POPIA Privacy Notice

Effective date: 14 September 2026 · Version: v2.2

1. Responsible party

MIKS CUBED FOUNDATION NPC ("MiksCubed Foundation", "we", "us" or "our") is the responsible party for Personal Information collected through the MiksCubed Foundation website, registration process and K53 learning programme, except where another organisation is clearly identified as independently responsible for its own processing.

2. South African privacy framework

We process Personal Information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African law. Where a request concerns access to records, the Promotion of Access to Information Act 2 of 2000 ("PAIA") may also apply.

3. Information we collect

3.1 Personal and contact information

• first name(s) and surname;
• date of birth and calculated age category;
• gender;
• mobile number and email address;
• preferred contact method;
• residential address and, if supplied, temporary address.

3.2 Identification information

• South African identity number where that identification type is selected;
• passport number where passport identification is selected;
• for a Minor, the required Competent Person's identity number.

3.3 Demographic and profile information

We may ask for information such as race or population group, education, employment status, employer details, occupation, industry sector, length of service and income range. Where the live form marks a field optional or provides "Prefer not to say", you may use that option.

Where supplied, information such as race or population group may constitute Special Personal Information and will be handled with appropriate care and only for the stated programme, research, transformation, demographic or impact-measurement purposes.

3.4 Education, driving and programme information

• highest education level and current institution where applicable;
• further-study plans;
• current learner's-licence journey and driver's-licence timeframe;
• driving lessons and vehicle-experience information;
• learning preferences and areas where support is wanted;
• referral source and optional comments;
• Moodle learning activity, progress, results and course-completion information.

3.5 Parent / guardian information

Where a learner is under 18, at least one Competent Person must provide the required details, including full name, relationship to the learner, identity number, contact number and email address. We also record the guardian's registration consent and authority confirmation.

3.6 Technical, registration and consent information

We may record a participant identifier, Moodle user identifier, enrolment status, registration status, consent date and time, Terms and Privacy Notice version, consent scope, actor type, protected technical audit values, campaign/referral parameters and security-related logs.

4. Core purposes of processing

We process Personal Information where reasonably necessary to:

• create and administer your MiksCubed participant profile;
• create, locate and administer your Moodle learning account;
• enrol you in the MiksCubed K53 programme;
• deliver and improve learning content and programme functionality;
• track participation, progress, learning activity and results;
• send account, programme, support and security communications;
• confirm guardian authorisation for Minors;
• prevent duplicate, fraudulent, abusive or unauthorised registrations;
• provide support and respond to enquiries;
• perform internal analytics, quality assurance, research and programme improvement;
• produce aggregated or de-identified impact reporting;
• comply with applicable legal and record-keeping obligations.

5. Lawful basis and required acknowledgement

Depending on the purpose, processing may be based on consent, performance of the programme or service requested, compliance with law, protection of a legitimate interest where permitted by POPIA, or another lawful ground.

Registration requires acceptance of the Terms and acknowledgement of this Privacy Notice. This required acknowledgement does not automatically provide permission for optional Commercial Processing or direct marketing.

6. Minors

A participant under 18 is treated as a Minor for the registration process. The Minor's registration must include the required details and consent of a Competent Person. The learner's own completion of the form does not replace required guardian authorisation.

The Competent Person may exercise applicable privacy rights on behalf of the Minor and also has rights in relation to their own Personal Information.

7. Optional Commercial Processing and direct marketing

MiksCubed Foundation's Terms provide for a separate, voluntary opt-in for Commercial Processing. Declining this option does not prevent registration for or use of the core K53 programme.

If you, or the Competent Person for a Minor, select Yes to the optional Commercial Processing choice, permitted Personal Information may be commercialised, disclosed, licensed, shared and/or sold within the MiksCubed Group or to selected Third Parties for lawful commercial purposes. These purposes may include:

• commercial and programme partnerships;
• marketing and market research;
• analytics and statistical products;
• development, testing or improvement of analytics, artificial-intelligence or machine-learning systems;
• direct marketing of MiksCubed, Group or selected Third-Party products and services;
• other lawful commercial uses within the clearly stated consent scope.

Possible Third-Party categories may include driving schools and instructors, vehicle dealerships and manufacturers, insurers and insurance intermediaries, financial-services providers, advertising and market-research businesses, analytics providers, artificial-intelligence or machine-learning businesses and data-service providers.

Where direct marketing is enabled, we will use only the communication channels selected during registration or subsequently authorised. Available channels may include email, SMS, WhatsApp and telephone.

You may withdraw optional consent at any time, free of charge, by contacting the Information Officer or using an available unsubscribe/opt-out mechanism. Withdrawal does not remove the lawfulness of processing carried out before withdrawal and does not terminate your access to the core K53 Services.

8. Moodle and service providers

The registration system sends account information such as your name, surname, email address and account credentials to the MiksCubed Moodle environment so that the learner account can be created or located and enrolled into the appropriate course. We may store the Moodle user ID and enrolment result in the participant database for administration and support.

Hosting, cloud, email, communications, IT, security, professional-adviser and other service providers may process Personal Information where reasonably necessary to provide services to MiksCubed Foundation.

9. Corporate and funding partners

Corporate or funding partners may receive aggregated or de-identified programme reports showing matters such as programme reach, participation, location, engagement and learning outcomes. Funding a programme does not by itself give a partner access to identifiable participant information.

Identifiable information will only be provided where a lawful basis exists, including where the relevant optional consent has been given when required.

10. Cross-border processing

Some cloud or technology service providers may use infrastructure outside South Africa. Where Personal Information is transferred across borders, MiksCubed Foundation will take reasonable steps to manage the transfer in accordance with applicable POPIA requirements.

11. Security safeguards

We take appropriate and reasonable technical and organisational measures designed to protect Personal Information against loss, misuse, unauthorised access, alteration, destruction or disclosure.

Measures may include access controls, secure credentials, restricted administrative access, database controls, security updates, audit records and backups. Identification-document images are stored outside the public website directory with restricted file permissions, use randomly generated storage names, and the registration endpoint requires HTTPS for the upload.

12. Retention

Personal Information is retained only for as long as reasonably necessary for the purpose for which it was collected, for legitimate programme, audit and record-keeping needs, or where a longer period is required or permitted by law. Verification Information is intended to be retained for approximately 90 days after successful verification, unless a longer period is required by law or is reasonably necessary for fraud prevention, a dispute or another lawful purpose. When no longer required, information will be securely deleted, destroyed or de-identified as appropriate.

13. Consent records

To maintain evidence of consent and accountability, we may store the selection made, consent scope, date and time, version of the Terms and Privacy Notice, actor type (participant or Competent Person), and a protected technical audit value such as an IP-address hash.

14. Your rights

Subject to POPIA and other applicable law, you may have the right to:

• ask whether we hold Personal Information about you;
• request access to Personal Information;
• request correction or updating of inaccurate or incomplete information;
• request deletion or destruction where legally appropriate;
• object to certain processing;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• raise a privacy complaint; and
• lodge a complaint with the Information Regulator.

15. Exercising your rights

We may need to verify your identity or authority before acting on a request. For a request concerning a Minor, we may also need to verify the authority of the Competent Person.

16. Information Regulator (South Africa)

You may also contact or submit an applicable complaint to the Information Regulator (South Africa). Current contact and eServices information is available from the Information Regulator's official portal.

17. PAIA

Requests for access to records under PAIA may be directed to the Information Officer. A PAIA manual, where applicable, may be requested from the Information Officer.

18. Cookies and tracking technologies

The website may use essential cookies or similar technologies for functionality, authentication, preferences and security. If optional analytics or marketing technologies are deployed, they will be described in the applicable cookie notice and appropriate choices will be provided where required.

19. Changes to this Notice

We may update this Notice when our programmes, systems, service providers, processing activities or legal obligations change. The effective date and version shown above identify the current published version. Where a material change requires fresh consent, we will request that consent before relying on the expanded purpose.

20. Contact