This policy explains how Core Knowledge Training and Consultancy (Pty) Ltd ("we") processes personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). We are the "responsible party" for the information we collect on this website and in our online classroom. For learners in Botswana, see also our Data Protection Policy.
1. Who is responsible
- 1.1Responsible party: Core Knowledge Training and Consultancy (Pty) Ltd, 17 First Avenue, Walkerville 1961, South Africa. Email: coreknowledgedigital@gmail.com.
- 1.2Information Officer: George Mureithi, at coreknowledgedigital@gmail.com.
2. What information we collect
- 2.1Enrolment details: your first name, last name, email address, the course you choose and, for some CPD courses, an access code.
- 2.2Classroom (Moodle) activity: the course items you open, time and date of activity, progress, completion status, forum or feedback posts you make, and certificates issued.
- 2.3Quiz and mock exam results: your answers, scores, attempts and time taken.
- 2.4Sign-in records: where you use email sign-in links or QR sign-in (currently a pilot), we log the request, the time, the device and browser type, and the IP address, to protect your account.
- 2.5Enquiries: what you tell us when you contact us.
- 2.6Website usage: pages visited and technical data collected by analytics (see the Cookie Policy).
- 2.7Payment information: once billing opens, payments are processed by a payment provider. We receive confirmation of payment but not your full card details.
- 2.8We do not knowingly collect information from children without the consent described in Minimum age and minors.
3. Why we use it and our lawful basis
- 3.1To create your account and give you the course you chose. Basis: needed to perform our contract with you.
- 3.2To measure your progress, mark your assessments, issue certificates and give you support. Basis: contract and our legitimate interest in delivering a good service.
- 3.3To keep accounts secure and prevent sharing or fraud. Basis: our legitimate interests and yours.
- 3.4To keep records and meet tax, accounting and consumer-law duties. Basis: legal obligation.
- 3.5To improve our courses using combined, de-identified statistics. Basis: legitimate interest.
- 3.6To send you service messages (login details, access reminders). We send marketing only if you have agreed, and you can unsubscribe at any time. Basis: consent.
4. Who we share it with
- 4.1We do not sell your personal information.
- 4.2We use trusted operators who process information for us under written terms: Contabo (data centre hosting, Germany) for our website and classroom; Google (email and analytics services); and, once billing opens, a payment provider.
- 4.3We may disclose information where the law requires, or to protect our rights.
5. Sending information outside South Africa
- 5.1Our servers are in Germany and Google services may process data in several countries. Under section 72 of POPIA we transfer your information outside South Africa only to operators bound by agreements or laws that give substantially similar protection, or where you have consented or the transfer is needed for your contract. By enrolling you acknowledge this transfer.
6. How long we keep it
- 6.1We keep information only as long as needed. The periods are listed in our Data Retention Schedule. After the period we delete or de-identify the information, except where the law requires us to keep it.
7. How we protect it
- 7.1We use encrypted connections, access controls, automated blocking of repeated failed logins, and regular security checks and updates (see Information Security). Staff and contractors with access are bound by confidentiality.
- 7.2If a security compromise could harm you, we will notify you and the Information Regulator as set out in our Data Breach Response procedure.
8. Your rights
- 8.1You may ask us to confirm whether we hold information about you, to give you a copy, to correct it, or to delete or de-identify it where we no longer need it. You may object to processing based on legitimate interest and withdraw consent at any time (this does not affect earlier processing).
- 8.2To use a right, email coreknowledgedigital@gmail.com. We may need to confirm your identity first. We respond within 30 days.
9. Complaints to the regulator
- 9.1If you are unhappy with how we handle your information, please tell us first. You may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001; email complaints.IR@justice.gov.za; website inforegulator.org.za.
10. Changes
- 10.1We will publish any change here with a new version and date. Material changes will also be emailed to enrolled learners where practical.