Privacy Policy & POPIA Compliance

1. Introduction

VARSITORIUM (Pty) Ltd ("VARSITORIUM", "we", "our", or "us") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and any other applicable South African legislation.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website at varsitorium.com, enrol in our programmes, or engage with our services.

By using our website or submitting your personal information to us, you acknowledge that you have read and understood this policy.

2. Responsible Party

3. Information We Collect

We collect personal information only where necessary and relevant to the purposes described in this policy. This may include:

• Identity information: Full names, surname, ID number or passport number
• Contact information: Email address, phone number, WhatsApp number
• Address information: Physical address, suburb, city, postal code, province, country
• Account payer information: Where a third party is paying for a programme, their identity and contact details
• Programme information: Programme of interest, preferred intake date, selected payment option
• Parent or guardian information: Where a learner is a minor enrolled in VARSITORIUM School, we may collect information about the parent or guardian
• Usage data: Pages visited, time spent on site, browser type, and similar technical data collected through cookies or server logs

We do not collect sensitive personal information (as defined in POPIA) unless specifically required and with your explicit consent.

4. How We Use Your Information

We use your personal information for the following purposes:

• Processing your enrolment in a VARSITORIUM programme
• Communicating with you about your application, intake, and study material
• Sending you programme factsheets or information packs you have requested
• Responding to your enquiries submitted via our contact form
• Sending relevant updates about programmes, new offerings, or important notices
• Complying with our legal obligations
• Improving our website and services through aggregated, anonymised usage data

We will not use your personal information for purposes other than those described above without your prior consent.

5. Lawful Basis for Processing

We process your personal information on the following grounds under POPIA:

• Consent: Where you have voluntarily submitted your information through our forms
• Contractual necessity: Where processing is required to fulfil our obligations under an enrolment agreement
• Legitimate interest: Where processing is necessary for our legitimate business purposes, provided your rights are not overridden
• Legal obligation: Where processing is required to comply with applicable South African law

6. Sharing of Information

We do not sell, rent, or trade your personal information to third parties. We may share your information with:

• Service providers: Third-party providers who assist us in operating our website, sending communications, or administering programmes — only to the extent necessary and subject to confidentiality obligations
• Payment processors: Where you make a payment, your financial information is processed by our payment partner directly and is not stored by VARSITORIUM
• Regulatory authorities: Where required by law or legal process

All third parties with whom we share personal information are required to treat it with the same level of protection we apply.

7. Data Retention

We retain your personal information for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

• Enrolment records are retained for a minimum of five years after the conclusion of a programme
• Contact and enquiry records are retained for two years unless a continuing relationship develops
• Financial records are retained for seven years in compliance with South African tax legislation

Once personal information is no longer required, we will securely delete or anonymise it.

8. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

• Access: Request confirmation of whether we hold your personal information and obtain a copy
• Correction: Request that we correct or update inaccurate or incomplete information
• Deletion: Request deletion of your personal information in certain circumstances
• Objection: Object to the processing of your personal information
• Restriction: Request that we restrict processing of your information pending resolution of an objection
• Complaint: Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact us at info@varsitorium.com. We will respond within a reasonable period and in accordance with POPIA.

9. Security

We implement reasonable technical and organisational security measures to protect your personal information against unauthorised access, loss, destruction, or alteration. These include encrypted connections (SSL/TLS), access controls, and regular security reviews.

While we take all reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA.

10. Cookies

Our website uses cookies — small text files stored on your device — to improve your browsing experience. We use:

• Essential cookies: Required for the website to function correctly. These cannot be disabled.
• Analytics cookies: Help us understand how visitors use our site, so we can improve it. These are only set with your consent.

You can control cookies through your browser settings. Disabling non-essential cookies will not affect your ability to use our website.

11. Children's Privacy

VARSITORIUM School enrols learners from Grade 1 (age 6) upward. Where a learner is under 18, we collect and process personal information only with the consent of a parent or legal guardian, who is responsible for providing accurate information and for managing the learner's participation.

We do not knowingly collect personal information from minors without appropriate parental or guardian consent.

12. Contact & Complaints

If you have any questions about this policy, wish to exercise your rights, or want to raise a concern about how we handle your personal information, please contact our Information Officer:

We will acknowledge your request within 3 business days and aim to resolve all matters within 30 days.

If you are not satisfied with our response, you have the right to escalate your complaint to the Information Regulator of South Africa (details above).