Privacy Policy

Last updated

1. Who is responsible for your information



Responsible party

Think Education Group Pty Ltd

Physical address

36 Jimmy Smith Street, Sandbaai, 7201

Information Officer

Leigh-Ann Geydien

Deputy Information Officer

Claire Minnaar

Information Officer contact

info@thinkeducation.co.za

Telephone

+27 63 197 5060

PAIA manual

View

This policy explains what personal information we collect, why, what we do with it, and what you can do about it. It is written to meet section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA).

2. ⚠️ If you are under 18

Some of our readers are still at school. Part of what follows is about you specifically.

South African law treats information about a child differently. It says that in most cases a "competent person" — normally your parent or legal guardian — has to agree before a website may collect and use personal information about you.

So here is how we have built this site:

  • You do not need an account to use ThinkEducation. There is no sign-up wall. Every career page, every qualification, every institution and every article is open.
  • We do not ask you for your name, your ID number, your school, your marks or your address in order to read anything.
  • The "Save this page" button stores a list on your own phone or computer. It never reaches us and it contains nothing about you.
  • If you send an enquiry to an institution and tell us you are under 18, we ask for a parent or guardian's name and email address, and we hold your enquiry instead of sending it. It does not go to the institution until your guardian has confirmed they are happy for it to. Nobody at the institution sees it in the meantime.
  • Please do not fill in any other form on this site without your parent or guardian's permission.
  • If you are a parent or guardian and you think we hold information about your child, email info@thinkeducation.co.za and we will delete it.

3. What we collect, and when

a) Automatically, when you visit — every visitor

Our web server and Cloudflare, our security provider, record: your IP address, the type of device and browser you are using, the pages you look at, the page that sent you to us, and the date and time. This happens for every website you visit, not just ours. We use it to keep the site working, to keep it secure, and to find broken pages.

b) Cookies and similar technologies — see section 7. In short, we set none of our own.

c) If you fill in a contact form

We collect what you type in: name, email address, telephone number, message, and anything else.

d) If you send an enquiry to an institution

We collect your name, email address, telephone number, which institution and campus you are asking about, the subject of your question and your message. We keep a record of the wording you agreed to when you sent it.

If you tell us you are under 18, we also collect a parent or guardian's name and email address, and we hold the enquiry rather than sending it — see section 2.

Enquiries are only offered on institutions that have a paid listing with us, because those are the only ones we have an agreement with to pass an enquiry to.

e) If you asked us to tell you when the site launched

Before launch we collected an email address, and a first name and surname where people gave them, along with the date and the wording agreed to. We do not currently send a newsletter. If we start one, we will only email people who have asked for it, and every email will have an unsubscribe link.

f) If you claim or buy an institution listing

We collect the details of the person acting for the institution — name, work email address, work telephone number, job title — and, where a purchase is involved, billing contact and invoicing details. This information is held on our system and is not published on the website.

g) If you email us

We keep the email and our reply, so that we have a record of what was asked and answered.

What we do not collect: we do not ask for or want your ID number, your bank details, your matric results, your medical information, or anything about your race, religion, health, sexual life, political views or trade union membership. If you send any of that to us anyway, we will delete it.

4. Why we use it, and what allows us to

POPIA requires us to have a lawful basis for each thing we do. These are ours:

What

Why

Lawful basis (POPIA s11)

Server and security logs

Keeping the site up, safe and working

Legitimate interests — s11(1)(f)

Remembering your cookie choice

So that we do not ask you again

Legitimate interests — s11(1)(f)

Analytics (Google Analytics 4)

Understanding which pages help people, and which do not

Your consent — s11(1)(a)

Contact form details

Answering you

Consent — s11(1)(a); and, for institutions, s11(1)(b) where it leads to a contract

An enquiry to an institution

Passing your question to the institution you chose

Your consent — s11(1)(a)

A guardian's name and email on an enquiry from a minor

Getting the agreement the law requires before we send it

Consent of a competent person — s35(1)(a)

The launch notification list

Telling you the site had launched, because you asked us to

Your consent — s11(1)(a), and POPIA s69

Listing claims and purchases

Verifying authority, delivering and invoicing the listing

Contract — s11(1)(b)

Keeping records of invoices

Tax and company law

Legal obligation — s11(1)(c)

5. Information about institutions

Most of our directory was compiled from public sources. South African law is unusual here: POPIA protects juristic persons — companies, colleges, universities — as well as natural persons. We rely on section 12(2), which permits collection from a public record or from information the institution has deliberately made public, and on section 15(3)(b) for the further processing. Official registers, institutions' own websites and published prospectuses all qualify.

We publish institution-level facts. We do not publish any individual person's contact details in a listing. That rule is enforced in the system itself: those fields do not exist on our institution or campus records, and our import process rejects columns that look like personal contact details.

There is one deliberate exception. An event listing may name a contact person for that event — a name only, so that you know who to ask for when you arrive or phone. It is not published alongside that person's own email address or direct telephone number, it is kept out of our site search, and it is kept out of the structured data that other websites and search engines read.

An institution can claim, correct or query its listing — see clause 4 of the Terms.

6. Who we share it with

We do not sell your personal information. We share it only in these ways:

Who

What

Why

Absolute Hosting, South Africa

Server logs, site data

Running the site

Cloudflare

Traffic data, IP addresses

Security and speed

Backblaze

Images and documents uploaded to the site

Storing media files

SMTP2GO

Your email address and the message

Sending the emails you asked for

Google (Analytics 4)

Cookie and device identifiers, pages viewed

Analytics — only if you consent

An institution

Only what you deliberately send it through an enquiry form

Answering your enquiry

Professional advisers, or a regulator or court

Whatever is required

Where the law requires it

OpenStreetMap Foundation

Your IP address

Drawing the campus maps — only if you open a map

Google is a separate responsible party for the information it collects through its own cookies. Its practices are governed by its own policies at policies.google.com/privacy and policies.google.com/technologies/partner-sites.

7. Cookies and similar technologies

What a cookie is. A small text file a website asks your browser to store, so it can recognise your browser next time. Some are needed for a site to work. Others watch what you do so that adverts or statistics can be produced.

We do not set any cookies of our own. Nothing this site remembers about you is a cookie. Your cookie choice and your saved pages are both kept in your browser's own storage, which is never sent to us and which we cannot read. The only cookies that can appear on this site are Google's, and only after you have agreed to them.

Your choice. When you first visit, you will see a banner. Nothing runs until you choose. You can change your mind at any time using the Cookie choices button in the footer of every page. Refusing analytics does not restrict anything you can read on this site.

a) Strictly necessary — none

The site works without a single cookie. Your answer to the banner is kept in your browser's local storage, under the name te-consent. It records your answer, which version of the banner's wording you were shown, and when. It contains no identifier of any kind, it is never sent to our server, and clearing your browser data removes it. If we change the banner's wording in a way that changes what you were told, your stored answer is discarded and we ask you again.

b) Preferences — stored on your device, not sent to us

"Save this page" uses your browser's local storage to keep a list of pages you have saved. It stays on your device. It is not a cookie, it is not sent to our server, and it contains no information about you. Clearing your browser data removes it.

c) Analytics — Google Analytics 4 — only with your consent

We use Google Analytics 4 to understand which pages people read, how they arrive, and where they give up. We also record when you click certain things — a link out to an institution's website, a share button, a prospectus download, a social media link, or a banner on the home page — so that we know which parts of the site are useful. We do not record anything you type into a form. The event records that it happened; what you typed goes to us through the form, not through analytics.

If you agree to analytics, Google sets these two cookies:

Name

Set by

Purpose

Expires

_ga

Google

Tells one browser from another

2 years

_ga_09SNPB37Z4

Google

Keeps track of your visit as you move between pages

2 years

Your browser may shorten these on its own: Chrome limits them to about 400 days and Safari to 7 days. If you refuse, neither is set.

You can also opt out of Google Analytics in any browser using Google's own tool at tools.google.com/dlpage/gaoptout.

d) Advertising — no advertising cookies at present

The site carries advertising, but every advert on it at the moment is one we have sold and serve ourselves: an ordinary image, hosted by us, with nothing tracking you and no cookie set. We are not currently using Google Ad Manager or any advertising network.

If that changes we will update this policy first, and advertising cookies will run only if you agree to them — the same choice, in the same banner, as for analytics.

e) Affiliate links

Some links to other websites are affiliate links: if you follow one and buy something, the other website may pay us a commission, and it may set a cookie to record that you came from us. It never costs you more. These links are labelled. See the Advertising Disclosure.

f) Turning cookies off in your browser

Every browser lets you block or delete cookies in its settings. Blocking all cookies may break parts of some websites. It will not stop you reading anything on ThinkEducation.

8. Sending information outside South Africa

Some of the companies we use process information outside South Africa — Google, Cloudflare, SMTP2GO and Backblaze in particular. POPIA section 72 permits this where the receiving country or the recipient's binding rules provide comparable protection, or where the transfer is necessary to perform a contract with you or in your interest. We rely on those grounds, and on the contractual terms those providers publish.

9. How long we keep things

What

How long

Server and security logs

About two months. Our application logs are rotated weekly and eight are kept; the web server's own access logs are kept for 14 days.

Analytics data

14 months, as set in Google Analytics

Contact form messages, enquiries, and our replies

For as long as we may still need them to answer you or to deal with a complaint about our answer

An enquiry held for a guardian's agreement

Until a guardian confirms it. If nobody does, it is never sent, and we delete it on request.

The launch notification list

Until you ask us to take you off it

Institution claims, listings and invoices

For the length of the agreement, plus the period tax and company law require us to keep invoices

We delete or de-identify personal information when we no longer have a reason to keep it, and always when you ask us to — see section 11. We do not run an automatic deletion schedule, so if you want something removed, asking us is the quickest way.

10. Keeping it safe

We take reasonable technical and organisational steps to protect personal information, as POPIA section 19 requires: the site is served over HTTPS, access to our systems is restricted and password-protected, and personal information is not published on the public site. No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as section 22 requires.

11. Your rights

Under POPIA you may:

  • Ask what we hold about you and get a copy (section 23)
  • Ask us to correct or delete information that is wrong, misleading, out of date, incomplete, or that we no longer have the right to keep (section 24)
  • Object to us processing your information on the legitimate-interests basis (section 11(3))
  • Withdraw consent at any time, where consent is what we relied on — this does not undo what we did before you withdrew it
  • Tell us to stop sending you direct marketing (section 69)
  • Complain to the Information Regulator (section 74)

To exercise any of these: email info@thinkeducation.co.za. We will respond within a reasonable time and, where a formal request form is prescribed under the Promotion of Access to Information Act 2 of 2000, we will tell you which one to use and send it to you. There is no charge to ask us to correct or delete something. A charge may apply to a formal access request, as PAIA allows.

The Information Regulator (South Africa)

12. Direct marketing

We do not currently send marketing email. If we start, we will only send it to people who have asked for it, every email will carry an unsubscribe link that works, and we will act on it. We do not sell or rent our mailing list.

13. Automated decisions

We do not make any decision about you automatically that has legal consequences for you or affects you significantly (POPIA section 71). Where the site suggests careers or qualifications, it is following simple published rules, it is a suggestion only, and no decision is being made about you.

14. Changes to this policy

We will update this policy when what we do changes. The date at the top tells you when it last changed. Where a change is significant — for example if we start collecting something new, or start carrying advertising that sets cookies — we will say so prominently on the site.

15. Contact us about privacy

Leigh-Ann Geydien, Information Officer

info@thinkeducation.co.za · +27 63 197 5060

36 Jimmy Smith Street, Sandbaai, 7201