Privacy Policy

Effective Date: 21 December 2025

THANDI AI (PTY) LTD (Registration No: 2025/939429/07) (hereinafter "Thandi," "we," "us," or "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

POPIA Registration Number: 2025-068149

1. INFORMATION OFFICER

Name: Seelan Govender

Email: hello@thandi.online

Phone: 0781298701

Physical Address: 170 Innes Road, Morningside, Durban, Kwa-Zulu Natal, 4001

2. PERSONAL INFORMATION WE COLLECT

From Students:

Academic performance data (subjects, marks, grades)

Career interests and personality assessments

Grade level and educational institution type

Contact information (email for results delivery)

Device and browser information (technical logs)

From Schools (Beta Program):

Institutional contact details

Aggregated, anonymized student analytics

Teacher/administrator email addresses

3. HOW WE COLLECT DATA

Directly from students via the assessment platform

Through school partnerships with explicit consent

Automated technical data (cookies, IP addresses)

4. LEGAL BASIS FOR PROCESSING (POPIA)

We process personal information based on:

Consent: Explicit opt-in for students 18+ and from parents/guardians for minors under 18

Legitimate Interest: Providing educational guidance services

Legal Obligation: Compliance with South African education regulations

5. PURPOSE OF PROCESSING

Generate personalized career and university recommendations

Match students with relevant bursary opportunities

Provide educational institutions with aggregated insights

Improve our AI models and service delivery

6. DATA RETENTION

Student assessment data: 12 months from submission date, then anonymized

Account information: Until account deletion is requested

Beta program data: 24 months maximum for research purposes

Anonymized analytics: Retained indefinitely for service improvement

7. DATA SHARING & THIRD PARTIES

We share data only with:

University partners: Anonymized trend data (no individual identifiers)

Bursary providers: Student-initiated applications only

Service providers: Google Cloud (hosting), Vercel (infrastructure) - all GDPR/POPIA compliant

Legal authorities: When required by South African law

WE DO NOT SELL PERSONAL INFORMATION TO THIRD PARTIES

8. SECURITY MEASURES

End-to-end encryption for data in transit (TLS 1.3)

AES-256 encryption for stored data

Regular security audits and penetration testing

Access controls with principle of least privilege

POPIA-compliant data processing agreements with all vendors

9. YOUR POPIA RIGHTS

As a data subject, you have the right to:

Access your personal information (free of charge)

Correct inaccurate information

Delete your data ("right to be forgotten")

Object to processing

Data portability

Lodge a complaint with the Information Regulator

To exercise rights: Email hello@thandi.online with subject "POPIA Request"

10. COOKIES & TRACKING

See our [Cookie Policy](/legal/cookie-policy) for details. You can manage preferences via the cookie banner.

11. CROSS-BORDER DATA TRANSFERS

We store data on Google Cloud servers located in the European Union. All transfers comply with POPIA Section 72 requirements through Standard Contractual Clauses.

12. CHILDREN'S PRIVACY (Under 18)

Explicit parental/guardian consent required for students under 18

Schools must act as intermediaries with documented consent

Age verification measures in place

Limited data collection for minors

13. CHANGES TO THIS POLICY

We will notify users of material changes via email and website banner. Continued use constitutes acceptance.

14. CONTACT

For privacy concerns: hello@thandi.online

For general inquiries: hello@thandi.online

Information Regulator complaints: complaints.IR@justice.gov.za

15. B-BBEE STATUS

Thandi AI (PTY) LTD is a Level 1 B-BBEE Contributor with 100% black ownership.

---

Last Updated: 21 December 2025

POPIA Registration: 2025-068149