Privacy Policy
Effective Date: 21 December 2025
THANDI AI (PTY) LTD (Registration No: 2025/939429/07) (hereinafter "Thandi.ai," "we," "us," or "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).
POPIA Registration Number: 2025-068149
1. INFORMATION OFFICER
Name: Seelan Govender
Email: hello@thandi.online
Phone: 0781298701
Physical Address: 170 Innes Road, Morningside, Durban, Kwa-Zulu Natal, 4001
2. PERSONAL INFORMATION WE COLLECT
From Students:
Academic performance data (subjects, marks, grades)
Career interests and personality assessments
Grade level and educational institution type
Contact information (email for results delivery)
Device and browser information (technical logs)
From Schools (Beta Program):
Institutional contact details
Aggregated, anonymized student analytics
Teacher/administrator email addresses
3. HOW WE COLLECT DATA
Directly from students via the assessment platform
Through school partnerships with explicit consent
Automated technical data (cookies, IP addresses)
4. LEGAL BASIS FOR PROCESSING (POPIA)
We process personal information based on:
Consent: Explicit opt-in for students 18+ and from parents/guardians for minors under 18
Legitimate Interest: Providing educational guidance services
Legal Obligation: Compliance with South African education regulations
5. PURPOSE OF PROCESSING
Generate personalized career and university recommendations
Match students with relevant bursary opportunities
Provide educational institutions with aggregated insights
Improve our AI models and service delivery
6. DATA RETENTION
Student assessment data: 12 months from submission date, then anonymized
Account information: Until account deletion is requested
Beta program data: 24 months maximum for research purposes
Anonymized analytics: Retained indefinitely for service improvement
7. DATA SHARING & THIRD PARTIES
We share data only with:
University partners: Anonymized trend data (no individual identifiers)
Bursary providers: Student-initiated applications only
Service providers: Google Cloud (hosting), Vercel (infrastructure) - all GDPR/POPIA compliant
Legal authorities: When required by South African law
WE DO NOT SELL PERSONAL INFORMATION TO THIRD PARTIES
8. SECURITY MEASURES
End-to-end encryption for data in transit (TLS 1.3)
AES-256 encryption for stored data
Regular security audits and penetration testing
Access controls with principle of least privilege
POPIA-compliant data processing agreements with all vendors
9. YOUR POPIA RIGHTS
As a data subject, you have the right to:
Access your personal information (free of charge)
Correct inaccurate information
Delete your data ("right to be forgotten")
Object to processing
Data portability
Lodge a complaint with the Information Regulator
To exercise rights: Email hello@thandi.online with subject "POPIA Request"
10. COOKIES & TRACKING
See our [Cookie Policy](/legal/cookie-policy) for details. You can manage preferences via the cookie banner.
11. CROSS-BORDER DATA TRANSFERS
We store data on Google Cloud servers located in the European Union. All transfers comply with POPIA Section 72 requirements through Standard Contractual Clauses.
12. CHILDREN'S PRIVACY (Under 18)
Explicit parental/guardian consent required for students under 18
Schools must act as intermediaries with documented consent
Age verification measures in place
Limited data collection for minors
13. CHANGES TO THIS POLICY
We will notify users of material changes via email and website banner. Continued use constitutes acceptance.
14. CONTACT
For privacy concerns: hello@thandi.online
For general inquiries: hello@thandi.online
Information Regulator complaints: complaints.IR@justice.gov.za
15. B-BBEE STATUS
Thandi AI (PTY) LTD is a Level 1 B-BBEE Contributor with 100% black ownership.
---
Last Updated: 21 December 2025
POPIA Registration: 2025-068149