Purpose and Scope
This policy applies to personal information processed by Cyberian Academy by Knowledge X Change in its capacity as a responsible party, operator or service provider, depending on the relevant relationship.
It applies to personal information relating to clients, prospective clients, learners, employees, contractors, suppliers, partners, website users, event participants and other identifiable natural or juristic persons.
The policy applies to information processed through websites, forms, email, learning platforms, business systems, documents, advisory services, programme delivery and operational records.
POPIA Principles
Cyberian Academy by Knowledge X Change processes personal information in accordance with the eight POPIA conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.
These principles guide how information is collected, used, stored, shared, retained, protected and made available to data subjects.
Accountability and Governance
Cyberian Academy by Knowledge X Change remains accountable for ensuring that personal information is processed lawfully and responsibly.
The designated Information Officer or authorised privacy contact will oversee privacy governance, data-subject requests, operator arrangements, breach response and policy review. Formal Information Officer details should be inserted once confirmed.
Employees, contractors and service providers who handle personal information are expected to do so only for authorised purposes and with appropriate confidentiality.
Categories of Data Subjects
Data subjects may include website visitors, prospective clients, client contacts, learners, delegates, employees of client organisations, service providers, suppliers, contractors, facilitators, job applicants, partners and event participants.
The exact information processed will depend on the relationship, service, platform, programme or transaction involved.
Categories of Personal Information
Information may include names, identification and contact details, organisation details, role information, communication records, service interests, learning records, attendance data, assessment data, payment or invoice information, survey responses, platform usage data and website analytics.
Where required and lawful, information may include special personal information or information relating to children, subject to appropriate authorisation and safeguards.
Lawful Processing and Consent
Cyberian Academy by Knowledge X Change processes personal information where a lawful basis exists, including consent, contract, legal obligation, legitimate interest, protection of rights or other grounds permitted by POPIA.
Consent will be obtained where required. A data subject may withdraw consent where processing is based on consent, although withdrawal may affect the ability to deliver certain services.
Purpose Specification
Personal information is collected for specific, explicitly defined and lawful purposes connected to enquiries, proposals, service delivery, programme administration, learning records, client management, supplier management, compliance, reporting, marketing and website operation.
Information will not be retained for longer than necessary unless retention is required or permitted for legal, contractual, operational, audit or legitimate business reasons.
Further Processing
Further processing will be assessed for compatibility with the original purpose of collection, the nature of the information, consequences for the data subject, the manner of collection and any contractual or legal obligations.
Where further processing is not compatible, Cyberian Academy by Knowledge X Change will seek consent or rely on another lawful basis before proceeding.
Information Quality and Openness
Reasonable steps will be taken to keep personal information accurate, complete and up to date where the information is used for active decision-making or service delivery.
Cyberian Academy by Knowledge X Change will make appropriate privacy notices available so data subjects understand what information is collected and why.
Security Safeguards
Cyberian Academy by Knowledge X Change will apply appropriate and reasonable security measures to protect personal information against loss, damage, unauthorised access, unlawful processing, disclosure, alteration or destruction.
Security measures may include access management, confidentiality undertakings, secure storage, backups, malware protection, supplier controls, secure disposal, incident handling and staff awareness.
Operators and Third Parties
Where an operator processes personal information for Cyberian Academy by Knowledge X Change, the operator must process information only with authorisation and must apply appropriate security and confidentiality measures.
Contracts, instructions or service arrangements should regulate the operator's processing activities, access rights, security duties, breach notification and return or deletion of information.
Cross-Border Information Transfers
Personal information may be transferred outside South Africa where cloud platforms, hosting, email, analytics, support or other services are provided internationally.
Cyberian Academy by Knowledge X Change will take reasonable steps to ensure that such transfers are lawful, proportionate and subject to appropriate protection.
Direct Marketing
Direct marketing by electronic communication will be managed in line with applicable consent, opt-out and existing-customer requirements.
Recipients may unsubscribe or request removal from marketing communications using the provided communication channels.
Data Subject Participation
Data subjects may request access to personal information, correction or deletion of information, objection to processing, restriction of processing, withdrawal of consent or confirmation that Cyberian Academy by Knowledge X Change holds information about them.
Requests should be submitted through the contact details on the website and may require identity verification.
Security Compromises
If Cyberian Academy by Knowledge X Change has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, it will assess the incident and notify affected data subjects and the Information Regulator where required by POPIA.
Incident response may include containment, investigation, remediation, communication, supplier coordination and records of corrective steps.
Complaints and Regulator Contact
Privacy complaints may be submitted to Cyberian Academy by Knowledge X Change through the published contact details.
Data subjects may also approach the Information Regulator of South Africa for guidance or complaints relating to interference with protection of personal information.
Review
This POPIA Policy should be reviewed periodically and updated when services, systems, legal requirements, operators, information categories or processing purposes change.