This Privacy Policy sets out the manner in which personal information is processed in connection with your use of the ScaleEd digital learning platforms. It is intended to provide a clear and accurate account of the categories of personal information processed, the purposes of such processing, the safeguards applied to it, and the rights available to you as a data subject.
ScaleEd is a learning solution provided by Philanthrosoft (Pty) Ltd, a private company incorporated in the Republic of South Africa ("Philanthrosoft", "we", "us" or "our"). Our registered address is Sandton, Johannesburg, South Africa, 2090.
All processing of personal information described in this policy is undertaken in accordance with the Protection of Personal Information Act, 2013 (Act 4 of 2013) ("POPIA"), being the data protection law of the Republic of South Africa.
Philanthrosoft acts at all times as an "operator" (processor) under POPIA. In that capacity, Philanthrosoft processes learners' personal information solely on behalf of, and on the documented instructions of, the business customer that provides the learning platform on which you are registered. That business customer is the "responsible party" under POPIA and, as such, determines which categories of personal information are processed and the purposes for which they are processed. Philanthrosoft does not determine those purposes.
The responsible party may maintain its own privacy notice, which governs the processing of your personal information and may also apply to you. This policy describes the practices and obligations of Philanthrosoft in its capacity as operator, and should be read together with any privacy notice issued by the relevant responsible party.
Should you have any questions concerning this policy, you may contact Philanthrosoft using the details set out in Section 12.
This policy is addressed to adult learners and end users aged 18 years or older. The ScaleEd platforms are not intended for use by children, and personal information is not knowingly processed in respect of any individual under the age of 18.
2. Categories of personal information processed
Processing is limited to the personal information reasonably required to establish a learner account and to make the learning platform available to you. The categories of personal information processed comprise:
a. your first name;
b. your last name;
c. your personal email address;
d. your gender;
e. your age;
f. your learning progress and course activity, including the courses and lessons undertaken and your progression through them; and
g. your quiz and assessment results.
You may, at your election, add a profile photograph or avatar to your account. The provision of such an image is entirely optional; the platform may be used in full without it. Where you elect to upload a profile photograph or avatar, it will be stored and displayed as part of your learner profile.
3. Sources of personal information
Personal information is obtained in the following ways:
a. Directly from you: upon registration of an account, completion of your profile, or sign-in. This includes the particulars you provide, such as your name, email address, gender, age, and any optional profile photograph or avatar.
b. Automatically through your use of the platform: as you undertake courses, complete lessons, and attempt quizzes and assessments, the platform records your learning progress, course activity, and results.
4. Purposes of processing and lawful basis under POPIA
The purposes for which your personal information is processed, as determined by the responsible party, are the following:
a. the creation and registration of your account;
b. your authentication and the verification of your identity upon sign-in;
c. the operation and delivery of the learning platform, including the provision of access to courses, the tracking of learning progress, and the recording of quiz and assessment results; and
d. communication with you in relation to your account and the platform.
POPIA prescribes eight conditions for the lawful processing of personal information, which require, among other matters, that personal information be processed lawfully and reasonably, collected for a specified purpose, used only for that purpose, kept accurate, processed transparently, maintained securely, and processed with due regard to the rights of data subjects. Philanthrosoft gives effect to these conditions in the performance of its functions as operator.
The lawful basis for the processing of your personal information is determined by the responsible party and not by Philanthrosoft. Depending on the platform and the circumstances, the responsible party may rely upon one or more of the following: your consent; the necessity of the processing for the conclusion or performance of a contract to which you are a party; or the legitimate interests of the responsible party, balanced against your rights. Philanthrosoft processes personal information only on the documented instructions of the responsible party and does not independently determine the purposes of, or the lawful basis for, such processing.
5. Consent
The establishment of the lawful basis for processing, including the obtaining and management of any consent that may be required, is the responsibility of the responsible party. Where consent is relied upon, the responsible party is responsible for obtaining it and for managing any subsequent withdrawal of it. Philanthrosoft gives effect to the instructions of the responsible party in this regard. Should you wish to withdraw any consent, or to raise any query concerning the basis of processing, you may contact Philanthrosoft using the details in Section 12, and your request will be referred to and dealt with by the responsible party. The withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal. Where consent that is necessary for the provision of the platform is withdrawn, it may no longer be possible to provide you with access to some or all of the platform.
6. Storage and security of personal information
Philanthrosoft attaches considerable importance to the protection of personal information. In accordance with section 19 of POPIA, Philanthrosoft applies appropriate, reasonable technical and organisational measures to safeguard personal information against loss, damage, unauthorised access, and unlawful processing.
Such measures include, where appropriate:
a. restricting access to personal information to those persons who require it for the performance of their functions;
b. employing access controls, such as passwords and authentication mechanisms, to protect accounts;
c. protecting personal information in transit and in storage through appropriate security safeguards, including encryption;
d. engaging reputable service providers who are required to maintain the security of personal information; and
e. reviewing security practices periodically in order to keep them current.
Notwithstanding the measures taken to protect personal information, no method of transmission or storage can be guaranteed to be entirely secure. In the event that Philanthrosoft becomes aware of a security compromise affecting personal information, it will respond as required by POPIA, which may include the notification of affected data subjects and of the Information Regulator.
7. Operators and service providers (including cloud providers)
Philanthrosoft does not sell personal information, nor does it disclose personal information to third parties for use by those parties for their own purposes.
Philanthrosoft does, however, engage trusted service providers to assist in the operation of the ScaleEd platforms. Under POPIA, a service provider that processes personal information on behalf of another is itself an "operator". In its capacity as operator, Philanthrosoft engages a cloud hosting provider as a further operator (sub-operator) to host the platform and store data on its behalf. Any such sub-operator may process personal information only on Philanthrosoft's instructions and for the purpose of providing its services, and is required to maintain the confidentiality and security of that personal information.
8. Cross-border transfers of personal information
The cloud hosting provider operates data centres in a number of regions, certain of which are located within Africa and certain of which are located outside Africa. Accordingly, your personal information may be stored or processed in a country other than South Africa.
Wherever personal information is transferred outside South Africa, Philanthrosoft takes steps in accordance with section 72 of POPIA to ensure that it continues to receive an adequate level of protection. Such steps may include ensuring that the recipient is subject to laws, binding corporate rules, or a binding agreement affording a level of protection substantially similar to that provided under POPIA, or reliance upon another basis permitted by section 72, including your consent or the necessity of the transfer for the performance of a contract to which you are a party.
9. Cookies and similar technologies
The ScaleEd platforms may employ cookies and similar technologies (including local storage and comparable identifiers) in order to enable the platform to function correctly, to maintain your session, to retain your preferences, and to understand how the platform is used so that it may be improved.
Certain of these technologies are necessary for the platform to function, whereas others are optional. The cookies and similar technologies used generally fall within the following categories: (a) strictly necessary cookies, which are required to operate the platform, to maintain your session, and to keep your account secure; (b) preference cookies, which retain your settings and choices so that the platform operates as you expect; and (c) analytics cookies, which assist in understanding how learners use the platform so that it may be improved. Strictly necessary cookies cannot be disabled, as the platform will not function correctly without them; optional cookies may, however, be accepted or declined, and your choice may be altered at any time. Cookies may generally be controlled through your browser or device settings, although the disabling of certain cookies may affect the operation of the platform.
10. Retention of personal information
Personal information is retained for no longer than is necessary for the purposes described in this policy, or for such period as is required or permitted by applicable law.
As Philanthrosoft acts as operator, personal information is retained in accordance with the instructions of the responsible party and applicable law. Philanthrosoft will delete or return personal information upon the termination of its services to the responsible party, or upon the instruction of the responsible party to do so. Where personal information is no longer required, it will be securely deleted, destroyed, or de-identified such that it can no longer be linked to you.
11. Your rights as a data subject
Under POPIA, you are entitled to a number of rights in relation to your personal information. These include the right to:
a. obtain confirmation of, and access to, the personal information held about you;
b. request the correction or updating of your personal information where it is inaccurate, out of date, or incomplete;
c. request the deletion or destruction of your personal information in prescribed circumstances;
d. object, on reasonable grounds, to the processing of your personal information; and
e. lodge a complaint with the Information Regulator of South Africa where you consider that your personal information has not been processed in accordance with POPIA.
As Philanthrosoft acts as operator on behalf of the responsible party, requests to exercise the rights referred to in paragraphs (a) to (d) above are to be exercised against the responsible party, which determines how such requests are addressed. Where you direct any such request to Philanthrosoft, Philanthrosoft will refer it to the responsible party and will provide reasonable assistance in connection with it. Your right to lodge a complaint directly with the Information Regulator of South Africa, as set out in paragraph (e) above, is exercisable independently and is unaffected by the foregoing.
12. Exercise of rights and contact details
Should you wish to exercise any of your rights, or to raise any question, concern, or complaint regarding the processing of your personal information, you may contact Philanthrosoft at:
Philanthrosoft's Information Officer is responsible for overseeing its compliance with POPIA and may be contacted at the email address set out above.
Philanthrosoft may be required to verify your identity before acting upon any request, in order to ensure that personal information is not disclosed to any person other than the data subject to whom it relates. Where a request concerns processing undertaken on behalf of a responsible party, it will be referred to that responsible party in accordance with Section 11.
You are further entitled to lodge a complaint directly with the Information Regulator of South Africa. The contact details of the Information Regulator are available on its official website.
13. Amendments to this policy
This policy may be amended from time to time, for example to reflect developments in the law, in technology, or in the manner in which the platform is operated. Where amendments are made, the effective date set out at the head of this policy will be updated and, where appropriate, notice will be given through the platform or by other suitable means. The version of this policy in force is that published on the platform with effect from the effective date shown above.
Effective date: 1 April 2025