POPIA Compliance Statement
Last updated: 29 June 2026
Vula is committed to processing personal information lawfully and responsibly in terms of the Protection of Personal Information Act, 2013 (POPIA). This statement explains how we meet the eight conditions for the lawful processing of personal information.
The 8 conditions, and how we meet them
1. Accountability
Our appointed Information Officer, Kyal Stahl, is responsible for ensuring our compliance with POPIA. Contact: privacy@vulacareers.co.za.
2. Processing limitation
We process personal information lawfully, with consent, and only to the extent needed to provide career guidance. We collect the minimum information required (name, surname, age, province, WhatsApp number and assessment answers).
3. Purpose specification
We collect information for the specific, explicitly defined purpose of generating career guidance and showing learners courses and bursaries from sponsoring institutions that match their profile. We do not use it for unrelated purposes.
4. Further processing limitation
Any further use of information will be compatible with the original purpose for which it was collected, or we will obtain fresh consent.
5. Information quality
Because learners enter their own information, we take reasonable steps to keep it accurate and current, and we allow learners (or their parents/guardians) to correct it.
6. Openness
We are transparent about what we collect and why, through our Privacy Policy and the consent we request at the start of the assessment.
7. Security safeguards
We protect personal information with reasonable technical and organisational measures, and we require our service providers (Operators) to do the same under contract. We will report breaches to the Information Regulator and affected users as required.
8. Data subject participation
Learners and their parents/guardians may request access to, correction of, or deletion of their information at any time.
Special focus: children's information
Because Vula is open from age 12 and many users are under 18, we treat the information of any user under 18 as a special category. We require the consent of a parent or legal guardian (a "competent person") and will delete a child's information on request. See section 6 of the Privacy Policy.
Special focus: sharing with institutions
We do not share a learner's personal information with educational institutions or bursary providers. Vula is funded by sponsoring institutions who pay to have their courses featured in a learner's results; this is anonymous exposure, not a data share, and contacting a sponsor is always the learner's own choice.
Operators (service providers)
We use the following Operators, who process personal information on our behalf under data-processing terms: Twilio (messaging), Supabase (database), Vercel (hosting) and Anthropic (AI text processing). Some may process data outside South Africa under section 72 safeguards.
PAIA
In terms of the Promotion of Access to Information Act, 2000 (PAIA), our information manual is available on request from privacy@vulacareers.co.za.
Contact & complaints
Information Officer: Kyal Stahl — privacy@vulacareers.co.za.
You may also complain to the Information Regulator (South Africa), POPIAComplaints@inforegulator.org.za, inforegulator.org.za.