Draft for review. This document is not yet in force. Its final wording is subject to legal review.
ProCourse Privacy Notice, version 1.0.0-draft.1, not yet in force1. Who is responsible. ProCourse (Pty) Ltd (registration number [●], [address]) is the responsible party under the Protection of Personal Information Act (POPIA). Information Officer: [●], [email].
2. What we collect and why
- Who
- Visitors
- Information
- Pages viewed, device/browser data, IP address, bot-check result
- Why
- Operate and secure the site, prevent abuse
- Legal basis (POPIA s11)
- Legitimate interests
- Who
- Learners
- Information
- Name, email, password (encrypted hash), 18+ confirmation, purchases, course progress, support and refund messages, payment reference (no full card details)
- Why
- Provide accounts and courses, process payments and refunds, support, keep records
- Legal basis (POPIA s11)
- Contract; legal obligation; legitimate interests
- Who
- Sellers
- Information
- Name, contact details, profile, identity verification outcome (ID image deleted after verification), organisation and representative details, bank account details and proof of account, tax status, statements
- Why
- Verify Sellers, publish courses, calculate and pay revenue share, prevent fraud, keep records
- Legal basis (POPIA s11)
- Contract; legal obligation; legitimate interests
- Who
- Anyone who reports content
- Information
- Name, email, report details
- Why
- Handle reports and legal notices
- Legal basis (POPIA s11)
- Legitimate interests; legal obligation
| Who | Information | Why | Legal basis (POPIA s11) |
|---|---|---|---|
| Visitors | Pages viewed, device/browser data, IP address, bot-check result | Operate and secure the site, prevent abuse | Legitimate interests |
| Learners | Name, email, password (encrypted hash), 18+ confirmation, purchases, course progress, support and refund messages, payment reference (no full card details) | Provide accounts and courses, process payments and refunds, support, keep records | Contract; legal obligation; legitimate interests |
| Sellers | Name, contact details, profile, identity verification outcome (ID image deleted after verification), organisation and representative details, bank account details and proof of account, tax status, statements | Verify Sellers, publish courses, calculate and pay revenue share, prevent fraud, keep records | Contract; legal obligation; legitimate interests |
| Anyone who reports content | Name, email, report details | Handle reports and legal notices | Legitimate interests; legal obligation |
We do not knowingly collect information about children. We do not collect special personal information (such as health, religion or criminal records) at launch.
3. Marketing. We send marketing only if you opt in, or if you are a customer and the marketing is about similar courses. You can always unsubscribe in one step from every message.
4. Cookies. We use essential cookies for sign-in, security and checkout. [● If analytics are enabled: we use analytics cookies only with your consent.]
5. Who we share with. We share personal information only with:
- our service providers (operators) for hosting and databases, video delivery, file storage, email delivery, bot protection, and payment processing;
- Instructors, who see aggregated, non-identifying course statistics;
- professional advisers, auditors and authorities where the law requires.
We do not sell personal information.
6. Information processed outside South Africa. Some of our service providers process information outside South Africa, for example in the European Union and the United States, for video delivery, file storage, email delivery and bot protection. We use them only under written agreements that require adequate protection (POPIA section 72), or where the transfer is necessary to provide the service you asked for.
7. Security. We use access controls, encryption in transit, and private, time-limited links for protected files and video. Staff can access sensitive data only when their role requires it. If a security compromise affects you, we will notify you and the Information Regulator as the law requires.
8. How long we keep information
- Information
- Account data
- Kept for
- While your account is open, then deleted or anonymised within 90 days of closure
- Information
- Payment, refund, payout and accounting records, and records of your acceptance of our terms
- Kept for
- 7 years
- Information
- Seller ID document image
- Kept for
- Up to 30 days after the verification decision
- Information
- Seller bank-account proof
- Kept for
- 5 years after the last payout
- Information
- Support and complaints
- Kept for
- 3 years after resolution
- Information
- Security logs
- Kept for
- 90 days
| Information | Kept for |
|---|---|
| Account data | While your account is open, then deleted or anonymised within 90 days of closure |
| Payment, refund, payout and accounting records, and records of your acceptance of our terms | 7 years |
| Seller ID document image | Up to 30 days after the verification decision |
| Seller bank-account proof | 5 years after the last payout |
| Support and complaints | 3 years after resolution |
| Security logs | 90 days |
Records are kept longer if needed for a legal claim or investigation.
9. Your rights. You may ask whether we hold your information and for a copy, ask us to correct or delete it, object to processing based on legitimate interests or to direct marketing, and withdraw consent. Contact [●]. We respond within 30 days. Some information must be kept by law even if you ask us to delete it. We will tell you which, and why. You may complain to the Information Regulator ([● website/email]).
10. Changes. We will notify you of material changes before they take effect.