Privacy notice (POPIA)

Version 0.1 (proof of concept) – 14 October 2026. To be reviewed before launch and before any formal agreement with an issuing organisation.

1. Who we are

DigitalBadges is operated by [Company name] (Pty) Ltd (placeholder – to be confirmed) ("we"). For student badge data, the issuing organisation (for example Wits Plus) is the responsible party and we act as its operator under the Protection of Personal Information Act 4 of 2013 (POPIA). For platform accounts, website enquiries and our own newsletter we are the responsible party.

Information Officer: Nico Baird, Director, [Company name] (Pty) Ltd – operator of DigitalBadges (placeholder) – privacy@digitalbadges.co.za.

2. What we collect

• Name and the email address(es) you choose to hold your badges, verified by one-time codes.
• Badge records: which milestone badge you claimed, when, from which course, and its status.
• Security data: hashed IP address and timestamps of sign-ins and claim attempts, to prevent abuse.
• Your consent choices (terms, privacy notice, disclaimer, optional newsletters).

We do not collect ID numbers, student numbers, grades, special personal information or payment card data. We do not receive your LMS (e.g. Canvas) password or profile.

3. Why (purpose and lawful basis)

• To record and show your milestone badges – performance of the service you request (s11(1)(b)) and the issuer's legitimate interest in motivating students (s11(1)(f)).
• To secure the platform and prevent fraudulent claims – legitimate interest.
• Newsletters about other courses – only with your opt-in consent (s69); you can unsubscribe at any time.

4. Sharing

Your badges are private by default. The issuing organisation can see the badges claimed in its courses and the email you used. If you make a badge public, anyone with its verification link can see your name, the badge and the date. We use service providers (hosting, email delivery) bound by operator agreements. We do not sell personal information.

5. Where and how long

Production data will be hosted in South Africa where possible. Badge records are kept while your account is active; deleted accounts are removed within 30 days (anonymised statistics may remain). Security logs are kept for 12 months.

6. Your rights

You may access, correct, export or delete your data from your dashboard, withdraw consent, object to processing, and complain to the Information Regulator (inforegulator.org.za). Contact the Information Officer above.

7. Security

Encryption in transit, hashed codes and tokens, rate limiting, audit logs, tenant isolation between issuing organisations, and least-privilege access. Breaches will be notified as required by s22 of POPIA.