Privacy notice

Who we are

Panelo is the national register of South African education, training and development practitioners, and the system their work runs on. It is operated by Panelo (the responsible party under POPIA). The Information Officer is Arnold Zumbika, reachable at zumbikaarnoldk@gmail.com. The registration of the Information Officer with the Information Regulator is in progress.

What we collect, and why

• Your account: name, email address, a password or a sign-in by code, and, if you choose, a photo. Needed to run your account and to show providers who they are hiring.
• Your register entry: where you work from, the languages you work in, the capacities you hold, and each registration (the capacity, the qualification, the body, the dates, the registration number). This is what the register is for: providers search it to find practitioners in scope.
• Your documents: the registration letters, certificates and CV you upload so the desk can check your registrations, and an identity document so the desk can confirm you are the person named on them. Documents are kept in a private store; only you and the desk can open them, and a provider that has seated you on an approved panel can open the ones you mark as shared.
• Your identity number: we do not store it. It is sent once over an encrypted connection, turned into a keyed fingerprint that cannot be turned back into the number, and only that fingerprint and the last four characters are kept. The desk sees the last four to match the document; the fingerprint stops the same person registering twice.
• Your work on Panelo: jobs applied for and done, cohorts taught, assessments signed, ratings given and received. These are the record the register exists to keep.
• Learners: a provider enrols a learner by a reference it chooses and an email address or phone number, which Panelo keeps only as a fingerprint; the learner signs in by one-time code. No password, no identity number, no date of birth.
• Payments: when payments are switched on, bank details are held by the licensed payment provider, not by Panelo. Panelo keeps a token, the bank’s name and the last four digits.

What we do not do

• We do not sell personal information, and we do not share it with anyone except as this notice says.
• We do not show your email address, phone number or documents on the public register. The public sees your name, your town, your capacities, your registrations and what the desk checked.
• We do not use your information to train anything, and we do not send marketing without your consent.

Who sees what

• Anyone: the public register entry and the verification lookup (your name, capacities, registrations with their dates and bodies, the verification tier and the date each was checked).
• Providers: the same, plus, once they have seated you on an approved panel, the documents you have marked as shared with panels.
• The Panelo desk: everything you upload, to check it. The desk’s decisions are recorded with who made them and when.
• Service providers: our hosting (Vercel, Supabase, in the European Union; there is no South African data centre available to us), email delivery, and, when payments are on, the licensed payment provider. Each one processes information only on our instructions.

Where it is kept

On servers in the European Union, operated by Supabase and Vercel, under written agreements that meet POPIA’s requirements for sending information across borders (section 72).

How long it is kept

• Your account and register entry: while the account is open, and for 90 days after you close it, in case you change your mind.
• Registration documents: while the registration they support is on the register, and for five years after it lapses, because a provider’s accreditation evidence may be inspected for that long.
• Identity documents: until the desk has checked them, then 30 days.
• Assessment records and portfolios of evidence: five years from the cohort’s close, the period the quality councils ask providers to keep them.
• Audit records of desk decisions: ten years.

Your rights

You may ask what we hold about you, correct it, or ask us to delete it, by writing to the Information Officer. You can see and change most of it yourself under your account. If you believe we have handled your information wrongly you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

Security

Every connection is encrypted. Documents sit in a private store that the public web cannot reach. The desk’s work, every decision and every switch, is written to an audit log that cannot be edited. If personal information is ever accessed without authority, we will tell the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires.

Changes

When this notice changes, the version and date at the top change with it, and account holders are told in their inbox.