POPIA Collection Notice

What this notice is

When you sign an attendance register in this system, your training provider collects personal information about you. POPIA requires that you be told, at the time of collection, what is collected and why. This is that notice; a short version is also shown to you on the screen where you sign.

Your training provider is the responsible party. Its name and Information Officer contact are shown on the on-screen notice for the specific register you are signing. Zandtbox operates the system on the training provider's behalf.

What is collected

• Your full name
• Your South African ID number (or passport / student number where used to identify you)
• Your handwritten digital signature
• The date, time and session/register your signature was captured against
• For workplace placements: your daily workplace attendance and monthly report feedback

Why it is collected

• To create and maintain accurate attendance registers for your training programme
• To confirm your identity and that you attended a session, class or workplace day
• To meet the training provider's legal, accreditation and quality-assurance obligations (for example SETA, QCTO or DHET requirements)
• To report attendance and progress to funders, sponsors, SETAs and, for placements, to your workplace host
• To produce audit-ready, tamper-evident records that can be verified later

The legal basis

Your information is processed on the basis of:

• Your consent, which you give when you sign;
• The training provider's need to comply with the law and its accreditation conditions (including the Skills Development Act and SETA/QCTO requirements); and
• The legitimate interests of the training provider and its funders in maintaining accurate, verifiable training records.

Is it voluntary?

Providing your name, identifying number and signature is generally required in order to be recorded on the official attendance register for your programme. You are not obliged to provide it, but if you do not, your attendance cannot be evidenced, which may affect your enrolment, funding or certification.

Who it may be shared with

• Authorised staff of your training provider
• SETAs, the QCTO, DHET and other accreditation, funding or quality-assurance bodies, where required
• Funders or sponsors of your programme
• For workplace placements: your workplace host / employer and assigned mentor
• Zandtbox, as the operator that securely hosts the system on the training provider's behalf
• Auditors or regulators where the law requires disclosure

How long it is kept

Your information is kept only for as long as the law and the training provider's accreditation require — typically for several years after the programme ends (commonly 3 to 5 years) — after which it is securely deleted. The exact period is set by your training provider.

How it is protected

ID numbers are encrypted while stored, signatures are held in restricted private storage, and access is limited to authorised users. The system records an audit trail of who accessed sensitive information.

Your rights

You have the right to:

• Ask what personal information is held about you and request a copy
• Ask for information that is inaccurate or out of date to be corrected
• Ask for your information to be deleted where there is no legal reason to keep it
• Object to certain processing, or withdraw your consent (this does not undo processing already done, and may affect your programme records)
• Complain to the training provider's Information Officer, and to the Information Regulator

Complaints

Raise concerns with your training provider's Information Officer first. You may also complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za · https://inforegulator.org.za.