Privacy Policy
Protection of Personal Information Act 4 of 2013 (POPIA) · Version 2026.09 · Effective 1 September 2026
1. Responsible party
Partum Solutions (Pty) Ltd is the responsible party for personal information processed in EDUFIN, except where an institution remains responsible for the student records it captures (the institution is then a responsible party and Partum is an operator for that processing, as agreed in the MOU).
2. Information we process
Organisation details (legal name, registration, address, contacts, financial year). User accounts (name, job title, email, role, authentication data, notification preferences, IP and user-agent on login and legal acceptance). Funding records (amounts, invoices, proofs of payment, stages, audit events). Student records captured by institutions: student number, race, gender, citizenship, disability, geography, qualification, fees and funding need, campus, documents (including identity copies, settlements, bursary agreements, EA1 unemployed declarations, and medical certificates where disability is recorded), and student consent timestamps. We do not use student information for marketing.
3. Lawful bases (POPIA)
- Contract: administering agreements, invoices, and funding rounds with funders and institutions.
- Consent: student records (institution-captured consent) and institutional sharing consent recorded in EDUFIN; user acceptance of this policy.
- Legitimate interest / legal obligation: security logs, fraud prevention, B-BBEE and Skills Development evidence packs the funder is entitled to receive, and retention required by law or audit.
Special personal information (race, disability, medical certificate) is processed only because it is required for the funding type the funder selected (typically B-BBEE SED or Skills Development bursaries) and with recorded consents.
4. Sharing
We share personal information only as needed for a round: with the relevant funder (aggregated or as required for evidence, not bulk student dumps beyond the funded cohort), with the relevant institution, with Partum operators, and with professional advisers or regulators where required. Hosting and email providers process data as operators under contract. We do not sell personal information.
5. Cross-border
EDUFIN is intended to be hosted in South Africa. If a subprocessors is outside the Republic, we will only transfer subject to POPIA section 72 safeguards.
6. Security
Access is role-based. Funders do not receive a general student database. Downloads of stored files use short-lived signed links. Passwords are hashed. MFA is required for designated roles. Uploads are type-checked. Closed rounds are locked. Database foreign keys, unique constraints, and audit logs reduce accidental or unauthorised alteration. No method is perfect; report suspected incidents to Partum immediately.
7. Retention
Account and funding records are kept for the life of the organisation relationship and the audit period of closed rounds. Identity copies and settlement statements may be purged after the configured retention period (default five years). Legal acceptances and institutional POPIA consents are kept to demonstrate compliance.
8. Your rights
You may request access, correction, or deletion where POPIA allows, object to processing, or withdraw consent where processing is consent-based (withdrawal may mean we cannot continue funding administration). You may lodge a complaint with the Information Regulator (South Africa). Users can update notification preferences in Settings. Institutions manage student records in the institution portal.
9. Children
EDUFIN is not directed at children. Higher-education student records are expected to concern adults. If a record concerns a child, the institution must ensure a competent person consents as required by POPIA.
10. Contact
Privacy requests: through your Partum relationship contact or the email used for portal administration. This policy is version 2026.09. Material changes require users to accept the updated governance bundle.