Privacy Policy

1. INTRODUCTION AND PURPOSE

1.1 This Privacy Policy regulates the manner in which ROCVEST Systems (PTY) Ltd ("ROCVEST", "Responsible Party", "we", "us", or "our") collects, processes, stores, uses, and protects Personal Information obtained through the Matric2Tertiary platform ("Platform").

1.2 This Policy is adopted in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and must be read together with:

• The Platform Terms and Conditions
• The Disclaimer Policy
• The Data Retention Policy

1.3 The purpose of this Policy is to:

• Give effect to the constitutional right to privacy
• Safeguard Personal Information processed by the Platform
• Inform Users of their rights and obligations
• Define lawful processing practices

2. DEFINITIONS

For purposes of this Policy:

2.1 "Personal Information" bears the meaning assigned in POPIA and includes any information relating to an identifiable, living natural person.

2.2 "Processing" includes collection, receipt, recording, storage, updating, dissemination, or destruction of Personal Information. The Platform includes functionality that enables Users to engage with Tutors and to make payments for services. Accordingly, Personal Information may be processed in connection with tutoring services, bookings, communications, and financial transactions.

2.3 "Data Subject" means any User whose Personal Information is processed through the Platform.

2.4 "Operator" means a third party who processes Personal Information on behalf of ROCVEST.

2.5 "Special Personal Information" refers to information as defined under POPIA requiring additional protection.

3. LAWFUL BASIS FOR PROCESSING

3.1 ROCVEST processes Personal Information strictly in accordance with POPIA, and only where:

• The Data Subject has provided consent;
• Processing is necessary for the performance of a contract;
• Processing complies with a legal obligation;
• Processing is necessary for a legitimate interest of the Responsible Party or Data Subject;

3.2 Processing shall always be:

• Lawful
• Reasonable
• Minimal and purpose-driven

4. TYPES OF PERSONAL INFORMATION COLLECTED

4.1 The Platform may collect and process the following categories of Personal Information:

5. PURPOSE OF PROCESSING

5.1 Personal Information is processed for the following purposes:

• To provide functionality of the Platform
• To generate academic pathway recommendations
• To calculate and display APS results
• To improve system performance and user experience
• To communicate with Users
• To ensure system security and integrity
• To comply with legal and regulatory obligations

5.2 Personal Information shall not be processed for purposes incompatible with the original purpose of collection.

6. SPECIAL PERSONAL INFORMATION

6.1 The Platform does not intentionally collect Special Personal Information as defined under POPIA.

6.2 Where such information is inadvertently processed:

• It shall be subject to heightened protection measures;
• Processing shall be limited strictly to lawful purposes;

7. PROCESSING OF MINORS' INFORMATION

7.1 The Platform is intended for use by learners, including minors.

7.2 Where the User is under the age of 18:

• Processing shall be subject to consent by a parent or legal guardian;
• Such consent may be obtained through Platform mechanisms or verification processes;

7.3 Parents or guardians bear responsibility for supervising the minor's use of the Platform.

8. CONSENT

8.1 By using the Platform, the User consents to the processing of Personal Information as set out in this Policy.

8.2 Consent must be:

• Voluntary
• Specific
• Informed

8.3 The User may withdraw consent at any time, subject to:

• Legal and contractual limitations;
• Retention obligations as set out in the Data Retention Policy;

9. DISCLOSURE OF PERSONAL INFORMATION

9.1 Personal Information may be disclosed to:

9.3 Personal Information shall not be sold, rented, or traded.

10. CROSS-BORDER TRANSFERS

10.1 Personal Information may be transferred outside South Africa where:

• The recipient is subject to laws providing adequate protection; or
• The User consents to such transfer;

10.2 Appropriate safeguards shall be implemented to ensure compliance with POPIA.

11. DATA SECURITY SAFEGUARDS

11.1 ROCVEST implements appropriate technical and organisational measures to secure Personal Information, including:

• Encryption of sensitive data
• Secure servers and hosting environments
• Access control and authentication measures
• Monitoring and auditing systems

11.2 Despite such measures, no system is entirely secure, and Users acknowledge inherent risks associated with digital platforms.

12. DATA RETENTION

12.1 Personal Information shall be retained only for as long as necessary to fulfil the purpose for which it was collected.

12.2 Retention periods are governed by the Data Retention Policy and include:

• Account data retention during active use
• Post-termination retention for legal and evidentiary purposes

12.3 Data may be retained longer where required by law or for dispute resolution.

13. DATA SUBJECT RIGHTS

13.1 The User has the right to:

• Access their Personal Information
• Request correction of inaccurate or incomplete data
• Request deletion of Personal Information
• Object to processing
• Withdraw consent

13.2 Requests may be submitted to the Information Officer.

13.3 Requests shall be processed in accordance with POPIA requirements.

14. RESTRICTION OF PROCESSING

14.1 Where a User contests accuracy or lawfulness:

• Processing may be restricted pending resolution

14.2 Restricted data shall not be actively processed except for lawful purposes.

15. DATA BREACHES

15.1 In the event of a data breach:

• ROCVEST shall notify affected Data Subjects where required;
• The Information Regulator shall be notified in accordance with POPIA;

15.2 Reasonable steps shall be taken to mitigate harm.

16. INFORMATION OFFICER

16.1 ROCVEST shall appoint an Information Officer responsible for:

• Compliance with POPIA
• Handling data subject requests
• Liaison with the Information Regulator

17. LIMITATION OF LIABILITY

17.1 ROCVEST shall not be liable for damages arising from:

• Unauthorised access beyond its reasonable control
• User negligence in safeguarding login credentials

17.2 Liability shall be limited to the extent permitted by law.

18. PAYMENT INFORMATION PROCESSING

18.1 ROCVEST does not collect or store full financial card details of Users.

18.2 Payment information is processed securely by authorised third-party payment service providers in accordance with applicable data protection and security standards.

18.3 ROCVEST may receive limited transactional information necessary to:

• Confirm payment status;
• Facilitate service delivery;
• Maintain transaction records;

18.4 All payment processing is subject to the privacy and security practices of the relevant payment service provider.

19. LIMITED DISCLOSURE TO TUTORS

19.1 ROCVEST may share Personal Information with Tutors strictly for the purpose of enabling the provision of tutoring services.

19.2 Such Personal Information shall be limited to what is reasonably necessary, which may include:

• Name and surname;
• Contact details;
• Booking and scheduling information;

19.3 ROCVEST shall take reasonable steps to ensure that such disclosure is limited, proportionate, and consistent with the purpose for which the information was collected.

19.4 Tutors are required, through contractual obligations, to process Personal Information in a lawful and secure manner in accordance with applicable data protection laws.

20. Sharing of Personal Information with Third Parties

20.1 Personal Information may be shared with carefully selected third parties where such disclosure is necessary to:

• Facilitate the provision of platform services;
• Enable tutoring, booking, and payment functionality;
• Connect Users with relevant educational, career, or funding opportunities;

20.2 These third parties may include:

• Educational institutions;
• Tutors and service providers;
• Partner organisations offering student-related services or opportunities;

20.3 In certain circumstances, Personal Information may be used to match Users with opportunities, programmes, or services that are relevant to their academic profile, interests, or activity on the Platform.

20.4 ROCVEST does not sell Personal Information in a manner that is inconsistent with applicable data protection laws. All sharing of Personal Information is conducted in accordance with POPIA and is subject to appropriate contractual, confidentiality, and security safeguards.

20.5 Where required, explicit User consent will be obtained prior to such processing.

21. POLICY AMENDMENTS

21.1 ROCVEST reserves the right to amend this Policy.

21.2 Updated versions shall be made available on the Platform.

22. GOVERNING LAW

22.1 This Policy shall be governed by the laws of the Republic of South Africa.

23. ACCEPTANCE

By using the Platform, the User confirms that:

• They have read and understood this Privacy Policy
• They consent to the processing of their Personal Information
• They accept the terms contained herein