Privacy Policy

1. Introduction

Voca Learning Solutions ("we", "us", "our") is committed to protecting the personal information of learners, bursary beneficiaries, staff, and all individuals whose data is processed through this Learner Management System ("LMS"). This policy explains what data we collect, how we use it, where it is stored, and your rights under the Protection of Personal Information Act, 2013 (POPIA).

2. What Personal Information We Collect

Learners

• Full name, ID number, date of birth, gender, race, nationality, home language
• Citizenship/residency status, socio-economic status, and disability status
• Contact details (email, phone, WhatsApp number, physical and postal address)
• Employment and learnership information (employer, contract dates, stipend)
• Banking details (for stipend payments)
• Educational records (attendance, competency assessments, PoE submissions, monthly workplace registers)
• EISA and qualification records
• Disciplinary records, including any evidence attached to them
• POPI Act consent status and date

People applying for a learnership

Where we invite somebody to apply for a learnership, they complete an application from a private link we send them. An application may also be started from an open link an employer has forwarded to its own people — in that case we ask for a name, an email address and a mobile number first, and send the private application link to that email address. They are not yet a learner, and their application is kept separately from our learner records. We process the details they give us about themselves — name, ID number, contact details, gender, race, home language, SARS tax number, marital status, whether they are employed, the province they live in, whether they live with a disability, their schooling and any qualification after it, previous learnerships, whether they are working, and whether they have a criminal record — along with their answers to our pre-assessment and the mark it is given. They are asked to attach a certified copy of their ID, a certified copy of their highest qualification, and a bank confirmation letter, and may attach a CV.

None of this is collected without the applicant's explicit consent, which is given by ticking a box on the application; an application cannot be submitted without it. If we take the applicant on, the details and documents above are copied onto their new learner record and are then held as learner information. If we do not, the application is kept for the period in Section 10 and nothing is copied anywhere.

Where we invite an applicant to an interview, we keep the date and time of that interview and any note sent with it, so that what they were told and what we hold are the same thing. An open link records which intake an application came through — the name of the link, not who forwarded it. If somebody starts an application with an email address that is already applying, we do not show that application on screen: the link to carry on with it is sent to the email address itself, and nobody typing an address into our form is told whether it belongs to an applicant.

Bursary beneficiaries

Where we administer a bursary rather than a learnership, we process the beneficiary's name, ID number, date of birth, gender, race, and contact details; the institution, programme and year of study; and the value and dates of each bursary. We also store the supporting documents the bursary requires — a certified copy of the ID, bank confirmation letter, bank statement, proof of registration, confirmation of registration, the signed bursary agreement, proof of payment, and DHET registration certificates. A beneficiary may hold more than one bursary; the identity and banking documents are stored once against the person, while the remaining documents are stored per bursary.

Learners who use our WhatsApp channel

Learners may view their schedule, clock in and out of training, receive learning material and submit portfolio evidence over WhatsApp. Staff may also send an announcement to everyone on a training group — a cancelled class or a change of venue — which goes only to learners on that group who have joined the channel and not opted out. The system also sends an automatic reminder about a week before a portfolio of evidence is due, and again on the morning it is due, to the same learners; replying STOP ends these along with every other message. When a learner first messages us we match their WhatsApp number against the number on their learner record — a separate WhatsApp number where we hold one, otherwise their cell number — and ask for the first eight digits of their ID number to confirm it is really them. We store the WhatsApp number, the date it was verified, and a log of the messages exchanged — including whether each message we sent was delivered — so that our support staff can help when something goes wrong.

When a learner asks us a question on WhatsApp, or submits portfolio evidence, the system emails our own staff so that it is not left unanswered. That email contains the learner's name, ID number and the text of their question, and goes only to Amalga staff who are able to answer it — never to anyone outside Amalga. A reminder about anything still unanswered is sent to the same staff each weekday morning. The same staff are emailed when a message we sent a learner could not be delivered, naming the learner and their number, so that an out-of-date number is corrected rather than left unnoticed.

The channel is not switched on for every learner. Staff invite selected learners onto it, which sends one message to the number already on that learner's record — their WhatsApp number where one is held, otherwise their cell number; we record that the invitation was sent. A learner who does not reply is not on the channel, and we hold nothing further about them.

We also send learners messages about their own training progress — when an assessor reviews their portfolio, when staff answer a question they asked, and when they complete a module of their qualification. These messages name the learner, the module and the qualification, and say how many modules they have finished. They go only to the number that learner verified, and a learner may stop them at any time by replying STOP.

On some training groups, a learner who finishes a module is asked how confident they feel about each part of it — green, amber or red, answered by tapping a button. We record those answers against the learner and the module, and our training staff can see them, so that somebody can offer help where a learner has asked for it. It is the learner's own view of their own progress: it is not an assessment, it does not affect any mark, competency or certificate, and it is never used to decide anything about their training. Answering is entirely optional — a learner may ignore the question, answer only part of it, or stop the messages altogether by replying STOP.

To clock in or out, a learner shares their location with us. Location is special personal information, so we ask for the learner's explicit consent before the first clock-in and we do not record any location until that consent is given. We use the location once, to check the learner is at their training venue, and store it against that day's attendance record together with the distance from the venue. We do not track learners between clock-ins, and we never record location at any other time. A learner may withdraw this consent at any time by replying STOP LOCATION on WhatsApp, or stop all messages by replying STOP. Withdrawing consent does not delete location already recorded against past attendance, because that attendance is evidence we are legally obliged to retain (see Section 10).

Staff who use the system

• Name, email address, role, and a securely hashed password
• An optional profile photo. It is supplied by the staff member themselves, is visible only to colleagues signed in to this system, and can be removed at any time from the Staff page. It is never published, never shared outside the organisation, and is deleted with the account.

Records of activity in the system

• Who signed in and what records they created, changed, deleted or exported
• For an edit, the previous and the new value of each field that changed — which may itself contain personal information (for example, a corrected ID number or bank account)
• The IP address the change was made from, and the date and time

3. Why We Collect This Information

• To assess whether somebody who has applied for a learnership is suited to one, and at what NQF level, and to place them with a client if they are taken on
• To manage learner enrolment and progress on SETA learnerships
• To administer bursaries and to account to the funding client for how the money was spent
• To process stipend payments and payroll submissions
• To report to SETAs, the QCTO and the DHET as required by law
• To generate attendance registers and competency reports
• To confirm that a learner clocking in on WhatsApp is physically at their training venue, so that the attendance we report to funders is accurate
• To comply with ETQA and Skills Development Act requirements
• To keep an audit trail, so that changes to a person's record can be traced to the staff member who made them — a requirement of SETA audits and a safeguard for the individuals concerned

4. Where Your Data is Stored

This system and all associated personal information are hosted on Microsoft Azure cloud infrastructure located within South Africa, in the South Africa North region (Johannesburg):

• Application hosting — Azure Container Apps, South Africa North
• Database — Azure Database for PostgreSQL, South Africa North
• Uploaded documents (ID copies, certificates, supporting files) — Azure Blob Storage, South Africa North

Database backups are retained for 30 days and geo-replicated to the South Africa West region (Cape Town) for disaster recovery. Microsoft Azure operates under data processing agreements aligned with POPIA and international data protection standards.

5. Backups Sent by Email

So that we hold a copy of the records independently of the cloud platform, the system sends an automated weekly backup email to a nominated Voca Learning Solutions mailbox. You should be aware of what this involves:

• A spreadsheet containing the system's data tables — including learner personal, contact and banking details, and applications for a learnership with the details and assessment answers the applicant gave — is attached to that email.
• The email also contains a time-limited download link to a ZIP archive of every uploaded document. The link expires after 7 days, but for as long as it is valid anyone holding the link can download the archive without signing in.
• The email is sent over an encrypted (STARTTLS) connection via Microsoft Office 365. Because mail is delivered through Microsoft's global mail infrastructure, we cannot guarantee that it is routed and stored only within South Africa.

The backup mailbox is treated as confidential and is accessible only to the Information Officer and authorised administrators. Backup emails and their links should not be forwarded.

6. Data Sharing

We do not sell your personal information, and we do not share it with third parties except:

• With the relevant SETA, the QCTO or the DHET as required for learnership and bursary reporting
• With your employer (host or client company) for training coordination. A company that funds your learnership may be given a read-only portal login showing the learners they fund: your profile, attendance, competence and the portfolios you have submitted, including the documents themselves. They can also open six of your documents — your workplace based learner agreement, ID copy, proof of disability, proof of registration, employment contract and EEA1 — being the paperwork of the employment and training relationship they hold with you. They are not shown your banking details, tax reference or payroll, nor the documents that carry them (bank confirmation letter, SARS documents), nor your POPI consent form, proof of residence, doctors notes or any termination letter, nor any staff notes about you, nor anything about a learnership funded by a different company.
• With the host employer you are placed with, on the stipend authorisation sheet they complete each month. That sheet carries your name, ID number, group, manager and contract dates. Your cell number is on it only when the person preparing it deliberately chooses to include it — it is left off by default, and each download is recorded in our audit log along with whether numbers were included.
• With the workplace manager you report to, as a daily training report on WhatsApp: how many of their learners attended training that day andthe names of those who did not. It goes to the manager recorded on your profile and to nobody else, and only when a member of our staff sends it for that day. It carries no other detail about you — no ID number, no contact details, no marks and no reason for an absence. An absence we already know to be approved leave or a credit transfer is shown as such rather than as a day you missed. If no manager is recorded against you, nothing is sent about you at all.
• With the client funding your bursary, for reporting on how their allocation has been spent
• With the educational institution at which you are registered, to confirm registration and to pay fees
• With our payment processor (FNB/SimplePay) for stipend disbursement
• With Microsoft, as the operator of the cloud and email infrastructure described above
• With Meta Platforms, which operates WhatsApp. Messages a learner exchanges with us — including a location pin sent to clock in — pass through Meta's WhatsApp Business Platform and are subject to Meta's own privacy terms. Learners who prefer not to use WhatsApp can clock in with their facilitator instead.
• With Google, which operates YouTube. Some learning material is a YouTube linkrather than a file — we send the link and host nothing. A learner who chooses to open one is watching on YouTube, where Google's own terms and cookies apply; we are not told who watched what. Learners who prefer not to use YouTube can ask the office for the material another way.
• As required by law or court order

7. Automated Reading of Documents

When an accreditation certificate is uploaded for an educational institution, the system may read the text of that document automatically in order to suggest the list of programmes it covers. This processing happens entirely within our own hosting environment — the document is not sent to any third-party or artificial-intelligence service — and the result is always reviewed and confirmed by a person before anything is saved. No decision affecting any individual is made by automated means.

8. Data Security

• All data is transmitted over HTTPS (encrypted in transit)
• Data is encrypted at rest on Microsoft Azure infrastructure
• Access is restricted to authorised staff via individual, password-protected accounts
• Passwords are stored only as a one-way cryptographic hash, never in readable form
• Each staff member has a role that determines which parts of the system they may open. Learner records — including ID numbers and banking details — are visible to staff holding the Administrator or Learner Management role, who need them to enrol learners and pay stipends. Facilitators, assessors, moderators and client managers cannot open learner records.
• A staff member holding the Backup Operator role cannot browse learner records in the system, but can download the full backup, which contains them. This role is granted only to the person responsible for safeguarding the data.
• An audit log records every change made to a record, including who made it, when, from what IP address, and what the value was before and after
• Sensitive actions (terminating or completing an enrolment) require a separate permission

9. Your Rights Under POPIA

You have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate information
• Object to the processing of your information in certain circumstances
• Request deletion of your information where retention is no longer justified
• Lodge a complaint with the Information Regulator of South Africa

Please note that where information is corrected, the audit log retains a record of the previous value, and where information is deleted, it may persist in backups until those backups expire (see Section 10). An application for a learnership that was not taken forward carries no such obligation: ask us and we delete it, along with the documents attached to it. We keep the other records because we are legally obliged to be able to demonstrate the integrity of learner records to a SETA auditor. They are not used for any other purpose.

10. Retention

• Learner and bursary records — retained for a minimum of 5 years after the conclusion of a learnership or bursary, as required by the Skills Development Act and SETA audit requirements.
• Applications for a learnership — kept while we are considering them, and after that so that somebody who applies again is not asked to start from nothing. An application and every document attached to it can be deleted outright from our recruitment screen, and we do that on request — see Section 9. Where an applicant is taken on, their details and documents are copied onto their learner record and are then retained as learner information, above.
• Banking details — deleted once no longer required for payment purposes.
• Database backups — retained for 30 days, then automatically discarded.
• Backup download links — expire 7 days after the email is sent.
• The audit log — retained for the life of the system, as an audit trail is only meaningful if it cannot be pruned.

11. Changes to This Policy

We update this policy when the system changes in a way that affects how personal information is handled. The date at the top of this page shows when it was last revised.

12. Contact

For any privacy-related queries or to exercise your rights, please contact:
Information Officer — Voca Learning Solutions
Email: operations@amalgatraining.co.za

You may also lodge a complaint directly with the Information Regulator of South Africa at enquiries@inforegulator.org.za.