ATX-POL-0008 R04 · 30 October 2026
Academy Privacy Notice: Your Data Security and AI
This notice explains how AiTronetiX (Pty) Ltd handles your personal information when you buy or take a course on the AiTronetiX Academy (academy.aitronetix.com). We give it to you under section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA). It adds to our Privacy Policy at aitronetix.com/privacy-policy. If your employer (or another business) bought your seat, section 3A explains what is different for you.
1. Who is responsible
AiTronetiX (Pty) Ltd, Reg. No. 2021/786421/07, 14 Regency Drive, Route 21 Business Park, Pretoria, 0157, is the responsible party. Our Information Officer (the Director) can be contacted at info@aitronetix.com or +27 67 241 8196.
2. What we collect
Our learning platform (Moodle) collects:
| Category | What it includes | Where it comes from |
|---|---|---|
| Account details | Your name, email address, username, password (stored only in scrambled, hashed form), and your company name if a business bought your seat | You, or the business that bought your seat |
| Business order details | If a business buys seats: the business's name and registration number, the names, work email addresses and phone numbers of its billing and key contacts, its purchase order number, our invoice and its proof of payment | The business buyer |
| Staff invitation and learner list details | If a business buys your seat and asks us to invite you (method A), or sends us a learner list so that we can set up your account (method B): your name and work email address, the seat, and the date of the invitation or of account creation | The business buyer (usually your employer) |
| Order and payment | Order details, the payment reference, amount, date and status, and the payer name and email that PayFast sends back with its confirmation. We never receive your card or bank details. | You and PayFast |
| Progress | Which lessons and activities you have opened and completed, and when | The platform |
| Quiz and assessment results | Your answers, marks, number of attempts and dates | The platform |
| Certificate records | Your name, the course, the skills assessed, the completion date and the certificate ID | The platform |
| Logs | Sign-in times, the pages and actions you use, your IP address and browser or device details | The platform |
| Consent records | When you accepted the terms and this notice (and which version), and your marketing choice | You |
| Messages | Support emails and messages you send us | You |
We don't ask for special personal information (such as health or religious beliefs) and we don't need it. The platform uses only strictly necessary sign-in cookies. It uses no analytics or advertising cookies unless you agree to them first.
The Academy is only for adults (18 and over). We don't knowingly collect information about children. If we learn that a child has registered, we close the account and delete their information.
3. Why we use it, and our lawful basis (POPIA section 11)
| Purpose | Lawful basis |
|---|---|
| Creating your account, giving you access, tracking progress, marking quizzes and issuing your certificate | Performing our contract with you (s11(1)(b)) |
| Processing payment and refunds, and keeping financial records | Contract (s11(1)(b)) and legal obligation (s11(1)(c)): Tax Administration Act 28 of 2011 s29, Companies Act 71 of 2008 s24 |
| Giving a business buyer, for its own learners only, each learner's name, enrolment and access dates (start and end), progress, completion and its date, and certificate status, date and code, and nothing else (section 3A.5) | Our contract with the business, and the legitimate interest of the business and the learner in confirming training it paid for (s11(1)(b) and (f)) |
| Handling a business order: invoicing, receiving payment, issuing and resetting the sign-up key, and dealing with the buyer's billing and key contacts | Our contract with the buyer, and our and the buyer's legitimate interest in managing the order (s11(1)(f)) |
| Sending the course invitation, sign-up key and service messages to staff details a business buyer gave us, or creating accounts from a buyer's learner list and emailing login details (section 3A) | The legitimate interest of the buyer and of us in enrolling the staff the buyer paid for (s11(1)(f)). You may object (section 9). |
| Moving a seat to another learner, or closing a learner's account when they leave the buyer: we close the account by suspending it at once, so access ends that day and it is never reused for another person, and its information is then deleted or de-identified on the section 10 retention timetable, counted from that date, or, for a learner list account whose learner never logged in and accepted the Course Terms, deleted within 30 days (Course Terms clauses 13.10 and 13.10A) | Performing our contract with the buyer and the learner (s11(1)(b)) |
| The public certificate check (section 7) | The legitimate interest of you and the people you show your certificate to in confirming that it is genuine (s11(1)(f)). You may object (section 9). |
| Keeping the platform secure, preventing misuse and investigating incidents | Our legal duty to keep information secure (s19, s11(1)(c)) and our legitimate interest (s11(1)(f)) |
| Answering your questions and complaints, and dealing with disputes | Contract (s11(1)(b)) and legitimate interest (s11(1)(f)) |
| Marketing our courses and services (section 8) | Your consent (s11(1)(a) and s69(1)) |
| Confirming your completion to a professional body for CPD purposes, if a course carries CPD points and you ask us to | Your consent (s11(1)(a)) |
We don't sell personal information, and we don't use your quiz answers or messages to train AI models.
3A. If a business bought your seat (staff details from a business buyer)
This section applies when a company or other business (the "buyer", usually your employer) buys Academy seats and gives us the names and work email addresses of its staff, so that we can invite them to sign up with a key (method A) or create their accounts from a learner list (method B).
3A.1 The buyer's responsibilities. The buyer is a responsible party under POPIA for its decision to share its staff's details with us. Before it sends them, the buyer must have a lawful basis to share them (POPIA section 11) and must tell the staff concerned that it is sharing their name and work email with AiTronetiX for the course (section 18). The buyer confirms this when it orders. This also applies to a learner list sent on our template. Buyers should send staff lists to us securely (for example as a password-protected file, with the password sent separately), not in a group message or on social media.
3A.2 What we ask for. Only each learner's name and work email address (section 10). Please don't send ID numbers, phone numbers, job titles, personal email addresses or any other details. If we receive more, we delete the extra information.
3A.3 How we use the details. Only to send the course invitation or sign-up key, to create learner accounts from a learner list, and to send service messages about the seat, such as login details, a reminder that the invitation is waiting, a key reset or a seat transfer. These are not marketing. We never send marketing to learners whose details came from a buyer unless the learner gives their own consent (section 8; POPIA section 69). The buyer can't consent for you.
3A.4 Telling you. Our invitation email, or the login email for an account set up from a learner list, says who we are, that your employer (named) gave us your name and work email for the course, what we use them for, and links to this notice (POPIA section 18).
3A.5 Once you sign up or first log in. When you redeem the key and create your account (method A), or when we create your account from your employer's learner list (method B), we become the responsible party for your learner account, and the rest of this notice applies to you in the same way as to any learner. When you sign up (method A) or first log in (method B), you must accept the Course Terms and this notice, and we tell you, and you confirm, that the buyer may receive, for its own learners only, your name, enrolment and access dates (start and end), progress, completion and its date, and certificate status, date and code, as a platform report or CSV file. The buyer won't receive your quiz or assessment answers, marks or attempts, your sign-in logs, or any other course content or activity in your account.
3A.6 If you don't sign up, or don't log in and accept the terms. We keep invitation details only as section 10 says, and then delete them. If your account was set up from a learner list, your 12 months' access starts only when you first log in and accept the Course Terms (Course Terms clause 4.1). Access to your account by our staff or systems doesn't start it. If you haven't logged in and accepted the Course Terms by 23:59 SAST on the date 3 years after we confirmed the seats to the buyer in writing, the seat expires, and we suspend your account then and delete it within 30 days (Course Terms clause 13.9 and section 10). An account whose learner has logged in and accepted the Course Terms is kept on the section 10 timetable for account details.
3A.7 If your seat is moved or you leave the buyer. (Course Terms clauses 13.10 and 13.10A.) If your seat is moved to someone else, or the buyer's key contact asks us to close your account because you have left the buyer, we close your account by suspending it at once. Your access ends that day, and the account is never reused for another person. If you logged in and accepted the Course Terms, your information is then deleted or de-identified on the retention timetable in section 10, counted from that date. If your account was set up from a learner list and you never logged in and accepted the Course Terms, we delete it within 30 days. You may ask us to delete your information sooner (section 9) unless we must keep it by law.
3A.8 Your rights. You have the rights in section 9 whether or not you sign up. You may object to receiving the invitation, and we then delete your details and tell the buyer only that the seat is free to give to someone else. Contact our Information Officer (the Director) at info@aitronetix.com.
3A.9 Security and where the details are kept. The safeguards in section 11 apply. Staff lists sent by email are loaded onto the learning platform (section 6) and then deleted from our mailbox. We delete a learner list file within 30 days after the accounts on it are created.
4. Do you have to give it?
Yes, your name and email address are required to create an account and to issue a certificate. Without them we can't give you access. Everything else the platform records automatically as you use it. Marketing consent is optional.
Quizzes are marked automatically. If you think a mark is wrong, ask us and a person will review it (POPIA s71).
5. Who else handles it
We share your information only with these service providers (operators), and only as needed. Each must keep it confidential and secure under a written agreement, as POPIA sections 20 and 21 require.
| Provider | What it does | Where |
|---|---|---|
| Hostinger | Hosts the learning platform (Moodle) and its database on our virtual private server | United Kingdom |
| Cloudflare | DNS and proxy provider for aitronetix.com. It handles website traffic data, such as IP addresses and request details. | United States |
| Resend (Plus Five Five, Inc.) | Sends the Academy's transactional email, such as account, password, enrolment and course notices, including login details for accounts set up from a learner list | United States |
| PayFast | Processes your payment. PayFast handles card and bank details on its own payment page, under its own terms and privacy policy. | South Africa |
We may also disclose information where the law requires it. A business that bought your seat sees only what section 3A.5 describes. We don't give a buyer's staff list to anyone else.
6. Transfers outside South Africa (POPIA section 72)
The learning platform (Moodle) runs on our virtual private server with Hostinger in the United Kingdom, so your Academy information, including invitation details from a business buyer, is stored there. Hostinger is a company in the European Union (Lithuania) and is bound by the GDPR. We rely on POPIA s72(1)(a) on two grounds: Hostinger is subject to law that gives an adequate level of protection, substantially similar to POPIA (GDPR level), and it is bound by a binding agreement with us, Hostinger's data processing agreement.
Cloudflare, in the United States, provides DNS and proxy services for aitronetix.com and handles website traffic data. It is bound by its data processing agreement with us, which includes standard contractual clauses (a binding agreement under s72(1)(a)).
Resend (Plus Five Five, Inc.), in the United States, sends the Academy's transactional email, so your name, email address and the content of those emails pass through it. It is bound by its data processing agreement with us, which includes standard contractual clauses (a binding agreement under s72(1)(a)).
7. Certificate check
Anyone who has your certificate ID can check it at academy.aitronetix.com/verify. The check shows only your name, the course, the completion date and the certificate ID. It can't be searched by name, and it doesn't show your marks, email or any other detail. You can ask us to switch it off for your certificate.
8. Marketing (POPIA section 69)
We send you marketing by email or other electronic messages only if you ticked the optional marketing box at checkout or in your profile (it is never pre-ticked). If you don't tick it, we don't send you marketing. This also applies if a business bought your seat: only your own tick counts, never your employer's.
Every marketing message names us and contains a free, simple way to opt out. You can also withdraw your consent at any time in your profile or by emailing info@aitronetix.com. Once you opt out, we stop and keep only your name and email on a do-not-contact list. Messages about your course, your account or your order are not marketing and still reach you.
9. Your rights
You may:
- ask whether we hold information about you and get a copy of it (s23);
- ask us to correct or delete information that is inaccurate, out of date, incomplete, misleading or no longer needed (s24);
- object to our use of your information based on legitimate interests (s11(3)(a)), including the certificate check, and object to marketing at any time (s11(3)(b));
- withdraw your consent at any time (this doesn't affect what we did before);
- ask for a person to review an automatically marked result (s71);
- bring a civil claim for a breach of POPIA (s99).
These rights also apply if a business gave us your details, even if you never sign up (section 3A.8).
Email your request to info@aitronetix.com. We may ask you to prove your identity first. Our PAIA manual explains how to request records.
10. How long we keep it (POPIA section 14)
| Information | How long | Why |
|---|---|---|
| Account details | Until 12 months after your access ends, then the account is deleted | So you can sign in to download your certificate and raise questions |
| Detailed quiz and assessment answers | 12 months after your access ends | To review marks and handle questions. After that we keep only the result summary (below). |
| Learner record: enrolment, completion, results summary (marks, attempts, dates) | 7 years after completion, or after your access ends if you didn't complete | To confirm completion, respond to CPD audits and handle disputes (Prescription Act 68 of 1969 s11(d): a 3-year claim period, with a buffer for delayed knowledge or interruption) |
| Certificate records, and the public certificate check | 7 years after the certificate is issued | So the certificate can be verified, and for disputes |
| Payment and invoice records | 7 years | Tax Administration Act s29; Companies Act s24 |
| Logs | 12 months | Security and investigating incidents |
| Support messages and complaints | 3 years after the last contact, or until a dispute is finally resolved | Prescription Act s11(d) |
| Accounts created without payment | 12 months after creation | POPIA s14(1) |
| Invitation details from a business buyer (name and work email) for a seat nobody redeemed | Deleted within 30 days after the seat expires or is moved to someone else, or sooner if the buyer or you ask | POPIA s14(1): no longer needed |
| Learner list accounts (method B) whose learner never logged in and accepted the Course Terms | Suspended when the seat expires (23:59 SAST on the date 3 years after we confirmed the seats to the buyer in writing), or at once when the seat is moved to someone else or the buyer asks us to close the account (Course Terms clauses 13.10 and 13.10A), then deleted within 30 days. Accounts whose learner logged in and accepted the Course Terms follow the account details row above. | POPIA s14(1): no longer needed |
| Learner list files from a business buyer (method B) | Deleted within 30 days after the accounts on the list are created | POPIA s14(1): no longer needed |
| Business order details, and records of the sign-up key and which seats were redeemed, when and by which account | 7 years after the order | Tax Administration Act s29; Companies Act s24; accounting for seats and refunds |
| Marketing consent and opt-outs | Until you withdraw consent. After an opt-out, only your name and email on a do-not-contact list. | POPIA s11(3)(b), s69 |
| Backups (when in place) | Encrypted and overwritten within 30 days | Restoring the platform after a failure |
When a period ends, we delete the information or de-identify it so it no longer identifies you. Information involved in a dispute, audit or investigation is kept until it is finally resolved.
11. Security (POPIA section 19)
We use encrypted connections (HTTPS), multi-factor authentication for administrators, access limited to people who need it and regular security updates. When we put backups in place, we will encrypt them. Sign-up keys are random, work only for the seats bought, and can be reset at once if they leak. Staff lists from business buyers are kept only on the platform and deleted from our mailbox once loaded. Login emails for accounts set up from a learner list carry either a temporary password that must be changed at first login or a set-password link. If we believe your information has been accessed by someone without authority, we'll tell you and the Information Regulator, as POPIA s22 requires.
12. Complaints
Please contact us first at info@aitronetix.com so we can try to put things right. If you're not satisfied, you may complain to the Information Regulator:
- online through its eServices portal, linked from www.inforegulator.org.za; or
- by email to POPIAComplaints@inforegulator.org.za.
13. Changes
We may update this notice. The version and date are shown at the top. We'll tell active learners about any important change.