Privacy Policy

1. About this policy

This policy explains how personal information is processed in Zandtbox Digital Registers ("the platform"), operated by Zandtbox (Pty) Ltd ("Zandtbox", "we", "us"). It is written to align with the Protection of Personal Information Act, 2013 (POPIA).

It applies to everyone whose information is processed through the platform, including administrators and facilitators who log in, and learners who sign attendance registers.

2. Who is responsible for your information

Each training provider (the organisation that runs your programme) is the responsible party for its learners' personal information. It decides what information is collected and why.

Zandtbox is the operator. We host and secure the platform and process personal information only on the training provider's documented instruction — we do not use learner information for our own purposes.

If you are a learner and want to exercise your rights over your information, contact your training provider's Information Officer in the first instance. Their details appear on the notice shown to you when you sign, and are available from your training provider.

3. Information we process

• Your full name
• Your South African ID number (or passport / student number where used to identify you)
• Your handwritten digital signature
• The date, time and session/register your signature was captured against
• For workplace placements: your daily workplace attendance and monthly report feedback
• Account details of administrators and facilitators (name, email, mobile number, job title) and their own signatures

4. Why it is processed

• To create and maintain accurate attendance registers for your training programme
• To confirm your identity and that you attended a session, class or workplace day
• To meet the training provider's legal, accreditation and quality-assurance obligations (for example SETA, QCTO or DHET requirements)
• To report attendance and progress to funders, sponsors, SETAs and, for placements, to your workplace host
• To produce audit-ready, tamper-evident records that can be verified later

5. Who it may be shared with

• Authorised staff of your training provider
• SETAs, the QCTO, DHET and other accreditation, funding or quality-assurance bodies, where required
• Funders or sponsors of your programme
• For workplace placements: your workplace host / employer and assigned mentor
• Zandtbox, as the operator that securely hosts the system on the training provider's behalf
• Auditors or regulators where the law requires disclosure

6. How it is protected

ID numbers are encrypted while stored, signatures are held in restricted private storage, and access is limited to authorised users. The system records an audit trail of who accessed sensitive information.

The platform is served over encrypted connections (HTTPS) and applies a strict content-security policy and other hardening measures.

7. How long it is kept

Your information is kept only for as long as the law and the training provider's accreditation require — typically for several years after the programme ends (commonly 3 to 5 years) — after which it is securely deleted. The exact period is set by your training provider.

8. Your rights

Subject to POPIA, you have the right to:

• Ask what personal information is held about you and request a copy
• Ask for information that is inaccurate or out of date to be corrected
• Ask for your information to be deleted where there is no legal reason to keep it
• Object to certain processing, or withdraw your consent (this does not undo processing already done, and may affect your programme records)
• Complain to the training provider's Information Officer, and to the Information Regulator

9. Complaints to the Regulator

You may complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za · https://inforegulator.org.za · JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

10. Cookies

The platform uses only strictly necessary cookies to keep you signed in and secure. It does not use advertising or third-party tracking cookies. See the Cookie & Data Notice for detail.

11. Changes and contact

We may update this policy; the effective date below reflects the current version. Questions about this policy can be sent to privacy@zandtbox.com.