POPIA Notice

1. Who We Are

The Responsible Party in respect of the personal information described in this notice is:

2. Information Officer

In line with section 55 of POPIA, Map My Future’s registered Information Officer is:

3. What Personal Information We Process

We process the following broad categories of personal information about our users: contact details (name, email, school), academic information (subjects, marks, grade level), psychometric information (RIASEC, Big Five and career-maturity responses), demographic information (age, grade, province), payment information (handled exclusively by PayFast — we do not store card details), and technical information (IP address, browser type, usage analytics). The full breakdown is set out in the Privacy Policy, section 1.

4. Why We Process Your Personal Information

We process your personal information for the following lawful purposes:

• Generating personalised course matches and a strength profile
• Surfacing bursary opportunities relevant to your profile
• Providing AI-generated course insights on the Pro tier
• Processing Pro tier payments through PayFast
• Service improvement, fraud prevention and security
• Compliance with legal, tax and regulatory obligations
• Sending operational and (where you opt in) product communications

5. Lawful Basis for Processing (POPIA §11)

We rely on one or more of the following lawful bases for processing your personal information:

• Consent — for example, when you submit assessment responses or opt in to communications
• Performance of a contract — to deliver Pro tier services you have paid for
• Legitimate interest — to improve our service, prevent abuse and maintain security
• Compliance with a legal obligation — tax, accounting and audit retention requirements

6. How We Handle Your Information — the Eight POPIA Conditions

POPIA sets out eight conditions for the lawful processing of personal information. In practice, this is what each condition means for Map My Future:

• Accountability — we have appointed an Information Officer and we are accountable for how your personal information is processed by us and our operators.
• Processing limitation — we collect only the information we need to match you to courses and bursaries, and we do so in a fair and lawful manner.
• Purpose specification — we collect personal information for the specific purposes set out in this notice and we tell you what those purposes are upfront.
• Further processing limitation — we do not use your personal information for any purpose that is incompatible with the original purpose of collection.
• Information quality — we take reasonable steps to keep the information we hold accurate and up to date, and you may correct it at any time.
• Openness — this notice, together with the Privacy Policy, sets out openly how we process your information.
• Security safeguards — we use encryption in transit and at rest, access controls, and contractual safeguards with our operators (POPIA §19).
• Data subject participation — you have the right to access, correct, delete and object to processing of your personal information, as set out in section 11 below.

7. Who We Share Information With

7.1 Operators

We share personal information with the following operators (third parties who process information on our behalf, under written agreement):

• Supabase — cloud database and authentication (hosted on Amazon Web Services)
• n8n on Railway — workflow automation for the matching engine
• Anthropic — AI processing of anonymised matching prompts for course insights
• PayFast — Pro tier payment processing
• Email service provider — transactional email delivery

7.2 Regulators

We may disclose personal information to a regulator, law enforcement agency or court where required by law.

7.3 Professional advisors

We may disclose personal information to our auditors, accountants and legal advisors, under duties of confidentiality, where necessary to run the business.

8. Children’s Information (POPIA §35)

Map My Future’s services are designed for students aged 15 to 18. POPIA classifies persons under 18 as children. By accepting these terms and submitting personal information through Map My Future, the user warrants that they have obtained the necessary consent from a parent or legal guardian to do so. Where a parent or guardian becomes aware that their child has used Map My Future without their consent, they may contact our Information Officer to request access to, correction of, or deletion of the child’s personal information.

9. Cross-Border Transfers (POPIA §72)

Several of our operators (including Supabase, Anthropic and Railway) process data on servers located outside the Republic of South Africa. Where personal information is transferred outside South Africa, we rely on one or more of the transfer grounds permitted by section 72 of POPIA: transfer to a jurisdiction with adequate data protection, binding contractual undertakings with the recipient, or the consent of the data subject.

10. How Long We Keep Your Information

In summary: free tier accounts are retained for 24 months from last login, Pro tier accounts for 36 months from purchase, payment records for 5 years (SARS / Companies Act), and anonymised analytics indefinitely. Full detail is set out in the Privacy Policy, section 5.

11. Your Rights as a Data Subject

Under section 5 of POPIA, you have the right to:

• Be notified that your personal information is being collected, and that it has been accessed or acquired by an unauthorised person
• Request access to the personal information we hold about you
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully
• Object to the processing of your personal information on reasonable grounds
• Object to processing for the purposes of direct marketing
• Not be subject to a decision based solely on automated processing where that decision results in legal consequences for you
• Submit a complaint to the Information Regulator (South Africa)
• Institute civil proceedings regarding alleged interference with the protection of your personal information

12. How to Make a Request or Complaint

To exercise any of your rights, or to lodge a complaint about how we have processed your personal information, contact our Information Officer in the first instance:

If you are not satisfied with our response, you may lodge a complaint directly with the Information Regulator (South Africa):

13. Changes to This Notice

We may update this POPIA Notice from time to time to reflect changes in our processing activities, our operators, or the law. The “Last reviewed” date at the top of this page indicates when the notice was last updated. The notice will, at a minimum, be reviewed every two years.