Privacy & POPIA

MyUniBuddy privacy policy

This policy describes this proof-of-concept portal. It is not a claim of legal certification or a replacement for an institution's own privacy notice. The project operator must review its legal responsibilities before using the portal in production.

Information we collect

We store the registration details you provide, your profile and contact details, school information, subjects and APS, application choices, uploaded files and file metadata. Profile fields can include demographic, disability, guardian and household information. We also record account sessions, authentication activity, advisor requests, assistant conversations and confirmed assistant actions.

Why we use it

Information supports account access, profile completion, programme and bursary matching, application tracking and assistance. Staff with administrator access can review applicant records and decisions. Do not submit another person's information unless you are authorised to do so.

Service providers and sharing

Neon provides database and private file storage. Resend is used for account and advisor emails when configured. Address lookup sends the address text you enter to Google Maps when configured. Messages and saved learner context used by the bot are processed by the configured AI provider, currently Groq. Avoid including passwords or unnecessary identity documents in chat.

Using a programme shortlist does not itself transmit a university application to that institution. Any live institutional sharing or cross-border transfer must have an appropriate lawful basis and safeguards explained by the operator. Service-provider locations and agreements require review before production use.

Security and access

Passwords are hashed. Student and administrator access is checked on the server. Uploaded files are private, and document download links expire. These controls reduce risk but cannot guarantee that a system will never suffer a breach. Two-factor authentication may be explicitly paused in the local test environment; test credentials must not be used in production.

Retention and removal

Profile records and files remain until removed or deleted by the operator. There is no automated intake-cycle retention cleanup yet. Removing a document clears its database record and deletes its referenced stored file. Retention periods for audit records, backups and advisor attachments must be set by the operator before production use.

Your choices and requests

You can review your profile, correct editable details and remove uploaded documents. The registered ID number is locked to protect account identity; request an identity correction from the project team rather than creating a conflicting account. Contact the team through Talk to an advisor to request access, correction or deletion, object to processing, or withdraw consent where consent is the basis. Some records may need to be retained where the law requires it.

Children and sensitive information

Information about children, disability, population group and other sensitive matters requires additional care and an appropriate lawful basis. The portal requests guardian details and, for applicants under 18, a minor declaration. The operator must verify the necessary authorisation before live processing; completing a checkbox alone is not a guarantee of compliance.

POPIA: your data protection rights

This is an original summary, not the official text of the Act or legal advice. POPIA regulates how personal information is processed in South Africa.

The eight conditions for lawful processing

1. Accountability: the responsible party must ensure lawful handling.
2. Processing limitation: collect information lawfully, fairly and no more than necessary.
3. Purpose specification: explain the purpose and retain information only as justified.
4. Further processing limitation: later use must be compatible with the original purpose unless an exception applies.
5. Information quality: take reasonable steps to keep information accurate and not misleading.
6. Openness: explain collection and processing to the person concerned.
7. Security safeguards: use appropriate safeguards and respond to security compromises.
8. Data subject participation: provide mechanisms for access and appropriate correction or deletion requests.

Consent is not the only lawful basis

Consent must be voluntary, specific and informed where it is relied on. Depending on the circumstances, processing may have another lawful basis under the Act. The operator must document its basis, handle objections and withdrawals appropriately, and take special care with children's and special personal information.

Requests and complaints

First contact the MyUniBuddy project team through the advisor form. If a concern is not resolved, you may contact South Africa's Information Regulator. Requests can be subject to lawful identity checks, limits and retention obligations.