Privacy policy

Who is responsible for your information

The organisation below is the responsible party under POPIA for the information that you give on this website and in the learner portal. Kumanov Perfumery Foundation has its own learner portal and its own records, separate from other organisations.

Information we collect

• Name, surname, email address and mobile number
• South African ID or passport number (kept encrypted), date of birth and gender
• Your student number, which we make when you register
• Your enrolment agreement, the date, time and IP address when you accepted it, and the version that you accepted
• Quotations, invoices, payments, proof of payment and receipts
• Learning records: courses, lessons completed, quiz results, attendance and certificates
• For learners under 18: the name, ID number and consent of a parent or guardian
• If a sponsor or employer pays: the sponsor's details

The enquiry form opens WhatsApp on your device. This website does not store the enquiry.

Why we use it

• To register you, give you a student number and manage your training
• To issue quotations, invoices, receipts and statements, and to record payments
• To deliver and assess the training, and to issue and verify certificates
• To keep the records that an accreditation body (for example the QCTO) requires for accredited programmes
• To contact you about your training and your account
• To report to sponsors or funders: progress reports only with your consent; otherwise in summary form

We do not sell your information. We do not use it for advertising.

Consent

You give consent when you register. The statement names the organisation that holds your information. Consent to use photos or videos in marketing is separate and optional. You can withdraw optional consent at any time in My account in the learner portal. If you are under 18, a parent or guardian must also consent.

Who receives your information

• Authorised staff of the organisation that you registered with, according to their role. For example, a facilitator sees only the learners in their own groups.
• The accreditation body and its quality partners, for accredited programmes, when they require it
• Your sponsor or funder, only with your consent
• Our accountant and auditors
• Service providers: Supabase (database, sign in and file storage; servers in Ireland, European Union), Cloudflare (website hosting), YouTube (unlisted lesson videos in privacy-enhanced mode), Google Fonts, and the email service that sends portal emails.

The European Union has data protection laws that give protection similar to POPIA (section 72 of POPIA).

How we protect it

• All connections use encryption (HTTPS). The database encrypts all stored data, and ID and passport numbers have an extra layer of encryption.
• Each staff member has their own account. Administrators and finance staff use two-factor sign in.
• The database checks every request against the role and organisation of the user.
• An audit log records who viewed, changed, exported or deleted records.
• Course videos and notes are only available to enrolled learners.
• We follow a written procedure for security incidents. If a breach affects you, we tell you and the Information Regulator as POPIA requires.

How long we keep it

We keep learner records for the period shown for each organisation (normally 5 years after your training ends), or longer when a law or an accreditation body requires it. Financial records are kept for at least 5 years as tax law requires. After that, we delete the records.

Your rights

• See the information that we hold about you. You can download it in My account in the learner portal.
• Ask us to correct or delete your information
• Object to how we use your information
• Withdraw optional consent
• Complain to the Information Regulator: inforegulator.org.za, [email protected]

Send requests from My account in the learner portal, or to the Information Officer of your organisation (above). We answer within 30 days.

Related pages

Terms and conditions · Refund and cancellation policy · PAIA manual · Cookie notice