POPIA Compliance Statement

Last updated: 29 June 2026

⚠️ Complete the green placeholders and have this reviewed by a qualified attorney before publishing. This statement summarises how Vula aims to comply with POPIA; full detail is in our Privacy Policy.

Vula is committed to processing personal information lawfully and responsibly in terms of the Protection of Personal Information Act, 2013 (POPIA). This statement explains how we meet the eight conditions for the lawful processing of personal information.

The 8 conditions, and how we meet them

1. Accountability

Our appointed Information Officer, [Name], is responsible for ensuring our compliance with POPIA. Contact: privacy@vulacareers.co.za.

2. Processing limitation

We process personal information lawfully, with consent, and only to the extent needed to provide career guidance. We collect the minimum information required (name, age, school, suburb, grade, WhatsApp number and assessment answers).

3. Purpose specification

We collect information for the specific, explicitly defined purpose of generating career guidance and, with consent, connecting learners to relevant institutions and bursaries. We do not use it for unrelated purposes.

4. Further processing limitation

Any further use of information will be compatible with the original purpose for which it was collected, or we will obtain fresh consent.

5. Information quality

Because learners enter their own information, we take reasonable steps to keep it accurate and current, and we allow learners (or their parents/guardians) to correct it.

6. Openness

We are transparent about what we collect and why, through our Privacy Policy and the consent we request at the start of the assessment.

7. Security safeguards

We protect personal information with reasonable technical and organisational measures, and we require our service providers (Operators) to do the same under contract. We will report breaches to the Information Regulator and affected users as required.

8. Data subject participation

Learners and their parents/guardians may request access to, correction of, or deletion of their information at any time.

Special focus: children's information

Because Vula serves learners who may be under 18, we treat their information as a special category. We require the consent of a parent or legal guardian (a "competent person") and will delete a child's information on request. See section 6 of the Privacy Policy.

Special focus: sharing with institutions

We only share a learner's information with educational institutions or bursary providers where the learner (or their parent/guardian) has given specific consent to be contacted. Consent can be withdrawn at any time.

Operators (service providers)

We use the following Operators, who process personal information on our behalf under data-processing terms: Twilio (messaging), Supabase (database), Vercel (hosting) and Anthropic (AI text processing). Some may process data outside South Africa under section 72 safeguards.

PAIA

In terms of the Promotion of Access to Information Act, 2000 (PAIA), our information manual is available on request from privacy@vulacareers.co.za. [Attach or link your PAIA manual once prepared.]

Contact & complaints

Information Officer: [Name, privacy@yourdomain].
You may also complain to the Information Regulator (South Africa), POPIAComplaints@inforegulator.org.za, inforegulator.org.za.