Privacy Policy

Effective date: 23 September 2026
Last updated: 23 September 2026
Version: 1.0

1. Who we are and what this policy covers

Naleli Innovations (Pty) Ltd ("Naleli", "we", "us" or "our") respects your privacy and is committed to processing personal information lawfully, reasonably, transparently and securely.

This Privacy Policy explains how we collect, use, store, share, protect and otherwise process personal information when you use Naleli websites, platforms, learning services, business services and related products (collectively, the "Services"), including, where applicable:

• naleli.co.za and related Naleli websites;
• NIBS learning services and NIBS Campus;
• learning and support at the NIBS Katlehong campus (Katlehong Computer School);
• course, programme and career-pathway enrolment;
• the NIBS Skills Passport and public credential-verification services;
• the NIBS Workplace Lab;
• e-Learning Cafe services;
• organisation and employer services;
• support, contact, registration and enquiry forms;
• payment, billing and order-processing services; and
• related mobile, web, portal, API or communication services operated by Naleli.

Where another Naleli service has a more specific privacy notice, that notice may apply together with this Privacy Policy.

For purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), Naleli is generally the responsible party where it determines why and how personal information is processed. In some business-to-business, funded, employer or partner arrangements, Naleli may instead act as an operator on behalf of another responsible party. Where that applies, the relevant agreement or programme notice will explain the relationship.

2. South African privacy framework

This policy is intended to support compliance with applicable South African law, including:

• the Protection of Personal Information Act 4 of 2013 (POPIA);
• the Promotion of Access to Information Act 2 of 2000 (PAIA);
• the Electronic Communications and Transactions Act 25 of 2002 (ECTA), where applicable;
• the Consumer Protection Act 68 of 2008, where applicable; and
• other laws that may apply to a particular service, transaction, record, programme or contractual relationship.

Naleli applies the POPIA conditions for lawful processing, including accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data-subject participation.

3. Personal information we may collect

The information we collect depends on how you use the Services.

3.1 Account and identity information

When you register, enquire, create an account or participate in a programme, we may collect:

• full name;
• email address;
• mobile or telephone number;
• username or learner reference;
• password in securely protected form;
• account settings and preferences;
• province, city or general location;
• date of birth or age where required for eligibility;
• identity or passport information where lawfully required for enrolment, assessment, certification, funded programmes, verification or regulatory purposes; and
• authentication and account-security information.

We aim to collect identity documents only where they are genuinely necessary.

3.2 Learner and academic information

When you use NIBS, including at the NIBS Katlehong campus, or another Naleli learning service, we may process information such as:

• programmes and courses enrolled in;
• module and lesson progress;
• assignment, quiz and assessment activity;
• submissions and resubmissions;
• attendance, where applicable;
• facilitator and assessor outcomes;
• competency and skills outcomes;
• course completion status;
• certificates and credentials earned;
• credential identifiers and verification status;
• learning transcripts;
• support interactions related to learning; and
• records required to maintain your Skills Passport.

Learning progress does not automatically mean competence. Where a skill or competency is described as assessed, competent or verified, that status must come from the applicable assessment or credential process.

3.3 Workplace Lab and evidence information

Where a programme includes practical work through the NIBS Workplace Lab, we may process:

• assigned tasks;
• task status and submission number;
• files, documents or other evidence you submit;
• comments and facilitator communications;
• dates of submission and review;
• assessment decisions such as not assessed, resubmission required or competent;
• mapped skills or competencies; and
• audit information showing how an outcome was reached.

Private evidence files, assessor notes and internal review information are not public by default.

3.4 Skills Passport, profile and credential information

You may have a private Skills Passport containing information about your learning, skills, credentials and assessed workplace outcomes.

If you choose to publish a Public Skills Passport, the information you choose to make public may be visible to employers, recruiters, professional bodies or anyone who receives the public link.

A public view may include:

• your display name;
• professional headline or pathway;
• selected verified skills;
• selected credentials;
• credential status and issue date;
• selected assessed workplace outcomes; and
• public verification references.

We do not intend to publish your email address, telephone number, identity number, payment information, private evidence files, unsuccessful assessment history, internal notes or assessor personal information through the Public Skills Passport.

You can unpublish or change the visibility of your Public Skills Passport using the controls made available to you, subject to records we must retain for legitimate verification, legal or audit purposes.

3.5 Payment and transaction information

When you make a payment or purchase, we may process:

• order or invoice number;
• product or programme purchased;
• amount;
• billing information;
• transaction status;
• payment method;
• payment-provider reference;
• payment date;
• refund or reversal information; and
• proof of payment where manual verification is required.

Card and sensitive payment credentials are processed by authorised payment providers. Naleli does not intend to store full payment-card numbers, card verification values (CVV/CVC) or online-banking credentials.

Payment providers may include Pay@, Paystack, PayFast or other providers that are enabled from time to time. Each payment provider processes information under its own terms and privacy notice.

3.6 Business, employer, organisation and partner information

When you enquire on behalf of a business, NGO, employer, school, funder, e-Learning Cafe or other organisation, we may collect:

• your name;
• work email and telephone number;
• organisation name;
• job title or role;
• programme or service interests;
• proposal, quotation and procurement information;
• correspondence and meeting information; and
• information needed to manage the commercial or programme relationship.

3.7 Support and communications information

If you contact us, we may keep:

• your contact details;
• support tickets;
• emails and messages;
• telephone-call notes where appropriate;
• screenshots or files you provide;
• technical information relevant to your query; and
• records of how the issue was resolved.

3.8 Technical and usage information

When you use our websites or platforms, we may automatically collect limited technical information, such as:

• IP address;
• browser type;
• operating system;
• device type;
• date and time of access;
• pages or features used;
• referral information;
• login and security events;
• cookie or session identifiers; and
• diagnostic and performance data.

We use this information for security, fraud prevention, service operation, troubleshooting, analytics and improvement.

4. Special personal information and children's information

POPIA gives additional protection to special personal information and to personal information of children.

Naleli does not intend to collect special personal information unless it is necessary and there is a lawful basis or authorisation for doing so. In a funded, employment, accessibility, equality, statutory or regulated programme, we may sometimes need information that falls within a protected category. Where that happens, we will tell you why it is required and apply appropriate safeguards.

Our standard self-service learning accounts are intended for adults unless a particular programme expressly allows younger participants. If a learner is a child as defined by POPIA, Naleli will only process the child's personal information where a lawful ground or competent-person authorisation applies and the relevant safeguards are in place.

If you believe a child's information has been collected without proper authority, please contact us.

5. How we collect personal information

We may collect information:

• directly from you;
• from your account or use of the Services;
• from a parent, guardian or competent person where lawfully applicable;
• from your employer, school, funder, partner or sponsoring organisation;
• from facilitators, assessors or authorised staff involved in your programme;
• from payment providers;
• from service providers acting on our behalf;
• from publicly available business sources where lawful; and
• automatically through security logs, cookies and similar technologies.

Where we collect personal information from a source other than you, we will handle it in accordance with POPIA and provide notice where required.

6. Why we process personal information

We process personal information only where we have an appropriate lawful ground under POPIA.

Purposes may include:

• creating and securing your account;
• enrolling you in a course or programme;
• delivering learning content and learner support;
• recording progress, submissions, assessments and competencies;
• issuing certificates, credentials and transcripts;
• maintaining the Skills Passport;
• enabling learner-controlled public credential and skills sharing;
• verifying the authenticity and status of credentials;
• administering Workplace Lab tasks and assessment evidence;
• processing payments, refunds and billing;
• providing e-Learning Cafe, employer, organisation and partner services;
• responding to enquiries and support requests;
• communicating service, security, transactional and policy information;
• preventing fraud, abuse and unauthorised access;
• maintaining audit and compliance records;
• improving our platforms and services;
• meeting tax, accounting, regulatory and legal duties;
• establishing, exercising or defending legal claims; and
• conducting marketing where permitted by law.

Depending on the context, the lawful ground may include:

• your consent;
• performance of a contract with you;
• steps taken at your request before entering into a contract;
• compliance with a legal obligation;
• protection of your legitimate interests;
• protection of Naleli's legitimate interests or those of a third party, where POPIA permits it; or
• another ground allowed by law.

Where processing is based on consent, you may withdraw that consent, although withdrawal does not make earlier lawful processing unlawful and may affect services that depend on the information.

7. Public credentials, Skills Passports and verification

A core part of some NIBS services is helping learners demonstrate verified learning and assessed skills.

7.1 Credential verification

A credential may have a public verification page so that an employer or other third party can confirm information such as:

• credential title;
• issuing organisation;
• credential identifier;
• issue date;
• validity status; and
• selected skills or competencies associated with the credential.

We limit verification pages to information reasonably necessary to establish authenticity.

7.2 Public Skills Passport

A Public Skills Passport is learner-controlled and opt-in. It should not be public merely because a learner has an account.

Where public sharing is enabled, we may use a non-obvious or random public reference rather than exposing an email address, username or identity number.

You should treat a public Skills Passport link as shareable information. If you publish or distribute the link yourself, third parties may retain copies or screenshots even after you later unpublish it.

8. Who we may share personal information with

We do not sell your personal information for money.

We may share personal information only where reasonably necessary and lawfully permitted, including with:

• authorised Naleli staff;
• facilitators, assessors and support personnel;
• hosting, cloud, email, backup and security providers;
• learning-platform and business-system providers;
• payment processors and banks;
• service providers that support customer service, communications, analytics or fraud prevention;
• your employer, funder, school, sponsoring organisation or programme partner where the programme arrangement lawfully requires it and appropriate notice has been given;
• professional or credential bodies where you request or authorise recognition, CPD or verification;
• auditors, accountants, insurers, legal advisers and other professional advisers;
• regulators, law-enforcement bodies, courts or public authorities where required or permitted by law; and
• a purchaser, successor or adviser involved in a legitimate restructuring, merger, acquisition or sale of all or part of the business, subject to appropriate confidentiality and legal safeguards.

Where another party processes personal information on our behalf as an operator, we require appropriate contractual, confidentiality and security safeguards.

9. Cross-border transfers

Some service providers or cloud systems may process or store personal information outside South Africa.

Where personal information is transferred to a third party in another country, Naleli will take reasonable steps to comply with section 72 of POPIA, including, where applicable, relying on:

• a recipient subject to a law, binding corporate rules or agreement that provides an adequate level of protection;
• your consent;
• a transfer necessary for performance of a contract or pre-contractual steps;
• a transfer necessary for a contract concluded in your interests; or
• another transfer permitted by POPIA.

We will not treat international transfer as permission to reduce the level of protection applied to your information.

10. Direct marketing

Naleli may send marketing about its courses, programmes, services, events or related offerings only in accordance with POPIA and other applicable law.

For unsolicited electronic direct marketing, including email, SMS or similar electronic communication, we will rely on consent or another ground permitted by section 69 of POPIA.

Where the law allows us to market similar products or services to an existing customer using details obtained in the context of a sale or service, we will provide a clear, free and simple opportunity to object.

Every direct-marketing message will identify the sender and provide a method to stop further marketing.

You may opt out of marketing at any time. Opting out of marketing does not stop necessary service communications such as:

• account-security notices;
• password resets;
• payment receipts;
• course or programme administration;
• assessment notifications;
• credential notices;
• material changes to terms or privacy notices; and
• other communications necessary to provide the Services.

11. Cookies and similar technologies

We may use cookies and similar technologies for:

Strictly necessary purposes

Required for login, authentication, security, session management, payment flow and core site functionality.

Functional purposes

Used to remember preferences and provide optional functionality.

Analytics and performance purposes

Used, where enabled, to understand how Services are used and improve performance and usability.

Marketing purposes

Used only where enabled and lawfully permitted for advertising, campaign measurement or audience activity.

Where consent is required for non-essential cookies or tracking, we will request it before activating the relevant technology.

You can also control cookies using your browser settings, although blocking necessary cookies may prevent parts of the Services from working.

12. Security

Naleli takes reasonable and appropriate technical and organisational measures to safeguard personal information against:

• loss;
• damage;
• unauthorised destruction;
• unlawful access;
• unauthorised disclosure;
• misuse;
• alteration; and
• other unlawful processing.

Measures may include, where appropriate:

• access controls and role-based permissions;
• strong authentication;
• password protection;
• encryption in transit;
• secure hosting;
• backups;
• logging and audit trails;
• security monitoring;
• least-privilege access;
• restricted access to learner evidence;
• software updates and vulnerability management; and
• contractual security requirements for operators and service providers.

No internet-based service can guarantee absolute security. You are responsible for keeping your password and authentication information confidential and for notifying us if you believe your account has been compromised.

13. Security compromises

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Naleli will manage the incident in accordance with section 22 of POPIA.

This may include:

• containing and investigating the incident;
• notifying the Information Officer;
• taking steps to mitigate harm;
• notifying the Information Regulator as soon as reasonably possible; and
• notifying affected data subjects where required by POPIA.

Operators processing information for Naleli are required to notify Naleli of relevant security compromises so that Naleli can meet its legal obligations as responsible party.

14. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, unless longer retention is required or permitted by law.

Different records may have different retention periods.

For example:

• account and learning records may be kept while your account or learning relationship remains active;
• transaction, tax and accounting records may be kept for legally required periods;
• support and security logs may be retained for operational and security purposes;
• assessment and audit records may be kept where necessary to support academic integrity, appeals or compliance;
• credentials and minimum credential-verification records may be retained for a longer period so that an issued credential can continue to be authenticated; and
• information involved in a dispute, investigation or legal claim may be retained until the matter is resolved and applicable retention periods have expired.

When information is no longer required and there is no lawful reason to retain it, we will delete, destroy or de-identify it in a manner appropriate to the information.

15. Your rights under POPIA

Subject to applicable law, you may have the right to:

• ask whether Naleli holds personal information about you;
• request access to your personal information;
• request correction of inaccurate, irrelevant, excessive, out-of-date, incomplete or misleading information;
• request deletion or destruction of personal information that Naleli is no longer authorised to retain;
• object to processing on grounds permitted by POPIA;
• withdraw consent where processing depends on consent;
• object to direct marketing;
• request information about the identity of third parties who have had access to your personal information where applicable;
• lodge a complaint with Naleli; and
• lodge a complaint with the Information Regulator.

We may need to verify your identity before giving access to, correcting or deleting personal information.

Some requests may be limited by PAIA, POPIA or another law, including where Naleli must retain records for legal, contractual, regulatory, evidentiary or legitimate operational reasons.

Requests may be submitted to:

Privacy / POPIA contact: compliance@naleli.co.za
Information Officer: To be confirmed
Deputy Information Officer (if applicable): To be confirmed
Registered address: 133 Maja Street, AP Khumalo, Katlehong, Gauteng, 1431
Physical office and campus: 824 Sontonga Road, Ramokonopi Section, Katlehong, 1431, Gauteng

Naleli may make prescribed POPIA forms available through its website or PAIA Manual.

16. Automated decision-making and AI-supported processing

Naleli may use software to assist with administration, matching, recommendations, fraud prevention, support or learning workflows.

We do not intend to make a decision based solely on automated processing that produces legal consequences for you, or affects you to a substantial degree, unless the decision is permitted under section 71 of POPIA and appropriate safeguards are in place.

Where section 71 applies, safeguards may include giving you:

• meaningful information about the relevant logic;
• an opportunity to make representations; and
• access to appropriate human review.

An automated course recommendation, progress indicator or career suggestion should not by itself be treated as an assessed competency or professional decision.

17. PAIA and access to records

The Promotion of Access to Information Act 2 of 2000 (PAIA) provides procedures for requesting access to certain records held by private bodies.

Naleli's PAIA Manual explains:

• categories of records held;
• records that may be available without a formal request;
• how to submit a PAIA request;
• applicable forms and fees;
• Information Officer details; and
• remedies available if access is refused.

PAIA Manual: To be confirmed

The PAIA Manual and this Privacy Policy serve different purposes. A privacy request concerning your own personal information may also be dealt with under POPIA, depending on the request.

18. Third-party websites and services

Our Services may link to or integrate with third-party websites, payment providers, communication services or platforms.

Naleli is not responsible for the independent privacy practices of third parties that determine their own purposes and means of processing. You should review their privacy notices before providing personal information to them.

Where a third party acts only as an operator for Naleli, Naleli remains responsible for ensuring the processing is appropriately governed under POPIA.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our Services;
• changes to our systems or providers;
• new legal or regulatory requirements; or
• improvements to our privacy practices.

The latest version will show the date it was updated.

Where a change is material, we may notify affected users through the Service, by email or by another appropriate method.

20. Contact Naleli about privacy

If you have a privacy question, request, concern or complaint, contact:

Naleli Innovations (Pty) Ltd
Privacy / POPIA: compliance@naleli.co.za
Information Officer: To be confirmed
Telephone: 076 684 5222
Registered address: 133 Maja Street, AP Khumalo, Katlehong, Gauteng, 1431
Physical office and campus: 824 Sontonga Road, Ramokonopi Section, Katlehong, 1431, Gauteng

We encourage you to contact us first so that we can try to resolve your concern.

21. Information Regulator (South Africa)

You also have the right to complain to the Information Regulator (South Africa).

Information Regulator (South Africa)
Woodmead North Office Park
54 Maxwell Drive
Woodmead, Johannesburg
South Africa

Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
Telephone: 010 023 5200
Toll-free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za

The Information Regulator also provides online services for POPIA complaints, PAIA complaints and security-compromise notifications.