POPIA Privacy Notice

1 Responsible Party

The responsible party for your personal information is:

• FPT Academy (Pty) Ltd
• Registration No: [Company Registration Number]
• Physical address: Durban, KwaZulu-Natal, South Africa
• Email: learn@fptacademy.co.za
• Phone: 031 493 9717

2 Information We Collect

Depending on your relationship with FPT Academy, we may collect and process the following categories of personal information:

Website enquiries and general contact

• Full name and surname
• Email address and telephone number
• Organisation name (where applicable)
• Programme of interest and the content of your enquiry

Learner enrolment and programme administration

• South African ID number or passport number
• Date of birth, gender, and home language
• Race (required for B-BBEE and SETA reporting — subject to your consent)
• Disability status (where voluntarily disclosed)
• Employment details and employer information
• Prior qualifications and educational history
• Assessment results and competency records
• Banking details (where applicable for stipend or grant payments)

Employer and service provider contacts

• Contact person name, role, and business contact details
• Company registration and SDL (Skills Development Levy) information

3 Why We Collect It

We collect and process personal information for the following purposes:

• Responding to enquiries and providing programme information
• Enrolling learners and administering training programmes
• Conducting assessments and issuing results and certificates
• Registering learners and reporting to SETAs (Services SETA, W&RSETA, ETDP SETA, FASSET) and the QCTO
• Compiling B-BBEE skills development reports for employer clients
• Administering learner stipends or grant-related payments
• Maintaining learner portfolios and competency records
• Communicating programme updates, schedules, and compliance deadlines
• Sending relevant industry news and training updates (with your consent)
• Complying with our legal and regulatory obligations as an accredited training provider

4 Lawful Basis for Processing

We process your personal information on one or more of the following lawful grounds under POPIA:

• Contract: Processing is necessary to fulfil our obligations in connection with a learnership or training agreement.
• Legal obligation: We are required by law to register learners with SETAs and the QCTO and to maintain training records.
• Legitimate interest: Responding to enquiries and maintaining business relationships.
• Consent: For marketing communications and for processing special personal information such as race, disability status, or home language where required for reporting and where not otherwise required by law.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

5 Third-Party Sharing

We share personal information only where necessary, and only with the following categories of recipients:

• SETAs and the QCTO — for learner registration, learnership agreement lodgement, grant claims, and qualification certification
• Registered assessors and moderators — for the conduct of assessments required under your programme
• Your employer — where you are enrolled under an employer-funded learnership, we share progress reports and attendance records with the relevant employer or skills development facilitator
• IT and system providers — our learning management system and student portal providers, who process data on our behalf under contractual data processing agreements
• Legal or regulatory authorities — where required by law, court order, or to protect our legal rights

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

6 Data Retention

We retain personal information for as long as is necessary for the purpose for which it was collected and to comply with our legal obligations:

• Learner records and assessment portfolios: 5 years after programme completion, or as required by the relevant SETA or the QCTO
• Financial records: 5 years in accordance with the Companies Act and SARS requirements
• Enquiry records (non-enrolled): 12 months from the date of enquiry
• Marketing consent records: Retained until consent is withdrawn

When personal information is no longer required, we securely destroy or de-identify it.

7 Security

We implement appropriate technical and organisational measures to protect your personal information against loss, unauthorised access, destruction, or disclosure. These include:

• Password-protected systems with role-based access controls
• Encrypted data transmission (HTTPS/TLS) across our website and portal
• Staff training on information security and POPIA obligations
• Contractual data protection obligations with all third-party operators

In the event of a security compromise that is likely to prejudice you, we will notify you and the Information Regulator as required by POPIA.

8 Your Rights

As a data subject under POPIA, you have the following rights:

To exercise any of these rights, please contact our Information Officer using the details in Section 11 below.

9 Cookies

Our website uses only essential technical cookies required for the site to function correctly. We do not use tracking, analytics, or advertising cookies. No personal information is collected automatically through cookies when you browse our website.

10 Complaints

If you believe we have not complied with your rights or our obligations under POPIA, please contact our Information Officer in the first instance. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: www.inforegulator.org.za
• Email: inforeg@justice.gov.za

11 Contact the Information Officer

For any questions about this notice or to exercise your rights, please contact our designated Information Officer: