Protection of Personal Information Act (POPIA)

Effective: 1 July 2021.

Last updated: 27 October 2026. Information Regulator registration number: 2026-067987.

This notice explains how UniApplyForMe NPC (“UniApplyForMe”, “we”, “us”) complies with the Protection of Personal Information Act 4 of 2013 (POPIA). It applies to our website (apply.org.za), the UniApplyForMe app, our web app, and our other services. It should be read together with our Privacy Policy, which describes in more detail what we collect and how we use it.

1. Who is responsible for your information

UniApplyForMe NPC is the responsible party for the personal information we collect through our services. Registration number: 2021/649773/08.

Our Information Officer is Mthokozisi Dhlamini. You can contact the Information Officer at [email protected], on 062 803 7717, or by post at Airy Crescent, Bram Fischerville, Soweto, Gauteng, 1875. Our Information Officer is registered with the Information Regulator under registration number 2026-067987.

2. What POPIA means for you

POPIA protects your right to privacy. It requires us to collect only the information we need, use it only for the reasons we told you about, keep it safe, and let you see, correct or delete it. We process personal information lawfully and in line with the eight conditions set out in POPIA: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.

3. What we collect and why

Our Privacy Policy lists the personal information we collect. In summary, we process:

• account and contact details, such as your name, email address and phone number, so you can create an account and use our services;
• academic details, such as your school, grade, subjects, marks and APS, so we can help you find qualifications, bursaries and opportunities you qualify for;
• identity details, such as your South African ID number and date of birth, where a service needs them, for example a bursary application;
• information about how you use our services, so we can keep them secure and improve them.

We rely on your consent, on the need to provide a service you asked for, or on our legitimate interests in running and protecting our services, as allowed by section 11 of POPIA.

4. Bursary applications through UniApplyForMe Bursaries

Some bursary funders let you apply directly through UniApplyForMe, in our app or on the web. When you do:

• What is shared. When you submit an application, we share your answers, the profile details the form asks for (such as your name, contact details, ID number, school, marks and APS), and the documents you attach (such as a copy of your ID, school reports and proof of household income) with the funder of that bursary only.
• When it is shared. Nothing is shared with a funder while your application is a draft. We share it only after you submit it and give your consent on the submission screen, which names the funder.
• What the funder may use it for. Funders may use your application only to assess it, communicate with you about it, and manage any bursary awarded. They may not use it for marketing or sell it. Funders accept these conditions before they receive access.
• Who at the funder can see it. Only staff the funder has given access to. Every funder account is protected with two step verification, and we keep a record each time a document is opened or applications are exported.
• Information you type in. If you enter details that are not in your profile, such as marks, the funder sees that you entered them yourself.
• Automatic checks. We may check your application against the funder's published requirements to help them review it. These checks do not make the final decision. Funders decide who receives a bursary.
• Withdrawing. You can withdraw an application at any time before a final decision. Withdrawing stops further processing on our side, but it cannot recall copies the funder has already downloaded. To ask a funder to delete your information, contact them directly or ask us to help.
• Status updates. We email you when the status of your application changes, for example when you are shortlisted.

Once a funder has your application, the funder is also responsible for protecting it under POPIA.

5. Learners under 18

Many of the learners we serve are under 18. POPIA protects the personal information of children with extra care. Where a service involves sharing a child's personal information with a third party, such as submitting a bursary application, we require confirmation that a parent or legal guardian has consented. If you are under 18, you must confirm on the submission screen that your parent or legal guardian has agreed that you may share your application with the funder. A parent or guardian may contact our Information Officer at any time to ask about, or withdraw, this consent.

6. Special personal information

We do not ask for special personal information, such as race, religion, health or criminal records, unless a service needs it and you give explicit consent, or another ground in POPIA applies. Some funders may ask about race or disability to meet transformation or equity requirements. If a bursary form asks for this, the question will say so, and you can choose whether to answer where the funder allows it.

7. Who processes information on our behalf

We use trusted service providers (operators) to run our services. They process information only on our instructions and must keep it secure. They include:

• Supabase, for our database and account sign in;
• Cloudflare, for hosting, secure file storage and sending email;
• Google, for sign in with Google and analytics;
• DesignThat Cloud, for hosting our main website.

Some of these providers store information on servers outside South Africa. We only use providers that are bound by laws, binding agreements or rules that give a level of protection comparable to POPIA, as required by section 72. Our database is hosted by Supabase in Ireland, in the European Union, whose data protection laws offer protection comparable to POPIA. Documents and files are stored and delivered by Cloudflare, which may store and serve them from data centres in several countries.

8. How we keep your information safe

We take reasonable technical and organisational measures to protect your information, including:

• encrypting information in transit;
• storing documents privately, so they can only be opened through our secure systems by people with permission;
• giving staff and funders access only to what they need;
• requiring two step verification for funder and administrator accounts;
• keeping records of who views documents and exports applications;
• reviewing our systems and access regularly.

If we become aware of a security compromise that affects your personal information, we will notify you and the Information Regulator as POPIA requires.

9. How long we keep your information

We keep personal information only for as long as we need it for the purpose it was collected, or as the law requires. Bursary applications and their documents are kept for the duration of the bursary cycle plus 2 years, or plus 5 years if you are awarded a bursary (so the award can be administered and verified), after which they are deleted or anonymised unless a law requires us to keep them longer. You can ask us to delete your information earlier, subject to any legal obligations.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and request a copy of it;
• ask us to correct or delete information that is inaccurate, out of date, incomplete or unlawfully obtained;
• object to processing on reasonable grounds, and to direct marketing at any time;
• withdraw your consent at any time, without affecting processing that happened before;
• not be subject to a decision based solely on automated processing that significantly affects you;
• lodge a complaint with the Information Regulator.

To use these rights, visit apply.org.za/mydata or contact our Information Officer.

11. Direct marketing

We will not use your bursary application information for direct marketing, and we do not allow funders to do so. You can opt out of any marketing messages from us at any time.

12. Complaints

If you are unhappy with how we have handled your personal information, please contact our Information Officer first so we can try to resolve it. You may also complain to the Information Regulator:

The Information Regulator (South Africa) Website: inforegulator.org.za General enquiries: [email protected] Complaints: [email protected]

13. Changes to this notice

We may update this notice when our services or the law change. The date at the top shows when it was last updated. If we make significant changes, we will tell you through our services.