Legal  ·  South Africa  ·  🇿🇦

South Africa Privacy Notice

Act: Protection of Personal Information Act 4 of 2013 (POPIA)  ·  Version 1.0  ·  Effective: 1 July 2026  ·  Review: July 2027

1. Responsible Party

Under POPIA, the organisation that determines the purpose and means of processing personal information is called the responsible party (equivalent to "controller" under GDPR).

Responsible Party: Exam Mastery International, a division of Nexus Education Group.

Information Officer: The Information Officer is the head of the organisation for POPIA purposes. As required by POPIA (read with PAIA), the Information Officer for Nexus Education Group / Exam Mastery International is designated as the chief executive or equivalent. Contact details are available on request at [email protected].

Contact address for POPIA enquiries:
[email protected]
+44 7454 408219
exammasteryinternational.com

2. Personal Information We Collect

We collect personal information that South African data subjects provide directly to us, including through our website forms, WhatsApp communications, and in the course of delivering educational workshops. This includes:

• Identity information: Full name
• Contact information: Email address, telephone or WhatsApp number
• Educational information: Exam board, qualification level, subject, school or institution name
• Guardian information: Parent or guardian name and contact details where the data subject is a minor
• Professional information: Role, school name, and association affiliation (for school staff and association contacts)
• Technical information: Website usage data collected via cookies and analytics tools (see our Cookie Policy)
• Communication records: Records of correspondence, enquiries, and form submissions

We do not collect special personal information as defined by POPIA (Section 26) — including information relating to religious beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, or criminal records — except where strictly necessary for a stated and lawful purpose, and only with explicit consent.

3. Personal Information of Children

POPIA contains specific provisions for the processing of personal information of children (persons under 18 years of age) under Section 34 and 35. Exam Mastery International provides educational services to students who may be minors. In doing so:

• We collect only the minimum personal information necessary to deliver the educational service
• Where a student is under 18, we require consent from a parent or legal guardian before processing the student's personal information for any purpose beyond delivery of the requested workshop service
• We do not use the personal information of minors for direct marketing purposes
• We do not share the personal information of minors with third parties except where required to deliver the service (e.g. facilitator assignment) or where required by law
• Where we become aware that personal information of a child has been collected without appropriate consent, we will delete it promptly
• Our engagement with minor students in South Africa is conducted with awareness of the Children's Act 38 of 2005 and the obligation to act in the best interests of the child at all times

4. Lawful Basis for Processing (Justification Grounds)

POPIA requires that processing of personal information must be justified by one or more of the conditions set out in Chapter 3. The justification grounds we rely on for our primary processing activities are:

5. The Eight Conditions for Lawful Processing

POPIA Chapter 3 establishes eight conditions that responsible parties must comply with when processing personal information. We are committed to compliance with all eight:

• Accountability: We take responsibility for ensuring that processing complies with POPIA and take appropriate measures to give effect to the conditions.
• Processing limitation: We collect only the personal information that is adequate, relevant, and not excessive in relation to the purpose for which it is collected.
• Purpose specification: We collect personal information for a specific, explicitly defined, and lawful purpose related to our educational services. We inform data subjects of this purpose at the point of collection.
• Further processing limitation: We do not process personal information for a secondary purpose that is incompatible with the original purpose for which it was collected.
• Information quality: We take reasonable steps to ensure that personal information is complete, accurate, not misleading, and updated where necessary.
• Openness: We maintain documentation of our processing activities and make this privacy notice publicly available. We inform data subjects about our processing at the point of collection.
• Security safeguards: We implement appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised access, disclosure, alteration, or destruction. All facilitators with access to student data are subject to confidentiality obligations.
• Data subject participation: We respect and facilitate data subjects' rights to access, correct, and object to the processing of their personal information, as set out in Section 6 of this notice.

6. Your Rights as a South African Data Subject

Section 5 of POPIA grants South African data subjects the following rights. You may exercise any of these rights by contacting us at [email protected]:

• Right to be notified (Section 18): The right to be informed that your personal information is being collected and about the purpose for which it is being collected.
• Right of access (Section 23): The right to request confirmation of whether we hold personal information about you, and to obtain a copy of that information.
• Right to correction or deletion (Section 24): The right to request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
• Right to object (Section 11(3)): The right to object, on reasonable grounds relating to your particular situation, to the processing of your personal information.
• Right to object to direct marketing (Section 69): The right to object at any time to the processing of your personal information for the purpose of direct marketing by means of unsolicited electronic communications.
• Right not to be subject to automated decision-making (Section 71): The right not to be subject to a decision based solely on the automated processing of personal information which produces legal or similarly significant effects.
• Right to submit a complaint (Section 74): The right to submit a complaint to the Information Regulator if you believe your rights under POPIA have been violated.
• Right to civil action (Section 99): The right to institute civil proceedings for damages against a responsible party for any interference with your personal information, regardless of intent or negligence.

We will respond to any data subject request within a reasonable time and in accordance with the timelines prescribed by POPIA. We will not charge a fee for standard requests unless the request is manifestly unfounded or repetitive.

7. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

• To respond to enquiries submitted through our website forms or WhatsApp
• To arrange and deliver free trial workshops and ongoing Masterclasss
• To match students with appropriately qualified facilitators
• To communicate with parents or guardians regarding their child's participation
• To communicate with school staff and association contacts about partnership arrangements
• To process affiliate and facilitator applications
• To send educational resources and updates (where you have consented or are a current service user)
• To comply with legal and safeguarding obligations
• To improve our services and website through analytics

8. Sharing of Personal Information

We do not sell personal information. We share personal information only where necessary and only with:

• Facilitators: Assigned facilitators receive the minimum personal information necessary to conduct a Masterclass (student first name, subject, and qualification level). Full contact details are not shared without explicit consent.
• Service providers (operators): We use third-party platforms including Cloudflare (hosting and security), Resend (transactional email), and Turnstile (bot protection). These providers process personal information on our behalf as operators under POPIA and are subject to appropriate data processing agreements.
• Legal or regulatory authorities: Where required by South African or UK law, a court order, or a legitimate request from a regulatory body including the Information Regulator.
• Safeguarding authorities: Where we have reasonable grounds to believe that a child is at risk of abuse or harm, we may share information with the relevant South African authorities in fulfilment of our obligations under the Children's Act 38 of 2005.

9. Cross-Border Transfers of Personal Information

POPIA Section 72 regulates the transfer of personal information to third parties in foreign countries. As EMI is operated from the United Kingdom, personal information collected from South African data subjects is transferred to and processed in the UK.

This transfer is lawful under Section 72 because:

• The United Kingdom has the UK GDPR and the Data Protection Act 2018 in force, which provide a level of protection for personal information that is substantially equivalent to the conditions for lawful processing under POPIA; and
• The transfer is necessary for the performance of a contract between the data subject and EMI (the provision of educational workshop services), or for the implementation of pre-contractual measures taken at the request of the data subject.

We do not transfer personal information to any country other than the United Kingdom without separately assessing adequacy or obtaining appropriate safeguards.

10. Retention of Personal Information

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by applicable South African or UK law. In general:

• Enquiry and contact records: up to 2 years from last contact
• Workshop participant records: up to 3 years from the date of the last workshop
• Financial and contractual records: as required by applicable law (typically 5–7 years)
• Safeguarding records involving minors: retained in accordance with South African safeguarding guidance, which may require longer retention periods

11. Security of Personal Information

We take the security of personal information seriously. Our technical and organisational measures include:

• All website data is transmitted over HTTPS (TLS encryption)
• Form submissions are processed via Cloudflare Workers with bot protection (Turnstile)
• Email communications are delivered via Resend with DKIM authentication
• Access to personal information is restricted to authorised staff and facilitators on a need-to-know basis
• All facilitators are required to maintain confidentiality of student information

In the event of a data breach that is likely to cause harm to a data subject, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, in accordance with Section 22 of POPIA.

12. Direct Marketing

We will only send unsolicited electronic communications (email, WhatsApp, SMS) to South African data subjects where we have obtained prior consent, or where you are an existing service user and the communication relates to similar services. You may opt out of any direct marketing communication at any time by contacting us at [email protected] or by following the unsubscribe instruction in any marketing email. We will action opt-out requests promptly and at no cost to you.

13. The Information Regulator

The Information Regulator is the independent body established by POPIA to enforce compliance with the Act and to protect the personal information rights of South African data subjects. If you believe that your rights under POPIA have been violated and you are not satisfied with our response to your complaint, you have the right to submit a complaint directly to the Information Regulator.

14. PAIA (Promotion of Access to Information Act)

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information held by private bodies where such information is required for the exercise or protection of rights. As EMI provides services in South Africa, we acknowledge our obligations under PAIA. A PAIA manual in the prescribed form is in preparation and will be published on this page. In the interim, any request for access to information held by EMI may be directed to our Information Officer at [email protected].

15. Changes to This Notice

We may update this notice from time to time to reflect changes in our processing activities, changes in South African law, or guidance from the Information Regulator. Where changes are material, we will notify affected data subjects by email or by a prominent notice on our website. The version and effective date at the top of this notice always reflect the current version.

16. Contact Us

For any questions about this notice, to exercise your rights under POPIA, or to lodge a complaint with EMI, please contact us: