Privacy Policy

1. Introduction

SmartAZ (Pty) Ltd (“SmartAZ”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal information processed through the SmartAZ mobile application, related websites and supporting services.

This Privacy Policy explains:

• what information SmartAZ collects;
• why we collect it;
• how we use, store and protect it;
• when information may be disclosed;
• how long information may be retained; and
• how users may exercise their privacy rights.

SmartAZ processes personal information in accordance with applicable law, including the South African Protection of Personal Information Act 4 of 2013 (“POPIA”).

2. About SmartAZ

SmartAZ is a learning and assessment application that provides educational content, question-based learning, mastery tracking, organisational training, course completion and certificate services.

SmartAZ may provide:

• publicly available learning databases;
• free and paid educational content;
• SmartAZ Teams training supplied through an organisation;
• assessments and learning-progress tracking;
• certificates of completion; and
• certificate-verification services.

SmartAZ does not provide users with a conventional online login account. The app may create a local learner profile and a unique user reference to support app functionality.

3. Information we collect

SmartAZ collects only the information reasonably required to provide its features.

3.1 Name

SmartAZ may collect a user’s first name and surname when these details are required for:

• SmartAZ Teams participation;
• learner identification;
• certificate generation;
• certificate verification; or
• completion records.

A user’s name may be stored in a certificate record and displayed on a generated certificate.

3.2 User identifiers

SmartAZ may collect identifiers such as:

• a SmartAZ-generated user GUID;
• an employee, student or member reference;
• a Teams group code;
• a certificate GUID or certificate number; and
• related internal reference numbers.

The SmartAZ user GUID is an internal identifier. It is not the Google Advertising ID and is not used for advertising or cross-app tracking.

A user GUID may be transmitted when public content is downloaded. A member or employee reference may be transmitted when SmartAZ Teams content is accessed.

3.3 Learning and app-interaction information

Most detailed question and learning-progress information is stored locally on the user’s device.

When certificate or organisational completion services are used, SmartAZ may collect information such as:

• the course, module, subject or database completed;
• topic names and identifiers;
• whether required topics were completed;
• completion percentages;
• assessment or mastery status;
• completion date and time;
• certificate eligibility; and
• the applicable organisation or Teams group.

This information is used to determine completion, issue certificates and verify learning achievements.

3.4 Purchase and entitlement information

Paid SmartAZ content may be purchased through Google Play.

Google processes the user’s payment method and financial transaction. SmartAZ does not receive or store payment-card numbers, banking credentials or other complete payment details.

SmartAZ may receive and process limited purchase information such as:

• product code;
• purchase status;
• purchase token;
• entitlement status; and
• information required to restore or verify a purchase.

This information is used to unlock purchased content, restore access and help prevent unauthorised access or purchase fraud.

3.5 Content-download information

When SmartAZ downloads public or Teams content, the request may include:

• the requested file or database;
• content version;
• catalogue or content-country code;
• SmartAZ user GUID;
• Teams group code; and
• employee or member reference.

A content-country code such as ZA selects the relevant South African catalogue or learning content. It is not obtained from GPS and is not used to determine the user’s physical location.

4. Information SmartAZ does not collect

The current version of SmartAZ does not intentionally collect:

• precise or approximate device location;
• contacts;
• telephone numbers;
• postal addresses;
• emails or SMS messages;
• user photos or videos;
• health or fitness information;
• race, ethnicity, political beliefs, religious beliefs or sexual orientation;
• files or documents selected from the user’s device;
• installed-app information;
• advertising identifiers;
• crash reports or diagnostic databases uploaded by users; or
• information for personalised advertising.

SmartAZ does not currently include a user-submitted bug-report or database-upload facility. This Privacy Policy will be updated before such a feature is introduced.

5. How we use information

5.1 App functionality

Information is used to:

• provide and download learning content;
• identify the correct local learner profile;
• support SmartAZ Teams participation;
• record course or module completion;
• generate certificates;
• provide certificate verification;
• unlock purchased content;
• restore valid purchases; and
• maintain the integrity of learning and certificate records.

5.2 Security and purchase verification

Purchase and entitlement information may be used to:

• verify that a purchase is valid;
• prevent unauthorised unlocking of paid content;
• restore previously purchased content; and
• investigate suspected misuse of purchase or certificate systems.

5.3 Legal and compliance requirements

Information may be processed where reasonably necessary to:

• comply with applicable law;
• respond to a lawful request;
• establish or defend legal rights;
• maintain reliable certificate records; or
• investigate fraud, misuse or security incidents.

SmartAZ does not use personal information for behavioural advertising.

6. Required and optional information

Some information is required for particular SmartAZ functions.

A SmartAZ user GUID may be transmitted when content is downloaded and is therefore required for that download process.

SmartAZ Teams users may be required to provide their:

• first name;
• surname; and
• employee, student or member reference.

These details may be necessary to participate in an assigned programme or receive an identifiable certificate.

Purchase information is collected only when a user chooses to purchase or restore paid content.

Learning-completion information is transmitted when certificate generation, completion verification or organisational reporting requires it.

7. Sharing and disclosure

SmartAZ does not sell personal information.

SmartAZ does not provide identifiable learner information to sponsors for advertising or marketing.

A sponsor may receive aggregated information, such as the total number of learners who accessed or completed sponsored content. Aggregated information will not identify individual users.

Personal information may be processed by service providers that support SmartAZ, including:

• website and server-hosting providers;
• database and certificate-processing infrastructure;
• Google Play for application distribution and purchase processing; and
• technical service providers acting on SmartAZ’s instructions.

Such service providers may process information only to provide the relevant service, subject to appropriate legal and security requirements.

SmartAZ may disclose information where required by law, court order or a lawful regulatory request.

8. Google Play

SmartAZ is distributed through Google Play and may use Google Play Billing for purchases.

Google may independently process information under Google’s own privacy terms and policies. SmartAZ does not control information that Google collects directly through Google Play or the user’s Google account.

SmartAZ does not use the Google Advertising ID and does not use Google Play purchase information for advertising.

9. Advertising and sponsorship

SmartAZ does not contain third-party advertising SDKs and does not display personalised advertisements.

Certain learning content may acknowledge a sponsor. A message such as “Sponsored by PPC Cement” is a sponsorship acknowledgement associated with making educational content available.

A sponsorship acknowledgement:

• does not use an advertising identifier;
• does not track the user across apps;
• is not personalised using user information; and
• does not give the sponsor access to identifiable learner records.

10. Storage and retention

Information stored only in the SmartAZ application remains on the user’s device unless it is transmitted for a function described in this policy.

Server-held information is retained only for as long as reasonably necessary for the purpose for which it was collected, subject to legal, operational, accreditation, fraud-prevention and recordkeeping requirements.

Certificate information may be retained for an extended period so that:

• the certificate can be generated;
• its authenticity can be verified;
• duplicate or fraudulent certificates can be detected; and
• the integrity of the issued credential can be maintained.

Purchase and entitlement information may be retained while required to provide or restore access to purchased content.

Where information is no longer reasonably required and no lawful retention requirement applies, SmartAZ will delete, destroy or de-identify it.

11. Certificate verification

SmartAZ certificates may contain:

• the certificate holder’s name;
• course or module details;
• completion date;
• certificate number; and
• other information required to describe the achievement.

A certificate-verification service may allow another person to confirm that a certificate number is valid.

The public verification result should disclose only the information reasonably necessary to verify the certificate and should not provide detailed question-level learning records.

Users should treat their certificate number as information that may be used to verify their certificate.

12. Security

SmartAZ uses reasonable technical and organisational safeguards designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These safeguards include:

• HTTPS encryption for information transmitted between the app and SmartAZ servers;
• access controls for server-held information;
• limited collection of personal information;
• separation of application content and certificate-processing functions; and
• measures intended to prevent unauthorised certificate and purchase activity.

No electronic system can be guaranteed to be completely secure. SmartAZ will review and improve its safeguards as the service develops.

13. Children and learners

SmartAZ provides educational content that may be used by children and school learners.

SmartAZ seeks to collect only the minimum information required to provide learning, organisational and certificate functions.

Parents, guardians, schools and organisations responsible for assigning SmartAZ content should ensure that they have an appropriate lawful basis and authority for supplying learner information to SmartAZ.

SmartAZ does not knowingly use children’s personal information for advertising, profiling or direct marketing.

A parent or guardian may contact SmartAZ regarding personal information relating to a child for whom they are legally responsible.

14. Organisational and SmartAZ Teams use

Where SmartAZ Teams is provided through an employer, school, university, healthcare facility or another organisation, that organisation may determine:

• who participates;
• which programme is assigned;
• which member reference is used;
• whether completion is compulsory; and
• which authorised organisational representatives may receive completion information.

Depending on the arrangement, the organisation and SmartAZ may each have responsibilities under applicable privacy law.

SmartAZ will not disclose Teams information beyond what is reasonably required to provide the agreed training, completion and certificate services.

Users may also contact the organisation that assigned the programme regarding its own processing of their information.

15. International processing

SmartAZ’s services and service providers may process or store information using infrastructure located outside the user’s province or country.

Where personal information is transferred across borders, SmartAZ will take reasonable steps to ensure that the transfer is permitted and that appropriate protection applies as required by applicable law.

16. Your privacy rights

Subject to applicable law, users may ask SmartAZ to:

• confirm whether SmartAZ holds their personal information;
• provide access to eligible personal information;
• correct inaccurate or incomplete information;
• object to certain processing;
• request deletion or destruction of eligible information; or
• explain how their personal information is being used.

Some information may not be deleted immediately where SmartAZ must retain it for lawful recordkeeping, certificate verification, fraud prevention, dispute handling or another legitimate legal purpose.

Deleting or changing information associated with a certificate may affect the ability to verify that certificate.

SmartAZ may request reasonable proof of identity before acting on a privacy request.

17. How to submit a privacy or deletion request

Privacy, correction and deletion requests may be submitted to:

Please include enough information for SmartAZ to locate the relevant record, such as:

• the user’s name;
• SmartAZ user GUID, where available;
• employee or member reference, where applicable;
• Teams group code;
• certificate number; and
• a description of the request.

Do not send passwords, complete payment-card details or banking credentials.

18. Complaints

Users are encouraged to contact SmartAZ first so that we can investigate and address a privacy concern.

A user may also lodge a complaint with the South African Information Regulator where applicable.

Information about the Information Regulator is available from its official website.

19. Third-party websites and services

SmartAZ may provide links to websites or services that are not controlled by SmartAZ.

When a user chooses to open an external website, the privacy practices of that website or service will apply. SmartAZ is not responsible for the privacy practices of independent third parties.

20. Changes to this Privacy Policy

SmartAZ may update this Privacy Policy when:

• application features change;
• new data-processing activities are introduced;
• legal or regulatory requirements change; or
• security and operational practices are updated.

The revised policy will display an updated effective date.

Material changes may also be communicated through the SmartAZ application, website or store listing where appropriate.

21. Contact details

For questions concerning this Privacy Policy or SmartAZ’s handling of personal information, contact the privacy email address above.