Skip to content

Privacy Policy

Last updated: 13 December 2024

Introduction

skillSYMS (Pty) Ltd ("skillSYMS", "we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our skills ecosystem management platform and related services.

This policy applies to all users of skillSYMS, including training providers (SDPs), employers, assessors, moderators, learners, and administrators.

By using skillSYMS, you consent to the practices described in this Privacy Policy and our compliance with the Protection of Personal Information Act (POPIA).

Information We Collect

Information You Provide

We collect information you provide directly to us, including:

  • Account Information: Name, email address, phone number, organization name, role
  • Learner Information: Full name, South African ID number, date of birth, contact details, educational history
  • Programme Information: Enrolment details, assessment records, moderation results, competency achievements
  • Evidence Files: Documents, images, and other files uploaded as portfolio of evidence
  • Communications: Support requests, feedback, and correspondence with us

Information Collected Automatically

When you use our platform, we automatically collect:

  • Usage Data: Pages visited, features used, actions performed
  • Device Information: Browser type, operating system, IP address
  • Audit Logs: Timestamps, user actions, data changes (for compliance purposes)

How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process learner registrations and enrolments
  • Manage assessment and moderation workflows
  • Generate QCTO-compliant data exports and reports
  • Issue Statements of Results and certificates
  • Send notifications about programme progress and deadlines
  • Maintain audit trails for QCTO compliance
  • Provide customer support
  • Detect and prevent fraud or security issues
  • Comply with legal obligations

Data Sharing and Disclosure

We may share your information in the following circumstances:

  • With Your Organization: Training providers, employers, and assessors within your tenant can access relevant learner and programme data
  • QCTO and SETAs: We generate data exports for submission to the Quality Council for Trades and Occupations and relevant Sector Education and Training Authorities, as required by law
  • Service Providers: We use trusted third parties for hosting (Cloudflare), notifications (WhatsApp via chatSYMS), and other services. These providers are bound by data processing agreements
  • Legal Requirements: We may disclose information when required by law, court order, or to protect our rights

We do not sell your personal information to third parties.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • Role-based access controls
  • Secure authentication with optional MFA
  • Regular security assessments
  • Comprehensive audit logging
  • South African ID number masking and encryption
  • Data hosted on Cloudflare's secure infrastructure

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Specifically:

  • Learner Records: Retained for the duration required by QCTO and SETA regulations (typically 5-7 years after programme completion)
  • Audit Logs: Retained for 7 years for compliance purposes
  • Account Data: Retained while your account is active, then for 2 years after account closure
  • Support Communications: Retained for 3 years

You may request deletion of your data subject to our legal retention obligations. See "Your Rights" below.

Your Rights

Under POPIA, you have the right to:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information (subject to legal retention requirements)
  • Object: Object to processing of your personal information in certain circumstances
  • Restriction: Request restriction of processing in certain circumstances
  • Portability: Receive your data in a structured, commonly used format
  • Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, contact our Information Officer at privacy@skillsyms.com.

If you are a learner, some requests may need to be processed through your training provider or employer.

Cookies and Tracking

We use essential cookies to enable core functionality of our platform. For details on our cookie practices, please see our Cookie Policy.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

Your continued use of skillSYMS after changes are posted constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

skillSYMS (Pty) Ltd
Information Officer
1 Amarand Avenue, Waterkloof Glen
Pretoria 0081, South Africa
privacy@skillsyms.com
+27 12 881 7331

You may also lodge a complaint with the Information Regulator of South Africa:
www.justice.gov.za/inforeg