Privacy and Data Protection Policy

1. Responsible party

Zithande ZA, trading as Zithande, is the responsible party for the personal information described in this Policy because it determines why and how that information is processed.

Registration number: 2022/550869/07 Physical or business address: 47 Sihlangene Circle, KwaDabeka, Pinetown, KwaZulu-Natal, 3610 Information Officer: Mirriam Thubelihle Sibisi Privacy email: info@zithande.co.za Support email: info@zithande.co.za Website: https://www.zithande.co.za

2. Who may use the Platform

The Stage 1 Platform is intended only for people aged 18 or older. We ask each user to confirm that they are at least 18 and record the confirmation, date, time and policy version. We do not intentionally collect personal information from children through this adult Platform. The separate Teenage Girls programme will require its own age-appropriate privacy, consent and safeguarding arrangements before it is made available digitally.

If we reasonably believe an adult Platform account belongs to a person under 18, we may suspend the account, restrict further collection and take reasonable steps to delete or lawfully retain only what is necessary for security, compliance and record purposes.

3. Personal information we collect

Account and identity information includes your first name, surname, verified email, sign-in method, account identifier, and verification and recovery records.

Eligibility and permission information includes your 18-plus confirmation; Terms, Privacy Policy and permission versions; dates, times, withdrawals and channel choices.

Profile and demographic information includes your age band, gender, country, South African province, preferred language, employment status and how you heard about Zithande.

Assessment information includes answers across eight compulsory areas and any selected Career or Entrepreneurship areas, together with the assessment version, status and completion records.

Journey activity includes results, saved recommendations, Reset actions, completion dates, optional reflections, reassessment responses and progress.

Communications information includes email and push preferences, in-app messages, delivery status, opens or clicks where enabled, support correspondence and waitlist status.

Technical and security information may include IP address, device or browser information, timestamps, session and authentication events, error logs, audit logs and suspected misuse.

Privacy request information includes access, correction, copy, objection, withdrawal and deletion requests, identity verification and outcomes.

We do not collect a telephone number or full date of birth in Stage 1. Please do not include unnecessary identifying, medical or confidential third-party information in optional reflections or support messages.

4. Sensitive and wellness-related information

Some assessment answers may reveal information about your physical, emotional, mental, spiritual, social or financial wellbeing. Depending on its content and context, some information may qualify as special personal information or otherwise require heightened protection under the Protection of Personal Information Act 4 of 2013, known as POPIA.

The Platform processes the information you submit to provide assessment results, approved recommendations, the 7-Day Reset and reassessment as described in these service terms and this Policy. You may stop using the service or request deletion, although this does not invalidate lawful processing already performed and some records may be retained where the law permits or requires it.

5. How we collect information

We collect information directly from you when you register, complete your profile or assessment, choose preferences, record progress, submit a reflection, join a waitlist or contact us. We also collect necessary security, session, audit and diagnostic information automatically from your use of the Platform.

When you choose third-party sign-in, we receive limited information from the authentication provider to verify and create or connect your account. We receive information from an employer, sponsor or programme partner only where you have been informed, the disclosure is lawful and the information is needed for an authorised programme or entitlement.

6. Purposes and lawful grounds

We process personal information only where a lawful ground applies. Depending on the activity, this may be your consent, performance of the Platform agreement, compliance with a legal obligation, protection of a legitimate interest pursued by you, Zithande or a third party, or another ground permitted by POPIA.

We use necessary account, profile, assessment and activity information to register and verify users, prevent duplicate accounts, provide selected assessment areas, calculate results, generate mapped recommendations, track Reset progress, unlock a reassessment, maintain history and answer support requests. Without required information, we may be unable to provide the relevant service.

We use appropriate technical and account information to authenticate users, recover accounts, detect misuse, investigate incidents, preserve audit trails, administer preferences, maintain the Platform, correct errors and establish or defend legal rights.

Where you opt in when required, we may analyse assessment, demographic and engagement information to evaluate the pilot, improve approved content and understand patterns. Wherever reasonably possible, this work uses aggregated or de-identified information. Declining optional research consent does not block the core assessment.

Email marketing, Zithande marketing and sponsor or partner marketing choices are optional and unticked by default. You may withdraw a choice at any time through your permissions or the unsubscribe method in a message. Withdrawal does not stop essential account, security or service communications.

7. Automated processing and personalisation

The Platform automatically scores answers using version-controlled rules, labels life areas, identifies priority areas and selects approved recommendations and Reset actions from pre-approved mappings. It does not use open-ended artificial intelligence to generate assessment actions during the pilot. These outputs support personal reflection and do not constitute a medical diagnosis or a decision that produces legal or similarly significant effects.

8. Sharing and recipients

We do not sell personal information. We may share only what is reasonably necessary with service providers acting under appropriate confidentiality and data-processing terms; professional advisers, auditors, insurers or authorities where reasonably necessary and lawful; a successor in a legitimate restructuring or transfer subject to safeguards; and a sponsor, employer or programme partner only as described below or where another lawful ground applies.

Aggregated sponsor reporting uses grouped counts, percentages, medians or averages and minimum group-size suppression to reduce re-identification risk. Aggregated reports should not identify you.

We will not provide identifiable assessment responses or journey information to a sponsor, employer or partner merely because it funded or referred a programme. Sharing your name and verified email for a sponsor or partner’s own direct marketing requires a clear, separate, unticked permission. Refusing this permission does not block the free assessment.

9. International transfers

Some service providers may store or access information outside South Africa. Before transferring personal information to another country, we will use a mechanism permitted by POPIA, assess the nature of the information, destination and safeguards, and limit transfers to what is necessary.

10. Retention

We retain personal information only for as long as reasonably needed for the purpose collected, an applicable contract, legal or regulatory obligations, dispute periods, security, fraud prevention and legitimate recordkeeping. Active account, profile, assessment and journey records are retained while the account remains active and as needed to provide the service.

After a verified deletion request, account data is deleted or irreversibly anonymised once operational dependencies are completed, subject to lawful exceptions. Consent, Terms acceptance, security and deletion audit records may be retained for a period reasonably necessary to demonstrate compliance and resolve disputes. Backups are removed through the normal secure backup-rotation cycle. Aggregated or irreversibly de-identified information may be retained because it no longer identifies an individual.

11. Security

We use reasonable and appropriate organisational and technical safeguards considering the sensitivity, volume and risks of the information. Measures may include access controls, least-privilege administration, secure authentication, encryption where appropriate, logging, backups, supplier controls, vulnerability management, staff confidentiality and incident-response procedures. No online system is completely risk-free.

12. Security compromises

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will investigate, contain and document the incident and notify the Information Regulator and affected people where POPIA requires this.

13. Your rights and choices

Subject to POPIA and other applicable law, you may ask whether we hold personal information about you and request access to it; ask us to correct, update, complete, delete or destroy qualifying information; object to processing where the law permits; withdraw consent for future processing where consent is the basis; change optional research, sponsor-marketing and Zithande marketing choices; request an available copy of your information; and complain to us or the Information Regulator.

Submit a request through your settings where available or email info@zithande.co.za. A self-service download is not currently available. We may take reasonable steps to verify identity and authority before acting and will explain any lawful limitation or refusal.

14. Cookies, local storage and similar technologies

The web-based Platform may use cookies, browser storage or similar technologies necessary for sign-in, security, session continuity, saved preferences and core functionality. Optional analytics or marketing technologies, if introduced, will be disclosed and controlled separately where required.

15. Communications and notification preferences

Account verification, password recovery, security alerts, Reset status, reassessment availability and material service notices may be necessary to operate your account. Other reminders, achievements, paid waitlist updates, general marketing and optional push notifications are controlled through preferences or permission choices.

16. Third-party links and sign-in

If you follow an external link or use a third-party sign-in service, that provider may process information under its own privacy policy. We receive only the information needed for the chosen connection and do not control the independent processing of external websites or services.

17. Changes to this Policy

We may update this Policy when the Platform, service providers, processing activities or law changes. The updated Policy will show a new version and effective date. We will provide reasonable notice of material changes and request fresh acceptance where required. Earlier versions and acceptance records may be retained for compliance.