PRIVACY POLICY
Garden Route Skills School
Effective date: 28 October 2026
Last updated: 28 October 2026
1. Introduction
Garden Route Skills School (“the School”, “we”, “us” or “our”) respects your right to privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, enquire about our courses, submit an application, enrol as a student, participate in training, apply for employment or facilitation opportunities, or otherwise interact with us.
We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”), its applicable regulations and other relevant South African legislation.
By using our website or providing personal information to us, you acknowledge that you have had an opportunity to read this Privacy Policy. Where consent is required by law, we will request it separately where appropriate. Using our website does not automatically constitute consent to every form of processing described in this policy.
2. Who is responsible for your personal information?
Garden Route Skills School is responsible for determining the purposes and means for which personal information is processed in connection with its operations.
Organisation: Garden Route Skills School
Email: info@gardenrouteskillsschool.com
Physical address: [Insert the School’s registered or principal business address]
Information Officer: [Insert the appointed Information Officer’s full name]
Information Officer email: [Insert the designated privacy contact email or confirm that the above email address will be used]
The School will make the appropriate contact details for its Information Officer available to individuals who wish to exercise their rights under POPIA or raise a privacy-related concern.
3. What personal information do we collect?
The information we collect depends on your relationship with the School, the services you request and the information necessary for the relevant purpose.
This may include the following categories.
3.1 Prospective students and applicants
Full name and surname.
Contact details, including email address, telephone number and residential or postal address.
Date of birth and age, where relevant to admission or safeguarding requirements.
Course of interest, application information and educational background.
Employment status, experience, qualifications and skills relevant to a course.
Information provided through application forms, enquiries, interviews and correspondence.
3.2 Enrolled students
Student registration and enrolment records.
Attendance, participation, assessment and course-completion records.
Information relating to student progress, support requirements and communication with facilitators.
Payment, invoicing, sponsorship and refund information.
Certificates, qualifications and other records relevant to training.
Emergency contact details and information reasonably necessary for student safety.
3.3 Parents, guardians and emergency contacts
Where appropriate, we may collect the names, contact details and relevant relationship information of parents, legal guardians or emergency contacts.
We ask individuals to provide another person’s information only where they are authorised to do so or where another lawful basis applies.
3.4 Course facilitators, employees and job applicants
We may collect contact details, CVs, qualifications, employment history, references, professional experience, contractual information, payment details and other information reasonably necessary for recruitment, appointment, payment and employment administration.
3.5 Website visitors
When you visit our website, we may collect technical information such as your IP address, browser type, device information, pages visited, referring website, approximate location derived from technical data and information about your interaction with the website. The information collected will depend on the website’s configuration and the technologies in use.
3.6 Special personal information
In limited circumstances, we may need to process special personal information, such as health information relevant to reasonable training accommodations or safety, or other information classified as special personal information under POPIA.
We will only process such information where permitted by law, where the relevant conditions are met and where it is necessary for a legitimate, defined purpose. We will not request sensitive information merely because it may be useful.
4. How do we collect personal information?
We may collect personal information:
Directly from you through website forms, online enquiries, application forms, registration documents, emails, telephone calls, interviews and in-person interactions.
During the delivery and administration of courses, including attendance and assessment processes.
From a parent or legal guardian where appropriate and lawful.
From an employer, sponsor, referee, educational institution or other third party where permitted by law and relevant to the purpose.
Automatically through website logs, cookies and similar technologies, where these are used.
From publicly available sources where lawful and appropriate.
Where we receive personal information from a third party, we will take reasonable steps to ensure that the processing complies with POPIA, including providing the required information to the data subject where applicable.
5. Why do we collect and use personal information?
We collect and process personal information only for specific, explicit and lawful purposes. Depending on your interaction with us, these purposes may include:
Course enquiries and admissions
Responding to enquiries and providing course information.
Assessing applications and determining eligibility for enrolment.
Communicating admission decisions, course dates, requirements and registration instructions.
Maintaining accurate student and applicant records.
Education and training
Delivering and administering courses.
Recording attendance, participation, assessments and progress.
Communicating with students, facilitators and relevant support personnel.
Providing certificates or other course-completion documentation where applicable.
Supporting student welfare, accessibility and reasonable accommodations where necessary.
Administration and financial management
Processing course fees, invoices, payments, sponsorships and refunds.
Maintaining accounting, financial and administrative records.
Managing contractual obligations and resolving disputes.
Complying with applicable tax, financial and recordkeeping requirements.
Recruitment and staffing
Assessing applications for employment or facilitation opportunities.
Verifying relevant qualifications, experience and references where lawful.
Administering employment, contractual and payment arrangements.
Safety, security and legal compliance
Managing campus access and student safety.
Investigating complaints, misconduct, fraud or security incidents where appropriate.
Protecting the rights, property and legitimate interests of the School and others.
Complying with legal obligations and responding to lawful requests from authorised authorities.
Website and service improvement
Maintaining website functionality and security.
Understanding how visitors use our website, where lawful.
Improving our courses, administrative processes and communications.
Marketing and communications
Sending course announcements, enrolment information, newsletters and promotional material where permitted by law.
Responding to requests for information about upcoming courses and events.
Sharing relevant opportunities with individuals who have requested or agreed to receive such communications, where applicable.
We will not use personal information for a materially different purpose unless the further processing is permitted by POPIA or another lawful basis applies.
6. What is our lawful basis for processing?
POPIA requires personal information to be processed lawfully and reasonably, without infringing the privacy of the individual concerned.
Depending on the circumstances, the School may rely on one or more lawful grounds, including:
Your consent, where consent is required or appropriate.
The necessity of processing to conclude or perform a contract with you.
Compliance with a legal obligation.
The protection of a legitimate interest of the data subject.
The legitimate interests of the School or a third party, where permitted by POPIA and appropriately balanced against your rights.
Another lawful ground expressly permitted under POPIA.
Where we rely on consent, you may withdraw it, subject to applicable legal limitations. Withdrawal will not make prior lawful processing unlawful, and it will not prevent processing that may continue on another lawful basis.
7. Direct marketing and your choices
We may communicate with you about courses, enrolment opportunities, events and related School activities.
We will conduct electronic direct marketing in accordance with POPIA and other applicable laws. Where prior consent is required, we will obtain it before sending the relevant marketing communication.
Where permitted by law, we may communicate with existing students or individuals who have requested information about our services, subject to applicable restrictions and opt-out requirements.
You may unsubscribe from marketing emails using the unsubscribe facility provided, where available, or by contacting us at info@gardenrouteskillsschool.com.
Unsubscribing from marketing will not prevent us from sending necessary administrative communications, such as course notices, payment information, safety updates or responses to your enquiries.
8. Cookies and website technologies
Our website may use cookies and similar technologies to support functionality, remember preferences, analyse website usage or measure marketing performance.
Cookies may include:
Essential cookies: necessary for the website to operate correctly.
Preference cookies: used to remember selected settings.
Analytics cookies: used to understand how visitors interact with the website.
Marketing cookies: used for advertising or campaign measurement, where applicable.
The School will provide appropriate information and consent controls where required by law, particularly for non-essential cookies or similar technologies.
You may be able to manage cookies through your browser settings. Disabling certain cookies may affect website functionality.
The School should update this section to reflect the actual cookies, analytics tools, advertising platforms and website integrations in use.
9. When do we share personal information?
We do not sell personal information to third parties.
We may share personal information where reasonably necessary and lawful with the following categories of recipients:
Staff and facilitators: where access is necessary to administer courses, assess work, communicate with students or perform their duties.
Parents or legal guardians: where appropriate and lawful, including where a student is a minor and disclosure is authorised or otherwise permitted.
Employers, sponsors or funding organisations: where necessary to administer sponsored training, payments or agreed reporting, and where a lawful basis exists.
Service providers and operators: such as website hosts, email providers, cloud-storage services, form-processing platforms, payment processors, accounting providers and IT support providers.
Professional advisers: including legal, accounting and other advisers where necessary.
Regulators, public authorities or law-enforcement bodies: where disclosure is required or authorised by law.
Other recipients: where you have consented to disclosure or where another lawful ground applies.
Where an external service provider processes personal information on our behalf, the School will take reasonable steps to ensure that appropriate confidentiality and security obligations are in place, including written operator arrangements where required by POPIA.
We will not disclose personal information simply because a third party requests it. Disclosure must be lawful and appropriate to the circumstances.
10. Transfers of personal information outside South Africa
Some third-party service providers may store or process personal information on servers located outside South Africa.
Where personal information is transferred to another country, the School will take reasonable steps to ensure that the transfer complies with section 72 of POPIA. This may require an applicable legal basis, appropriate contractual protections, adequate protection under the recipient country’s laws, or another permitted circumstance.
We will not assume that a transfer is lawful merely because a service provider is widely used or offers cloud-based services.
Where appropriate, further information about relevant international transfers may be requested from the School.
11. How do we protect personal information?
The School will take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access and unauthorised processing.
Depending on the information and risks involved, safeguards may include:
Restricting access to authorised personnel who need the information for their duties.
Using password protection, access controls and suitable account security.
Securing physical student records and administrative documents.
Taking reasonable precautions when transmitting or sharing personal information.
Reviewing access permissions and data-handling practices.
Using appropriate security arrangements with external service providers.
Providing relevant personnel with guidance on confidentiality and data protection.
Reviewing and improving safeguards when risks or deficiencies are identified.
No website, electronic communication or storage system can be guaranteed to be completely secure. However, the School will take reasonable steps to maintain appropriate safeguards and respond to identified risks.
12. Personal information breaches
If the School has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, it will assess and respond to the incident in accordance with POPIA.
Where required by law, the School will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful restrictions or directions from the relevant authorities.
A notification may explain the nature of the incident, the information involved, any measures taken and steps that affected individuals may take to protect themselves.
13. How long do we keep personal information?
The School will retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, subject to applicable legal, contractual, accounting, educational and recordkeeping requirements.
Retention periods may differ according to the type of record, including:
Enquiry and prospective-student records.
Student enrolment, attendance, assessment and completion records.
Financial and payment records.
Employment and facilitator records.
Consent, complaint and legal records.
Website logs and marketing preferences.
When personal information is no longer required and no lawful reason exists to retain it, we will take reasonable steps to delete, destroy or de-identify it securely.
We may retain certain information where necessary to comply with the law, establish or defend legal claims, resolve disputes or protect legitimate interests, as permitted by law.
14. Your rights under POPIA
Subject to the applicable legal requirements and limitations, you may have the right to:
Be informed about the collection and use of your personal information.
Request confirmation of whether the School holds personal information about you.
Request access to personal information held about you, through the applicable process.
Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, where the legal requirements are met.
Object to processing in circumstances provided for by POPIA.
Withdraw consent where processing is based on your consent.
Object to direct marketing and request that your personal information not be used for that purpose, as permitted by law.
Complain to the Information Regulator if you believe your personal information has been processed unlawfully.
Exercise any other rights available to you under applicable law.
These rights are not absolute. For example, the School may need to retain certain records to meet legal obligations or may be lawfully entitled to refuse a request in specific circumstances.
To exercise a right, please email info@gardenrouteskillsschool.com with the subject line “POPIA Request”. Please describe your request and provide sufficient information for us to identify the relevant records. We may request reasonable proof of identity to protect your information from unauthorised disclosure.
We will consider and respond to requests in accordance with POPIA and any applicable prescribed procedures, time limits and fees.
15. Children and students under 18
The School recognises that children’s personal information receives additional protection under POPIA.
Where a learner is a child as defined by applicable law, the School will process their personal information only where a lawful basis and the additional requirements applicable to children’s information are satisfied.
Where required, we will obtain consent from a competent person, such as a parent or legal guardian, or rely on another applicable authorisation permitted by law.
We will take reasonable steps to ensure that application forms, consent processes, communications, photographs and other records involving minors are handled appropriately.
Parents and legal guardians may contact the School with questions about the personal information of a child for whom they are legally responsible. Requests will be assessed in accordance with the child’s rights, applicable law and any relevant safeguarding considerations.
16. Photographs, videos and student work
The School may wish to photograph or record courses, workshops, student projects, exhibitions, events and other School activities for educational, administrative, promotional or reporting purposes.
Where photographs, recordings or student work identify an individual, they may constitute personal information. The School will handle this material in accordance with POPIA and applicable intellectual-property requirements.
Where consent or another lawful basis is required, the School will obtain the appropriate permission before using identifiable photographs, videos, testimonials or student work for the relevant purpose.
Where appropriate, students or their parents or guardians may be offered a separate media consent form. Consent to promotional use should be distinguishable from consent required for ordinary course administration.
Students should inform the School if they have concerns about the use of their image or work.
17. Third-party websites and services
Our website may contain links to external websites or use third-party tools and services.
These external services may have their own privacy policies and data-handling practices. The School does not control the privacy practices of independent third parties.
We encourage you to read the relevant privacy policies before submitting personal information to an external website or service.
Where the School selects a third-party service to process information on its behalf, we will take reasonable steps to address our responsibilities under POPIA.
18. Accuracy of personal information
We take reasonable steps to ensure that personal information is accurate, complete, not misleading and updated where necessary for the purpose for which it is processed.
Please inform us if your contact details, emergency contact information or other relevant personal information changes.
You may also request correction of inaccurate information through the process described in this policy.
19. Complaints and contact details
If you have a question, concern or complaint about how the School handles personal information, please contact us first so that we can investigate and attempt to resolve the matter.
Garden Route Skills School
Email: info@gardenrouteskillsschool.com
Information Officer: [Insert appointed Information Officer’s name]
Physical address: [Insert address]
If you are not satisfied with the outcome, you may lodge a complaint with the South African Information Regulator.
Information Regulator (South Africa)
Website: https://inforegulator.org.za/
Email for POPIA complaints: POPIAComplaints@inforegulator.org.za
Please verify the regulator’s current contact details and complaint procedures before submitting a complaint.
20. Changes to this Privacy Policy
The School may update this Privacy Policy from time to time to reflect changes in our operations, website, service providers, legal obligations or data-protection practices.
The updated version will be published on our website with a revised “Last updated” date.
Where required by law, we will provide additional notice or obtain consent before implementing a change that requires it.
We encourage you to review this page periodically.
21. Related policies
This Privacy Policy should be read together with the School’s Terms and Conditions, Student Refund Policy, website cookie notice and any applicable student application, enrolment, consent or information-access documents.
If there is a conflict between this policy and applicable law, the relevant legal requirements will prevail.