POPIA Compliance

2.1 Key Definitions

4.1 Accountability

We take responsibility for complying with POPIA:

• Appointed an Information Officer
• Implemented appropriate policies and procedures
• Conduct regular compliance audits
• Train staff on data protection requirements
• Maintain records of all processing activities

4.2 Processing Limitation

We only process personal information when:

• You have provided consent
• It is necessary to fulfill our contract with you
• We have a legitimate interest
• It is required by law

Minimization: We collect only the personal information necessary for the specified purposes.

4.3 Purpose Specification

We collect personal information for the following specific purposes:

4.4 Further Processing Limitation

We will not process your personal information for purposes incompatible with the original purpose unless:

• You have provided consent
• It is necessary for legal proceedings
• It is required by law
• It is for historical, statistical, or research purposes

4.5 Information Quality

We take reasonable steps to ensure personal information is:

• Complete
• Accurate
• Not misleading
• Updated when necessary

You can update your information through the App's profile settings at any time.

4.6 Openness

We are transparent about our data practices:

• This POPIA Compliance Statement is publicly available
• Our Privacy Policy explains data collection and use
• We notify you of any material changes to our practices
• We respond to inquiries about our data practices

4.7 Security Safeguards

We implement appropriate security measures to protect your personal information:

4.8 Data Subject Participation

You have the right to participate in decisions about your personal information (see Section 6 for your full rights).

5.1 Personal Information We Collect

5.2 Special Personal Information

We generally do not collect special personal information as defined by POPIA (such as religious beliefs, political opinions, health information, etc.). If we need to collect such information, we will obtain your explicit consent and explain the purpose.

5.3 Children's Personal Information

• We may process personal information of children (under 18) who are students
• This processing is done with parental/guardian consent
• Parents can access and manage their child's information through linked accounts
• We implement additional safeguards for children's data

6.1 Right to Access (Section 23)

You have the right to:

• Request confirmation of whether we hold your personal information
• Request a description of your personal information
• Obtain a copy of your personal information
• Request information about third parties who have access to your information

How to exercise: Submit a request to privacy@ovcc.africa or through the App's profile settings.

6.2 Right to Correction (Section 24)

You have the right to request:

• Correction of inaccurate personal information
• Completion of incomplete personal information
• Deletion of personal information that is no longer necessary

How to exercise: Update information in the App or contact privacy@ovcc.africa.

6.3 Right to Deletion (Section 24)

You may request deletion of your personal information when:

• It is no longer necessary for the purpose collected
• You withdraw consent
• The processing is unlawful

Note: We may retain certain information as required by law or for legitimate business purposes.

6.4 Right to Object (Section 11(3))

You have the right to object to:

• Processing of your personal information for direct marketing
• Processing based on legitimate interests

How to exercise: Contact privacy@ovcc.africa or adjust settings in the App.

6.5 Right to Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

6.6 Right to Lodge a Complaint

If you believe your personal information has been processed unlawfully, you may lodge a complaint with:

7.1 Operator Agreements

All operators are bound by:

• Written agreements ensuring POPIA compliance
• Appropriate security measures
• Restrictions on further processing
• Confidentiality obligations

7.2 Cross-Border Transfers

When personal information is transferred outside South Africa, we ensure:

• The recipient country has adequate data protection laws, OR
• Binding agreements are in place to protect your information, OR
• You have provided explicit consent for the transfer

9.1 Notification to Information Regulator

We will notify the Information Regulator as soon as reasonably possible.

9.2 Notification to Data Subjects

We will notify affected individuals:

• As soon as reasonably possible after discovery
• With details of the breach and potential consequences
• With information about measures taken
• With recommendations for self-protection

9.3 Documentation

We maintain records of all personal information breaches, including:

• Facts surrounding the breach
• Effects of the breach
• Remedial action taken

10.1 Consent

We will only send you direct marketing communications if:

• You have provided opt-in consent, OR
• You are an existing user and the marketing relates to similar services

10.2 Opt-Out

You can opt out of marketing communications at any time:

• Through the App's notification settings
• By clicking "unsubscribe" in emails
• By contacting privacy@ovcc.africa

11.1 Career Matching

Our career matching feature uses automated processing to:

• Analyze your subject preferences
• Match careers based on your interests
• Provide personalized recommendations

11.2 Your Rights

You have the right to:

• Not be subject to decisions based solely on automated processing that significantly affect you
• Request human intervention in automated decisions
• Express your point of view regarding automated decisions

12.1 Making a Request

To exercise any of your POPIA rights:

1. Email: Send a request to privacy@ovcc.africa
2. In-App: Use the privacy settings in your profile
3. Written Request: Send to our physical address

12.2 Verification

We may need to verify your identity before processing requests.

12.3 Response Time

We will respond to requests within a reasonable time, and no later than:

• Access requests: 30 days
• Other requests: As soon as reasonably practicable

12.4 Fees

We may charge a reasonable fee for:

• Manifestly unfounded or excessive requests
• Requests for additional copies