Privacy notice

Version v8-operational-draft · updated 22 October 2026 · learner profiles, uploaded learner files, and recruitment enquiries

Operational draft — not yet approved for production. The legal operator and contact, reporting recipients, provider locations, cross-border safeguards, and lawful-basis review still need confirmation. The system owner should consult the internal reminder.md checklist. Do not rely on this draft as legal approval.

Who is responsible

The programme is operated as the Forvis Mazars Institute of Development (FMID). The exact legal entity responsible for the information and its registration details are [PENDING: confirm legal entity name and registration number]. The Information Officer’s name and contact are [PENDING: confirm name and email or official privacy contact]. These details must be completed before this notice is approved.

Information we collect

Learner accounts and profiles: name, email, programme, optional phone number, gender and race (including “Prefer not to say”), education and qualifications, certifications, current studies, languages, experience, previous roles, employment information, and cohort assignment.
Optional uploads requested by the programme team: profile photo, identity, school or qualification records, CV, tax document, proof of address, or bank-confirmation letter. The portal stores the file and its supplied filename, type, size and upload time. Do not upload files unless requested. Never upload card numbers, PINs or passwords.
Consent records: the notice/consent version and time recorded when a profile is saved or an enquiry is submitted.
Recruitment expressions of interest: name, email, selected programme, optional phone number, submission/consent details, and follow-up status. These are enquiries, not learner profiles or formal applications. The public enquiry form does not request documents, ID numbers, race or date of birth.
Operational records: administrator access events, profile-change field names, cohort assignment history and recruitment follow-up/deletion events. Profile-change logs record field names, not the changed values.

Purposes and recipients

We use learner information to issue learner account invitations and sign-in codes, administer programme participation, learner profiles and cohorts, and review documents specifically requested by the programme. Recruitment contact information is used to respond to the selected programme enquiry, not for marketing. Information provided to employers, SETAs, funders or other reporting recipients, and the fields and purposes involved, are [PENDING: confirm reporting recipients, data fields and purposes, or confirm there are none]. We do not sell personal information.

Consent and your choices

The portal records learner consent when you tick the consent box and save your profile. Uploads are optional. Existing learners must review this updated notice and save their profile with consent again; the current profile consent version is v6-2026-10. Recruitment uses a separate consent box and version recruitment-interest-v1. An enquiry does not create a learner account and is not consent to marketing. Consent records and the appropriate lawful basis, including the treatment of race and other sensitive information, require Information Officer/legal review before this notice is approved. You may contact the Information Officer to ask about withdrawal; withdrawing consent does not undo processing that already occurred.

Who can access information

Learners can access their own profiles and files. Named, authorised programme administrators can access programme records and, where needed, learner files. Recruitment enquiries are available to authorised administrators in the separate applicant inbox. Database and storage policies restrict learner access by account. Dashboard-mediated document opens and administrative reads are logged; direct administrator access to private storage may not be recorded in that dashboard log, so the log is not a complete record of every possible file read.

Service providers and storage location

Supabase provides the database, authentication and private file storage. The actual project region is [PENDING: verify region in the Supabase project settings].
Vercel serves the portal pages. Cloudflare Turnstile provides bot checks; when recruitment is enabled, the server may send the request IP address to Cloudflare to verify a challenge.
The provider that sends sign-in emails and its processing/location details are [PENDING: confirm SMTP/email provider and relevant processing locations].

Whether information is transferred outside South Africa and the applicable safeguards/basis under POPIA section 72 are [PENDING: verify actual data locations and obtain documented Information Officer/legal approval]. Do not assume a project region or transfer basis from this draft.

Retention and erasure

The operational retention target is three years for each category. Learner profile, account, cohort membership and uploaded-file records are scheduled for deletion three years after programme completion, or three years after the last recorded participation where no completion date is available. The retention period for an invited account that is never activated or has no recorded learner participation is [PENDING: approve an expiry period for unaccepted/inactive learner invitations]. Recruitment enquiries are scheduled for deletion three years after submission; an administrative status change does not restart that period. Access, profile-change, recruitment and cohort-history log entries are scheduled for deletion three years after each event. A documented legal, funder or audit hold may require a different period and must be approved and recorded before expiry.

Until automated expiry is built and verified, an authorised system owner must review due records at least quarterly, document the review, and carry out approved deletion. The three-year target also applies to backup copies, but deletion from active records may not immediately remove provider backups. Whether provider backups can expire by the same deadline, and how deleted data is handled if a backup is restored, are [PENDING: confirm provider backup retention and deletion behaviour].

The learner “Delete my profile” control removes the profile and attempts to remove its uploaded files and metadata. It does not delete the sign-in account or current cohort assignment. If you need those removed too, contact the Information Officer. Recruitment enquiry deletion is an administrator action under the retention process. The internal erasure procedure still requires automation and operational verification.

Sign-in and device guidance

The portal uses one-time email codes. Admin multi-factor authentication is planned for a later project stage and is not yet enforced. Sign-in state is held in tab-scoped browser storage. The portal currently applies a client-side sign-out after 30 minutes without activity or after 8 hours from sign-in, whichever comes first; this timer is not a server-side session guarantee. A normal tab close ends its session, but duplicated or restored tabs may retain a copy. On shared devices, use the visible Sign out control before leaving and sign out separately in every portal tab. Server-side session limits and admin MFA remain launch hardening tasks.

Your rights and complaints

You can review and correct your learner profile in the portal and use “Delete my profile” to remove the profile and associated uploads, subject to the limitations above. For access, correction or deletion requests concerning recruitment enquiries, sign-in accounts, cohort membership, or other records, contact [PENDING: Information Officer contact]. You may also contact the Information Regulator of South Africa if you believe your information has been handled unlawfully. Add the approved complaint/contact process here after Information Officer review.

Security

Connections use HTTPS. The portal applies account-based database and private-storage access rules, administrator access checks, and access/change logging for specified actions. Current administrator sign-in uses email one-time codes; MFA is planned but not yet enabled. These safeguards reduce risk but cannot guarantee that information is secure in every circumstance. This notice and the retention schedule require Information Officer/legal and vendor review before production approval.