent person, such as a parent or legal guardian.

7. Information sharing

We do not sell or rent personal information. Where appropriate and lawful, relevant information may be shared with:

• QCTO, SETAs, authorised assessment and quality-assurance bodies, certification bodies or other regulatory organisations.
• Approved facilitators, assessors, moderators, training providers and workplace supervisors involved in your programme.
• Employers, sponsors or funders where an agreement or another lawful basis permits disclosure.
• Providers that host or maintain our website, LMIS/LMS, communications, payment or document-management services.
• Public authorities or other recipients where disclosure is required or authorised by law.

We limit shared information to what is relevant to the purpose and expect service providers to apply suitable confidentiality and security safeguards.

8. LMIS, LMS and website technology

Applications and learning services may use EduTrack LMIS or related systems. These systems may hold enrolment forms, identity documents, course selections, assessments, progress and communications. Access is intended to be limited according to authorised user roles and operational requirements.

Submitting information through our website may result in it being transferred securely to the systems used to process admissions, enquiries and learner records. We take reasonable steps to protect transmission and stored data, but no online system can be guaranteed completely risk-free.

9. Security safeguards

We use reasonable technical and organisational safeguards appropriate to the information and risks involved, which may include access controls, staff confidentiality, authentication, monitoring, backups and system maintenance. Individuals should safeguard their passwords and report suspicious account activity promptly.

10. Retention and deletion

We retain personal information only for as long as necessary for the purposes described in this policy, or as required or permitted by applicable laws, contracts, education records and regulatory obligations. When information is no longer needed and no retention obligation applies, we take appropriate steps to delete, destroy or de-identify it. Some academic and certification records must be retained even after a learner completes or leaves a programme.

11. Your privacy rights

Subject to POPIA and applicable exceptions, you may:

• Ask whether we hold personal information about you and request access to it.
• Request correction, updating or deletion of information that is inaccurate, excessive, unlawfully obtained or no longer lawfully required.
• Object to certain processing activities, where the law permits.
• Withdraw consent where processing is based on consent, without affecting prior lawful processing.
• Opt out of unsolicited direct marketing.
• Lodge a complaint with South Africa's Information Regulator.

These rights are not absolute; for example, a lawful retention or reporting obligation may prevent immediate deletion.

12. How to make a privacy request

Send your request to admin@geniusbusinesscollege.com, describing the information or processing activity concerned. We may request sufficient information to verify your identity and protect your records before responding. Requests are managed within applicable legal requirements.

You may also contact the Information Regulator (South Africa) about your rights or to submit a complaint.

13. International transfers

Some service providers or hosting arrangements may involve processing or storage outside South Africa. Where applicable, we take steps to ensure a permitted basis and appropriate protections under POPIA for such transfers.

14. Cookies and external websites

Our website may use essential cookies or similar technologies to support navigation, security and functionality, and may use additional analytics or marketing technologies where configured and permitted. Browser settings may allow you to control or block some cookies, although this could affect site functionality.

Links to external websites, including social media and third-party learning platforms, are subject to those providers' own privacy practices.

15. Marketing communications

We may provide course updates or promotional communications only where a lawful basis applies. Where electronic direct marketing requires consent or another statutory condition, we will follow that requirement and provide an appropriate way to opt out.

16. Security incidents

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will investigate and take steps required by POPIA, including notifying the Information Regulator and affected data subjects where applicable.

17. Changes to this policy

We may update this policy as our services, technologies and legal obligations change. The current version will be published on our website. Where required, we will communicate material changes or obtain fresh consent for processing that requires it.

For privacy questions, contact admin@geniusbusinesscollege.com.