Privacy notice

Last updated: 24 October 2026

1. Who we are

RemoteRegister is a South African software platform for learnership attendance, workplace learning, stipend administration and SETA/QCTO evidence. In this notice, “we”, “us” and “RemoteRegister” refer to the operator of the platform.

For personal information submitted through this marketing website, we are the responsible party (controller) under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

When a training provider, employer or other organisation uses the platform to process learner information, that organisation is the responsible party and we act as its operator (processor) under a written agreement. In that case, the organisation's own privacy notice governs its processing, and requests should first be directed to that organisation.

2. Information we collect

2.1 Website visitors

• Technical information needed to serve the site, such as IP address, browser type and requested URL.
• Aggregate, cookieless analytics if analytics is enabled for the site. No advertising identifiers are used.
• Information you volunteer through an enquiry, newsletter or support form.

2.2 Enquiries and newsletter

• Name, work email, organisation, role and optional telephone number.
• The content of your message and the area of interest you select.
• The privacy notice version you accepted and the time of acceptance.
• Whether you opted in to marketing updates, and the time of that choice.
• A pseudonymised network identifier (a salted hash of the IP address) for abuse prevention.

2.3 Platform users

• Account identity, role, tenant, authentication events and session metadata.
• Audit records of compliance-relevant actions, including the actor, time and affected record.
• Support and break-glass records where emergency access is authorised.

2.4 Learner information (when we act as an operator)

• Identity and demographic information, including South African ID number where required for learnership reporting.
• Contact details, programme and cohort enrolment, attendance and leave records.
• Consent records, guardian consent for minors, and 18th-birthday re-consent.
• Workplace learning logbooks and mentor attestations.
• Stipend, banking and tax information required for payment and statutory reporting.
• Biometric templates (ISO/IEC 19794-2) and match decisions, where biometric verification is enabled with consent. We do not store raw fingerprint images.

3. Why we process it and our lawful basis

Purpose	Lawful basis under POPIA
Respond to an enquiry or provide a demo	Consent (s11(1)(a)); steps at your request before a contract
Send newsletter updates	Consent, confirmed by double opt-in; withdrawal at any time
Provide and secure the platform	Performance of a contract; legitimate interests in security and reliability
Learner administration and SETA reporting	Performance of a contract; compliance with legal obligations; consent where required
Biometric verification	Consent, with a lawful alternative where required; special personal information safeguards under ss 26–27
Statutory tax and payroll records	Compliance with legal obligations (SARS, SD5, NMW)
Fraud prevention and audit	Legitimate interests; legal obligations; establishment or defence of legal claims

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out, and may mean we cannot provide a service that depends on that information.

4. Sharing

We share personal information only where necessary:

• With subprocessors that host, secure or support the platform, under written terms.
• With a training provider or employer that is the responsible party for the relevant learner record.
• With identity, bank verification, payout, messaging or LMS providers when the tenant has configured that channel.
• With a SETA, QCTO, SARS or other regulator where the tenant instructs an export or a legal obligation applies.
• With professional advisers or authorities where required by law or to establish or defend legal claims.

We do not sell personal information and we do not share learner data for third-party marketing.

Current subprocessors and their locations are listed in the Trust Centre.

5. Cross-border processing

The platform is governed by South African law. Production compute currently runs on Hetzner in Helsinki, Finland (EU). This means personal information may be processed outside South Africa.

We rely on POPIA section 72, which permits a transfer where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection. The safeguards include the EU General Data Protection Regulation, a data processing agreement with the host, encryption in transit and at rest, tenant-scoped access control, audit logging and a published data-subject request route.

Where a tenant requires a different location or a dedicated data plane, that is a commercial and configuration decision recorded in the tenant agreement. We do not claim South African physical residency for a deployment that does not have it.

6. Retention

• Enquiries: retained for up to 24 months after the last contact, unless a contract or legal obligation requires longer.
• Newsletter: retained until you unsubscribe, plus a suppression record so we do not contact you again.
• Platform records: retained according to the tenant's evidence and statutory retention policy. Learnership and payroll records may need to be kept for several years.
• Audit records: retained as part of the tamper-evident ledger. Deleting an audit entry would break the chain.
• Biometric templates: deleted or rendered unreadable when consent is withdrawn or the enrolment is no longer needed, subject to the tenant's lawful retention obligations.

7. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based and tenant-scoped access, audit logging, rate limiting, secure headers and integrity checks on stored snapshots. No system is perfectly secure; if a breach affects personal information, we follow the POPIA section 22 notification process.

8. Your rights

Subject to applicable law, you may request:

• Confirmation of whether we hold your personal information and access to it.
• Correction or deletion of inaccurate, irrelevant, excessive or unlawfully obtained information.
• Objection to processing based on legitimate interests.
• Withdrawal of consent.
• Information about cross-border transfers and the safeguards applied.

Email [email protected] with enough detail for us to identify you and the record. We may need to verify your identity before acting. If your information is held on behalf of a provider, we may route the request to that provider.

You may also complain to the Information Regulator (South Africa):
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: [email protected]
Website: inforegulator.org.za

9. Cookies

This marketing website does not use advertising cookies. If aggregate analytics is enabled, it is cookieless. The application uses essential cookies for authentication. See the cookie notice for detail.

10. Children

The platform supports learnership learners who may be minors. Where a learner is under 18, the provider must obtain guardian consent as required by POPIA and the Children's Act. The platform records the consent and the re-consent event when the learner turns 18. This marketing website is not directed at children and we do not knowingly collect their information through it.

11. Changes

We may update this notice when the platform or the law changes. The version and date at the top will change, and material changes will be communicated to tenant administrators. Consent records store the version that was accepted.

12. Contact

Information Officer: [email protected]
General enquiries: [email protected]

This notice is a plain-language summary of our processing. It does not replace the data processing agreement between RemoteRegister and a tenant, or legal advice about a specific processing activity.