Privacy notice

Who is responsible

For courses sold directly by Kwalifi, the responsible party is MTBRZ GROUP (registration number 2026/523775/07), trading as Kwalifi. Our contact details are on the contact page.

Our Information Officer is Wesley Sing, admin@kwalifi.co.za.

What we collect

Learners: your name, email address, the courses you enrol on, your progress, your assessment answers and results, and any certificate issued to you. Where a course includes a tracked contact session, we record that you signed the attendance register and when.

Practical assessments: where a course is assessed on site, an assessor may record photographs, video, voice notes or documents as evidence of what you demonstrated. This is kept as your Portfolio of Evidence.

Payments: our payment provider processes your card details. We never see or store them; we keep only the fact of a payment, its amount and its reference.

We collect the minimum needed to run the course and issue a certificate that can be verified. We do not sell personal information, and we do not use it for advertising.

Why we collect it

To give you access to courses you have enrolled on, to mark your assessments, to issue and verify certificates, to support you when something goes wrong, and to keep the records a training provider is required to keep. Our lawful basis is the performance of our contract with you, our legitimate interest in running the service, and, where a course requires it, your consent recorded at enrolment.

What appears publicly

A certificate's verification page shows the holder's name, the course and the issue date to anyone holding the certificate number. That is the point of a verifiable certificate. Nothing else about you is public, and certificate numbers cannot be guessed or listed.

Where your information is stored

Our database and the files uploaded to it are hosted in Frankfurt, Germany, so your personal information is transferred outside South Africa. Section 72 of POPIA permits this where the receiving country provides an adequate level of protection: Germany is in the European Union and subject to the General Data Protection Regulation, and our providers are bound by data processing agreements requiring the same protections and restricting onward transfer. Email we send you is dispatched by Supabase on our behalf, and may be delivered through servers outside the Republic.

Who processes it for us

We use a small number of operators, each bound to process personal information only on our instruction: Supabase (database, sign-in, file storage, and the sign-in and notification email it sends on our behalf), Vercel (hosting and page analytics) and Paystack (payments). We do not share your personal information with anyone else except where the law requires it.

We measure how the site is used — which pages are opened, from which country, on what kind of device — in aggregate. It sets no cookies, does not follow you to other websites, and produces counts rather than a record of you, which is why this site asks you to accept nothing before you read it. We do not use advertising or cross-site tracking of any kind.

How long we keep it

Certificates and the assessment records behind them are kept for as long as the certificate remains verifiable, because a certificate nobody can check is worthless. Where a course is delivered by an accredited provider, records are kept for the period that provider's quality council requires. Everything else is deleted when it is no longer needed for the purpose it was collected for. If you close your account we delete your personal information except what we must keep to honour a certificate already issued or to meet a legal obligation.

How we protect it

Access is restricted at the database itself, so one organisation's learners cannot be read by another and assessment answer keys are not readable by learners. Evidence files are held in private storage and served only through short-lived links. Traffic is encrypted in transit.

Courses delivered by accredited providers

Where a course is delivered by an accredited training provider using Kwalifi, that provider is the responsible party for your personal information and Kwalifi acts as their operator, processing it only on their instruction. Their own privacy notice applies to that course, and requests about your information should go to them.

Your rights

You may ask what personal information we hold about you, ask us to correct or delete it, object to processing, and withdraw any consent you have given. Withdrawing consent does not affect processing that already happened, and may mean we can no longer provide a course. Send requests to admin@kwalifi.co.za and we will respond within two business days.

Complaints

If you are not satisfied with how we have handled your personal information, you may complain to the Information Regulator (South Africa). Their current contact details are published on their website.

Changes to this notice

If we change how we handle personal information we will update this page and change the date at the top. Where a change materially affects you, we will tell you directly.