Xhuma Talent Privacy Policy

Who Is Responsible for Your Information?

This policy is issued by Xhuma Talent (Pty) Ltd, at 171 Oxford Road, Rosebank, Johannesburg, 2196.

For privacy and Information Officer enquiries, or requests to exercise your rights, email support@xhuma.io.

The party that determines the purpose and means of processing is the responsible party under POPIA. Where Xhuma processes information solely on an institution's or another customer's instructions as an operator, that organisation's privacy notice and lawful instructions also apply. The relevant service notice should identify the responsible party.

Information We Collect and How We Collect It

• Directly from you when you provide it to us.
• Automatically when you use the Services.
• Where a service involves an educational institution, funder, employer or other authorised source, information may also be received from that source. The relevant collection notice must identify the source and purpose where required by POPIA.

Information You Provide to Us

When you use or register with the Services, we may ask you to provide information by which you may be personally identified, such as your name, email address, telephone number, location, qualification history, subjects and qualification performance, age, credit card information and any other identifier by which you may be contacted online or offline ("Personal Information").

This information includes:

• Information that you provide by filling in forms in the Services. This includes information provided at the time of registering to use the Services, using the Services and requesting help.
• If you complete an XAB assessment, questionnaire or survey, we treat your responses and results as confidential. Where lawfully authorised for the relevant purpose, they may be shared with your educational institution, prospective bursary or scholarship provider, or prospective employer for research or funding and career opportunities. Authorised service providers may also process them on our behalf as described below. We do not sell your assessment responses or results.
• Details of transactions you carry out through the Services and of the fulfilment of your orders. You may be required to provide financial information before placing an order through the Services or receiving payment.
• Records and copies of your correspondence (including e-mail addresses and phone numbers), if you contact us. We may also ask you for information when you report a problem with the Services.
• Your responses to surveys that we might ask you to complete for research and development purposes.

Required and Optional Information

The website contact form requires your first name, last name, email address, organisation and message so that we can receive and respond to your enquiry. If you do not provide these required fields, you cannot submit the form. Please do not include identity documents, bank account details, assessment results or other sensitive information in a general enquiry.

For other Services, the relevant collection notice must explain which information is mandatory or voluntary, why it is needed, the consequences of not supplying it, and any law requiring or authorising its collection. Refusing optional information should not prevent access to unrelated services.

Automatic Information Collection

When you download, access or use the Services, it may use technology to automatically collect:

• Usage Details. When you access and use the Services, we may automatically collect certain details of your access to and use of the Services, including traffic data, location data, logs and other communication data and the resources that you access and use on or through the Services.
• Device Information. We may collect information about your computer, mobile device and internet connection, including the computer or mobile device's unique device identifier, IP address, operating system, browser type, mobile network information and the device's telephone number.

Local Storage, Cookies, Web Beacons, and Tracking

The website uses browser storage to remember preferences such as your selected theme. Depending on the service, cookies or similar technologies may also support functionality, security or usage measurement. A service-specific notice should describe any additional tracking technologies and their purposes.

You can manage cookies and browser storage in your browser settings, although disabling necessary storage may affect functionality. Where consent is legally required for optional tracking, it must be obtained before that tracking starts; this policy and your continued use of the Services are not a substitute for that consent.

Use of Personal Information We Collect

We may use the information we collect from you in the following ways:

• To set up your account with us.
• To provide an analysis of your survey responses.
• To perform transactions through the Services and third-party service providers.
• To personalize your user experience and to allow us to deliver the type of content and offerings in which you are most interested, including sending you personalized job, internship and bursary alert correspondence.
• To facilitate research and monitor performance at your Educational Institution/School
• To deliver service messages and other services and content you request and send information related to accounts and services, including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages, and to enable user-to user communication.
• To conduct an aggregated analysis of the performance of our Services, including referral data if you arrive at our website from an external source.

Personal information must be relevant to and not excessive for a specified, lawful purpose. Optional processing, such as certain research or marketing activities, must be distinguished from processing needed to provide a requested service.

You may ask about a processing purpose, withdraw consent where consent is the basis, or object where POPIA permits by contacting support@xhuma.io. Withdrawing consent does not invalidate earlier lawful processing or prevent processing supported by another lawful ground.

How We May Share Information We Collect

Sharing must have a lawful purpose and basis. Depending on the service and applicable notice, recipients may include:

• We may share personal information with your consent. For example, you may let us share personal information with third parties for research purposes. Those uses will be subject to the third-party privacy policies.
• Service providers supporting hosting, communications, security, technical support, analysis or payments. Operators processing information on our behalf must be subject to written agreements requiring appropriate confidentiality and security safeguards under POPIA. A provider acting independently may have its own privacy notice and responsibilities.
• We may share personal information when we do a business deal, or negotiate a business deal, involving the sale or transfer of all or a part of our business or assets. These deals can include any merger, financing, acquisition, or bankruptcy transaction or proceeding.
• We may share information to respond to lawful requests and legal processes, and with banking partners as required by credit card association rules.
• We may share information to protect the rights and property of Xhuma, our agents, customers, and others. This includes enforcing our agreements, policies, and terms of use.
• We may share information in an emergency. This includes protecting the safety of our employees and agents, our customers, or any person.
• Authorised personnel and providers who need the information for the specified purpose. Consent is obtained where it is the required lawful basis; not all lawful service-provider processing depends on consent.
• We may share personal information with your Educational Institution or School for their research purposes. Those uses will be subject to the third-party privacy policies.
• Prospective employers or bursary and scholarship providers for the funding or career service you request, subject to the applicable lawful basis and collection notice. Using a chatbot, an assessment or another service does not by itself constitute blanket consent to unrelated disclosures.

We may also share aggregated and/or anonymized data with others for their own uses.

POPIA and Cross-Border Processing

Some of our Services utilise capabilities located in the United States of America (USA), while others utilise capabilities located in Europe. The locations used depend on the specific service and service provider.

Depending on the Services you use, your personal information may therefore be processed, stored or accessed outside South Africa, including in the USA or Europe. Not all service capabilities or personal information processing are located in South Africa.

Cross-border transfers of personal information are subject to the applicable requirements of the Protection of Personal Information Act, 2013 (POPIA), including section 72. This disclosure is not a request for blanket consent to international transfers.

The level of legal protection differs between countries; a location in the USA or Europe does not, by itself, establish that a transfer is lawful. Before a transfer, the applicable section 72 basis must be established. This may include a recipient subject to a law, binding corporate rules or a binding agreement providing adequate, substantially similar protection, including for onward transfers; valid consent to the transfer; or another applicable contractual or statutory ground permitted by section 72.

The relevant collection notice must explain intended international transfers and the level of protection afforded, as required by section 18 of POPIA. Service-specific destination countries, recipient categories and applicable safeguards need to reflect the actual providers and arrangements used.

For information about the processing locations and transfer arrangements relevant to a particular service, please contact us at support@xhuma.io.

Legal Basis for Processing Personal Information

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

Under section 11 of POPIA, processing may be justified by consent, necessity for a contract with you, compliance with a legal obligation, protection of your legitimate interests, or pursuit of the legitimate interests of Xhuma or a third party to whom information is supplied, where applicable. The ground used must be appropriate to the particular purpose and circumstances.

Responding to an enquiry and providing a service you request are different purposes from optional research or marketing. A general reference to legitimate interests does not override POPIA's specific restrictions, including those for electronic direct marketing, children's information or special personal information.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

Your Rights Under POPIA

Subject to POPIA's conditions and lawful limitations, you may:

• Ask whether we hold personal information about you and request access to it, including relevant information about third parties that have had access.
• Request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and request destruction or deletion of records we are no longer authorised to retain.
• Object on reasonable grounds to processing where POPIA permits, and object to processing for direct marketing.
• Withdraw consent where processing relies on consent, without affecting processing that was lawful before withdrawal.
• Lodge a complaint with the Information Regulator and pursue other remedies available under applicable law.

Send requests to support@xhuma.io with enough detail to identify the service and the right you wish to exercise. We may reasonably verify your identity and, where appropriate, your authority to act for someone else. Do not send sensitive identity documents in an initial email unless a suitable verification method has been agreed.

Requests are handled within the applicable statutory timeframes. Any lawful limitation, refusal or permitted fee must be explained where required. Access and correction rights are subject to POPIA and applicable PAIA procedures; they are not an unconditional right to erase records that must lawfully be retained.

Complaints to the Information Regulator

You may contact support@xhuma.io about a privacy concern, but you do not need our permission to complain to the Information Regulator (South Africa).

POPIA complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za. Telephone: 010 023 5200 or toll-free 0800 017 160.

The Regulator's published address is Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Current complaint forms, submission instructions and contact details are available at https://inforegulator.org.za/contact-us/.

Children and Special Personal Information

Student and assessment services may involve children or special personal information, such as health information, race or ethnic origin, or biometric information. POPIA imposes additional restrictions on these categories; a general processing ground or acceptance of this policy is not sufficient on its own.

Where a service involves such information, the applicable authorisation or exception under POPIA must be established before processing. This may require consent from a legally competent person for a child, or another authorisation permitted by law. The relevant service notice must explain the purpose and safeguards.

Please contact support@xhuma.io before submitting a child's information or special personal information through a general enquiry channel.

Assessments, AI and Automated Decisions

Where a service uses assessments, AI or profiling, its specific notice must explain the relevant processing and purpose. Section 71 of POPIA restricts certain decisions based solely on automated processing that have legal consequences or substantially affect a person.

Where section 71 applies, an applicable exception and the required safeguards must be in place, including an opportunity to make representations where required. Contact support@xhuma.io to ask whether a decision affecting you involved automated processing and what review or representations process applies.

Direct Marketing

Electronic direct marketing is subject to section 69 of POPIA. Where consent is required, it must be obtained separately; requesting information or using a service does not automatically authorise unrelated marketing. Any existing-customer exception must meet the conditions in that section.

You can object to direct marketing or use the unsubscribe mechanism in a marketing message. You may also email support@xhuma.io. Necessary service messages, such as replies to your enquiry or security notices, are distinct from marketing.

Data Retention

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements).

When we have no ongoing legitimate business need to process personal information, we will either delete or anonymize it or, if this is not possible (for example, because personal information has been stored in backup archives), then we will securely store personal information and isolate it from any further processing until deletion is possible.

Security of Your Personal Information

The security of your Personal Information is important to us. When you enter sensitive information (such as credit card number) on our Services, we encrypt that information using secure socket layer technology (SSL).

Xhuma takes reasonable security measures to protect your Personal Information to prevent loss, misuse, unauthorized access, disclosure, alteration, and destruction. Please be aware, however, that despite our efforts, no security measures are impenetrable.

If you use a password on the Services, you are responsible for keeping it confidential. Do not share it with any other person. If you believe your password has been misused, please notify us immediately.

Security Compromise Notifications

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires notification to the Information Regulator and affected data subjects as soon as reasonably possible after discovery, subject to the Act's provisions, including lawful delays and identification of affected data subjects.

Where notification is required, it must provide sufficient information to help affected people take protective measures. This policy does not replace the investigation, security response and notifications required by law.

Your Data Protection Rights Under The General Data Protection Regulation (GDPR)

Where the GDPR applies to the processing of your information, you may also have the following rights, subject to its conditions and limitations:

• You may access, correct, update, or request deletion of your personal information.
• In addition, you can object to the processing of your personal information, ask us to restrict the processing of your personal information, or request portability of your personal information.
• You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the "unsubscribe" or "opt-out" link in the marketing emails we send you.
• Similarly, if we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. To exercise any of these rights, please contact us at support@xhuma.io

Contact Us

If you have any questions about this Privacy Policy, or want to exercise your privacy rights, contact us at support@xhuma.io.

Updating and Accessing Your Personal Information

If you would like to review, update, correct, or access the personal information we hold about you, please contact us at the email address above. We will respond to verified requests within a reasonable timeframe and in accordance with applicable data protection laws.

If you believe any personal information we have is inaccurate or incomplete, you may request that we update or correct it. Where applicable, you may also request deletion of your personal information, subject to our legal and operational retention obligations.