PROTECTION OF PERSONAL INFORMATION NOTICE

The Ikusasa Student Financial Aid Programme NPC (“ISFAP”, “we”, “our”, or “us”) is a non-profit company (Registration Number: 2016/533748/08) that provides and facilitates comprehensive support to South African students in tertiary education who come from low-income and “missing middle” households. Our services include bursary management, academic support, psychosocial interventions, and related stakeholder engagement.

This Notice outlines what, how, and why we collect, use, store, and share personal information from applicants, students, alumni, donors, funders, employees, service providers, and other individuals (“you”). This includes interactions through our website, student support platforms, chatbots, funding portals, employee systems, and other communication channels.

“Processing” refers to any action taken in relation to your personal information, including (but not limited to) the recording, organising, collation, storage, updating or modification, retrieval, alteration, consultation, and use of such information; as well as its dissemination by means of transmission, distribution, or making it available in any other form, and the merging, linking, restriction, blocking, degradation, erasure, or destruction of the information, as prescribed by applicable legislation.

ISFAP respects your privacy and recognises the importance of protecting your personal information. Accordingly, all personal information in our possession is handled in accordance with the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”), and we have implemented the necessary policies and procedures to ensure ongoing compliance with the conditions for lawful processing.

Why We Collect and Process Your Personal Information:

The purpose of collecting your personal information depends on your relationship with ISFAP, and the operational, contractual, or regulatory requirements necessary to deliver our services or meet our obligations. We only process personal information where it is necessary, lawful, and relevant to the fulfilment of that purpose. This includes, but is not limited to:

Facilitating the application and selection of students for funding;
Verifying identity, household income, academic status, and eligibility;
Administering financial, academic, and psychosocial support;
Processing payments and reimbursements;
Fulfilling contractual obligations with students, funders, and service providers;
Managing relationships with our stakeholders, including universities, donors, and suppliers;
Complying with audit, legal, and regulatory requirements;
Carrying out Internal reporting, research, and analytics; and
HR and internal governance processes (for employees, board, and committee members).

Personal Information Collected & Processed:

Personal information refers to information that relates to an identified or identifiable natural or juristic person and can be linked to that person through an identifying factor, as defined under applicable data protection laws. The personal information we collect, and process may vary depending on the specific purpose for which it is required, and may include, but is not limited to, the following:

General Personal Information:
- Your full name, identity, or passport number;
- Contact details (e.g., telephone numbers, email addresses, physical/postal addresses);
- Gender, nationality, and other demographic details;
- Employment information, qualifications, or designations; and
- Banking details, income information, payment history, tax, and VAT numbers.
Education and Academic Information:
- Your academic records, student numbers, institution details;
- Certifications, course enrolments, progress reports, exam results; and
- Support interventions or academic assistance provided or undertaken.
Special Personal Information:
- Racial or ethnic origin;
- Health or mental health information (including disability status);
- Biometric data (e.g., facial images, fingerprints, where applicable);
- Criminal background (where relevant); and
- Information relating to children, where applicable and with appropriate guardian consent.

Recipients and Disclosure of Personal Information:

Our employees may access your personal information for the administration and management of services, as well as to support various stakeholder relationships. Further to this, your personal information may also be shared with authorised third parties for purposes such as verification, auditing, and reporting, subject to the specific purpose/s for which it was originally collected and processed. Parties that may have access to your personal information include, but are not limited to:

Operators, who process personal information externally on our behalf in terms of a contract or mandate, without coming under our direct authority e.g., service providers etc.;
Institutions of higher education, academic partners, or similar entities;
Reciprocal entities, linked Funders and managing agencies;
Oversight or regulatory bodies, including government departments and statutory agencies;
ISFAP’s Board of Directors, sub-committees, or authorised governance structures; and
Law enforcement authorities or courts when required by law.

All third parties who process your information on our behalf are required to do so under strict confidentiality and in compliance with POPIA.

Cross-Border Transfers of Personal Information:

Your personal information may be transferred to or accessed from countries outside of South Africa, where necessary for the purposes of service delivery, regulatory compliance, or in accordance with our contractual obligations. Your personal information will only be shared in such instances where the relevant third country or international organisation provides a level of protection for personal information that is comparable to, or adequate under, the requirements of POPIA and/or the European Union’s General Data Protection Regulation (GDPR).

In the event in which we transfer your personal information to a country where the data privacy laws are not equivalent to those of the European Economic Area (EEA) or the Republic of South Africa (RSA), we will take all necessary steps to ensure that your information is adequately protected in accordance with applicable data protection laws.

Protection and Retention of Your Personal Information:

We are committed to securing the integrity and confidentiality of personal information in our possession or under our control. To achieve this, we have implemented appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, misuse, destruction, alteration, or disclosure, regardless of the format in which it is held.

We will retain your personal information only for as long as necessary to fulfil the purpose for which it was originally collected or subsequently processed, unless:

a longer retention period is required or authorised by applicable law;
retention is reasonably necessary for lawful purposes related to our functions or operational requirements;
retention is required to fulfil contractual obligations; or
you (or a competent person, where you are a minor) have given valid consent for longer retention.

We may also retain personal information for extended periods where necessary for historical, statistical, or research purposes, provided that appropriate safeguards are in place to prevent the use of such information for any other purpose.

Where your personal information has been used to make a decision about you, we will retain the relevant record for a period:

required or prescribed by law or a code of conduct; or
if no specific legal requirement exists, for a period sufficient to afford you a reasonable opportunity to request access to the record, taking all relevant considerations into account.

Your Rights:

The Protection of Personal Information Act (POPIA) grants you, as a data subject, specific rights which you may exercise, where applicable, in relation to the personal information we process. You have the right to:

Be informed when your personal information is being collected;
Be informed if your personal information has been accessed or acquired by an unauthorised person;
Request confirmation as to whether we hold any personal information about you;
Request access to the personal information we hold about you, including details of third parties or categories of third parties who have, or have had, access to your information;
Request the correction or deletion of your personal information in our possession or under our control, where such information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or was unlawfully obtained;
Request the destruction or deletion of a record of your personal information where we are no longer authorised to retain it;
Object to the processing of your personal information, on reasonable grounds relating to your particular situation, unless the processing is required or authorised by law;
Object to the processing of your personal information for purposes of direct marketing;
Request that the processing of your personal information be restricted in certain circumstances, in accordance with applicable law; and
Request the transfer of your personal information to another responsible party, where reasonably practicable and subject to applicable legal requirements.

How to Contact Us Regarding Your Information:

If you have any questions about this Notice or would like to exercise any of your rights, you may contact us at:

📞 Tel: 087 805 8500

📧 Email: protectpidata@isfap.org.za

🌐 Website: www.isfap.org.za

For formal access to information requests, please complete the prescribed request form available in our Promotion of Access to Information Act (PAIA) Manual, accessible on our website at: https://www.isfap.org.za/wp-content/uploads/2023/04/ISFAP-PAIA-Manual.pdf.