Privacy & Data Protection Policy

This Privacy & Data Protection Policy explains how Artificial Intelligence Skills Development Institute (Pty) Ltd (t/a AISDI™) collects, uses, stores, shares, protects, and manages personal information.

AISDI™ is established in South Africa and processes personal information in accordance with the Protection of Personal Information Act, 2013. Where another privacy or data-protection law applies to a user or to AISDI™’s processing activities, AISDI™ will also process personal information in accordance with the applicable mandatory requirements of that law.

This Policy should be read together with the AISDI™ Terms & Conditions, Cookie & Tracking Notice, Communications & Marketing Policy, and Intellectual Property & Content Policy.

1. Who we are

AISDI™ is operated by:

For purposes of South African privacy law, AISDI™ is generally the responsible party for personal information processed through its website, direct subscriptions, learner accounts, ALMA™ interactions, customer communications, and direct learning services.

For purposes of GDPR, UK GDPR, and similar data-protection laws, AISDI™ is generally the controller for direct website visitors, direct learners, direct subscribers, and direct account users.

Where AISDI™ provides services to a business, institution, reseller, partner, or enterprise customer, AISDI™ may act as a controller, responsible party, operator, processor, or service provider depending on the agreement, the data involved, and the customer’s role in providing learner data.

2. Scope of this Policy

This Policy applies to personal information processed through or in connection with:

1. AISDI™ websites and web pages.
2. AISDI™ user accounts and registration flows.
3. Free, no-charge, trial, promotional, and evaluation access.
4. Paid subscriptions, course passes, bundles, and other access models.
5. Website commerce, checkout, subscription billing, customer portal, and payment flows.
6. Controlled digital course delivery and learning access.
7. ALMA™ and ALMA Activities™.
8. Certificates, validated completion records, and learning records.
9. Third-party sign-in, including Google sign-in where selected.
10. Website analytics, testing, live chat, and campaign measurement where enabled.
11. Support requests, live chat, email communications, enquiry forms, and marketing communications.
12. Business, enterprise, partner, reseller, and organizational access arrangements.

In this Policy, “personal information” includes “personal data” and similar terms used under other privacy laws.

3. Data controller and responsible-party position

AISDI™ determines why and how most direct-user personal information is processed. This includes account registration, course access, subscription administration, learning progress, certificates, ALMA™ interactions, website analytics, customer support, billing records, and marketing preferences.

Where a business, institution, reseller, partner, or enterprise customer provides learner details to AISDI™ or requires learner reporting, the customer may also be a controller or responsible party for that learner data. In those cases, the customer is responsible for providing its own privacy notices and obtaining any required authorizations from its learners, employees, contractors, or users.

AISDI™ may process personal information as an operator, processor, or service provider where a written agreement states that AISDI™ processes personal information on behalf of a customer and according to that customer’s lawful instructions.

4. Personal information we collect

AISDI™ may collect the following categories of personal information.

AISDI™ does not intentionally request special personal information, sensitive personal data, health information, financial account passwords, identity documents, private third-party information, or confidential customer information unless a specific process requires it and appropriate safeguards are applied.

Users should avoid entering sensitive personal information, confidential business information, third-party personal information, regulated data, or private documents into ALMA™, support messages, forms, or course activities unless they have the right to provide that information and understand how it will be processed.

5. How we collect information

AISDI™ collects personal information in the following ways:

1. Directly from you when you register, sign in, subscribe, complete checkout, use free access, contact support, complete forms, use ALMA™, complete course activities, request a certificate, cancel a subscription, or communicate with AISDI™.
2. Automatically through the website and learning environment when you browse pages, access courses, interact with the platform, use cookies, use ALMA™, complete activities, or trigger analytics and security logs.
3. Through payment and billing providers when payment, subscription, banking, card network, or billing systems process purchases, renewals, failed payments, refunds, chargebacks, or billing updates.
4. Through authentication providers when you use Google sign-in or another supported sign-in method.
5. Through course-delivery and learning-access systems when you access AISDI™ courses.
6. Through business, enterprise, or partner arrangements where an organization, reseller, partner, employer, institution, or administrator provides learner or account information to AISDI™.
7. Through marketing, CRM, live chat, support, and communication tools when you engage with AISDI™ campaigns, newsletters, enquiry forms, chat tools, forms, emails, or related communications.
8. Through service providers and technical systems that help AISDI™ operate, secure, monitor, improve, and support the services.

6. How we use personal information

AISDI™ uses personal information for the following purposes.

Where AISDI™ relies on consent, you may withdraw consent where the law allows. Withdrawal of consent does not affect processing that occurred before withdrawal, and it may not affect processing required for contract, legal, security, billing, or operational reasons.

7. ALMA™ interactions and learning data

ALMA™ is an embedded AI co-learning interface within the AISDI™ learning experience. AISDI™ courses combine structured course content, ALMA™, ALMA Activities™, learner judgment, and practical application.

When you use ALMA™, AISDI™ may process:

1. Your prompts, questions, instructions, and uploaded or pasted text.
2. ALMA™ responses and interaction history.
3. Course context needed to support your learning interaction.
4. ALMA Activities™ and related activity responses.
5. Usage metadata, timestamps, account identifiers, course identifiers, and technical logs.
6. Feedback, flagged responses, support records, or issue reports related to ALMA™.

AISDI™ stores ALMA™ interactions in its systems or databases so that it can provide the learning experience, support users, secure the platform, understand usage patterns, diagnose issues, improve course design, and support future learner-facing or customer-facing analytics where permitted.

AISDI™ may use aggregated, anonymized, de-identified, or appropriately governed ALMA™ interaction data to understand usage patterns, improve course design, improve ALMA™ behaviour, identify friction points, develop learning analytics, monitor service quality, and plan future learning features.

AISDI™ will not use identifiable ALMA™ interaction data for materially different purposes without an appropriate lawful basis, notice, or consent where required.

AISDI™ may use third-party AI model providers, retrieval and content-indexing providers, secure infrastructure providers, database providers, and backend service providers to support ALMA™ and related learning features. These providers may process prompts, responses, course context, interaction metadata, technical logs, indexed content, or related records as needed to provide, secure, monitor, and improve the learning experience.

Users should not submit sensitive personal information, confidential business information, third-party private information, trade secrets, regulated data, or information they are not authorized to provide into ALMA™.

ALMA™ responses are AI-generated. They may be incomplete, inaccurate, outdated, or unsuitable for a specific context. Privacy processing of ALMA™ data does not change the learner’s responsibility to review AI outputs and avoid submitting sensitive or unauthorized information.

8. Course access, certificates, and validated completion data

AISDI™ processes learning data to provide course access, track progress, support completion, issue certificates, and recognize validated completion where applicable.

This may include:

1. Courses accessed.
2. Modules, lessons, assessments, and activities completed.
3. Time and date of access or completion.
4. Completion status.
5. Certificate status and certificate identifiers.
6. Administrative review records.
7. Correction, reissue, withdrawal, or revocation records.
8. Support requests relating to completion or certificate issue.

AISDI™ may check completion records and other available information before issuing a certificate or recognizing validated completion. Certificate issue may be automated, manual, or partly manual.

Certificate and validated completion data may be retained for longer than ordinary account activity records where required to support verification, prevent fraud, resolve disputes, reissue certificates, protect AISDI™ marks, or maintain learning records.

Where your access is provided through an organization, employer, institution, reseller, or enterprise customer, AISDI™ may share relevant progress, completion, certificate, and validated completion data with that organization where the access arrangement, agreement, or lawful basis permits it.

9. Payments, subscriptions, and billing

AISDI™ uses website commerce, subscription billing, customer portal, payment gateway, banking, card network, and fraud-prevention providers to manage purchases, subscriptions, renewals, invoices, receipts, cancellations, failed payments, refunds, and customer billing records.

AISDI™ may process:

1. Plan selected.
2. Billing interval.
3. Subscription status.
4. Renewal date.
5. Cancellation status.
6. Billing name and contact details.
7. Billing address.
8. Tax or VAT details where required.
9. Invoice and receipt history.
10. Payment status.
11. Payment transaction reference.
12. Payment gateway response.
13. Refund, reversal, or chargeback records.
14. Partial card details or payment method metadata returned by the payment provider.

AISDI™ does not intend to receive or store full card numbers or card security codes. Those details are handled by payment providers and card-processing systems.

AISDI™ currently processes online subscription payments in South African Rand unless AISDI™ states otherwise at checkout. If a card or account issued outside South Africa is used, the customer’s bank, card issuer, or payment network may convert the ZAR charge into another currency and may apply its own rate, timing, or fees.

AISDI™ may use billing and payment information to manage renewals, send renewal notices, recover failed payments, process refunds, prevent fraud, manage chargebacks, support customers, meet tax and accounting requirements, and enforce the Terms & Conditions.

10. Google sign-in and authentication

AISDI™ may allow users to sign in or register using Google sign-in or another supported sign-in method.

Where Google sign-in is used, AISDI™ may receive or process information such as:

1. Name.
2. Email address.
3. Google account identifier.
4. Profile picture, where provided.
5. Authentication tokens or metadata.
6. Login status and security signals.

Google sign-in is used for authentication and account access. AISDI™ does not access your Gmail mailbox content, Google Drive files, Google Calendar data, or other Google Workspace content unless AISDI™ introduces a separate integration, requests the relevant permission, and provides any additional notice or consent required by law and Google’s policies.

If you use Google sign-in, Google may also process your information according to Google’s own privacy terms and account settings.

AISDI™ may use authentication records to secure accounts, prevent unauthorized access, manage sessions, detect suspicious login activity, and support account recovery.

11. Website analytics, cookies, and tracking

AISDI™ uses or may use cookies, pixels, analytics scripts, tags, local storage, session identifiers, and similar technologies to operate the website, support checkout, enable course access, secure accounts, remember preferences, understand traffic, measure campaigns, and improve website performance.

These technologies may support:

1. website operation;
2. account access;
3. checkout and subscription management;
4. payment processing;
5. fraud prevention;
6. course access;
7. learning-environment functions;
8. live chat and support;
9. website analytics;
10. page testing and optimization;
11. campaign measurement;
12. marketing attribution;
13. communication preferences;
14. security monitoring.

Some cookies and tracking technologies are necessary for the website, checkout, account access, payment processing, security, or course delivery. Others support analytics, marketing, personalization, chat, campaign measurement, or testing.

Non-essential analytics, marketing, advertising, personalization, and behavioural tracking technologies will be handled according to the AISDI™ Cookie & Tracking Notice and the available consent or preference controls.

AISDI™ does not rely on cookie consent as acceptance of the Terms & Conditions. Terms acceptance, marketing consent, and cookie consent are separate where separation is required.

12. Marketing, CRM, and communications

AISDI™ may process personal information for communications, customer relationship management, marketing, and business development through CRM systems, email systems, live chat tools, campaign tools, marketing automation tools, social media management tools, website forms, and related services.

AISDI™ may send:

1. Account and access messages.
2. Course and platform notices.
3. Subscription renewal reminders.
4. Payment, invoice, failed-payment, refund, and cancellation notices.
5. Certificate and validated completion notices.
6. Security notices.
7. Support responses.
8. Legal and policy notices.
9. Newsletter and marketing messages where permitted.
10. Business, enterprise, or partner follow-ups.

Transactional, account, billing, access, security, and legal messages are not treated as optional marketing messages because they are needed to provide or administer AISDI™ services.

Marketing messages are handled according to the Communications & Marketing Policy and applicable consent or unsubscribe rules. Users may unsubscribe from marketing communications using the unsubscribe link, preference tools, or by contacting support@aisdi.ai.

AISDI™ may keep suppression records after an unsubscribe request to help ensure that the user is not added back to marketing lists by mistake.

AISDI™ may use CRM and campaign data to understand enquiry history, manage sales conversations, respond to business requests, segment audiences, measure campaign effectiveness, and improve communications.

13. Service providers and categories of recipients

AISDI™ uses third-party service providers to operate, secure, support, bill, analyse, communicate, and improve its services. These providers may process personal information on AISDI™’s behalf or as independent service providers, depending on the service and legal role.

The categories of providers and recipients include:

AISDI™ may add, replace, or remove providers as its services develop. Where a provider change materially affects privacy, AISDI™ will provide notice where required.

AISDI™ may provide additional provider information through an appropriate enterprise, procurement, regulator, support, legal, or data-processing process where required by law, contract, or a competent authority.

AISDI™ does not sell personal information for monetary consideration. Where a law treats certain analytics, advertising, or cross-context behavioural advertising disclosures as a “sale,” “sharing,” or targeted advertising activity, AISDI™ will provide the required notice or opt-out mechanism if that law applies to AISDI™ and the activity is enabled.

14. International transfers

AISDI™ is based in South Africa, but its service providers, infrastructure, analytics systems, AI providers, support tools, payment systems, and business systems may process personal information in other countries.

This means personal information may be transferred to, stored in, accessed from, or processed in countries outside South Africa, including countries that may not have the same level of data-protection law as the user’s country.

AISDI™ manages international transfers through safeguards that may include:

1. contracts with service providers;
2. data-processing agreements;
3. standard contractual clauses or similar transfer terms where applicable;
4. provider privacy and security commitments;
5. technical safeguards such as encryption, access controls, and logging;
6. transfer assessments where required;
7. consent, contractual necessity, or another lawful transfer ground where applicable.

For South African personal information, AISDI™ will seek to align cross-border transfers with POPIA section 72 requirements, including transfer to recipients subject to adequate protection, binding agreements, consent, contractual necessity, or another permitted basis.

For EEA, UK, or other international users, AISDI™ will apply applicable transfer safeguards where those laws apply.

15. Retention

AISDI™ keeps personal information only for as long as reasonably needed for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Retention depends on the type of information, the purpose of processing, the user’s account status, legal requirements, service requirements, dispute risk, support needs, security needs, and business requirements.

AISDI™ may retain information in backups for a limited period after deletion from active systems. Backup deletion may follow the backup cycle and may not occur immediately.

AISDI™ may retain aggregated, anonymized, or de-identified information for analytics, planning, research, product improvement, and reporting where it no longer identifies an individual.

16. Security

AISDI™ uses reasonable technical and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

1. access controls;
2. role-based permissions;
3. password and authentication controls;
4. administrative account protections;
5. encryption in transit;
6. protected storage where appropriate;
7. secure hosting practices;
8. logging and monitoring;
9. backup controls;
10. vendor review and contractual safeguards;
11. security review and issue response;
12. staff or contractor access restrictions;
13. payment-provider security controls.

No website, AI system, payment system, database, or internet-based service can be guaranteed to be completely secure. Users are responsible for keeping account credentials secure, using trusted devices, avoiding shared passwords, and notifying AISDI™ if they suspect unauthorized access.

If AISDI™ becomes aware of a security compromise involving personal information, AISDI™ will assess the incident and notify affected users, regulators, or customers where required by law.

Security concerns can be sent to support@aisdi.ai.

17. User rights

Users may have rights under POPIA, GDPR, UK GDPR, CPRA/CCPA, and other applicable laws.

Depending on the law that applies, these rights may include:

1. the right to know what personal information AISDI™ processes;
2. the right to access personal information;
3. the right to correct inaccurate or incomplete information;
4. the right to request deletion of personal information;
5. the right to object to certain processing;
6. the right to restrict certain processing;
7. the right to data portability where applicable;
8. the right to withdraw consent where processing is based on consent;
9. the right to object to direct marketing;
10. the right to opt out of certain sale, sharing, targeted advertising, or cross-context behavioural advertising practices where applicable;
11. the right not to be unfairly discriminated against for exercising privacy rights;
12. the right to complain to a regulator.

AISDI™ does not currently use ALMA™, learning analytics, or website analytics to make solely automated decisions that produce legal or similarly significant effects for users.

To exercise a privacy right, contact support@aisdi.ai.

AISDI™ may need to verify your identity before responding. AISDI™ may decline, limit, or delay a request where permitted by law, including where the request conflicts with legal obligations, billing records, security needs, certificate integrity, dispute records, fraud prevention, contractual duties, or the rights of others.

AISDI™ aims to respond to privacy requests within a reasonable period and within the timeframe required by applicable law.

For South African complaints, users may contact the Information Regulator. POPIA complaints can be sent to POPIAComplaints@inforegulator.org.za.

Users in the EEA or UK may also contact their local data-protection authority.

California users may have additional rights under the CCPA/CPRA where that law applies to AISDI™. These may include rights to know, access, delete, correct, opt out of sale or sharing, limit use of sensitive personal information where applicable, and receive non-discriminatory treatment for exercising privacy rights.

18. Children and age limits

AISDI™ is intended primarily for adult learners, professionals, businesses, institutions, and organizations.

Users must be at least 18 years old or the age of legal majority in their jurisdiction to create an account, purchase a subscription, or enter into a contract with AISDI™ unless a parent, guardian, school, employer, institution, or authorized organization has arranged access in a lawful manner.

AISDI™ does not knowingly collect personal information from children in a way that is unlawful. If AISDI™ becomes aware that it has collected personal information from a child without the required consent or authorization, AISDI™ may delete or restrict that information.

Parents, guardians, schools, or organizations that believe AISDI™ holds personal information relating to a child may contact support@aisdi.ai.

19. Business, enterprise, and partner access

AISDI™ may provide business, enterprise, reseller, partner, institutional, or cohort-based access.

In these cases, AISDI™ may receive personal information from the organization, including:

1. learner names;
2. learner email addresses;
3. job role or department;
4. cohort or group allocation;
5. access tier;
6. course allocation;
7. progress and completion status;
8. certificate or validated completion records;
9. reporting requirements;
10. administrator details.

The organization is responsible for ensuring that it has the right to provide learner information to AISDI™ and that it has given any required privacy notice to learners.

AISDI™ may share learner progress, access status, completion data, certificate data, support information, and usage reports with the organization where required to provide the agreed service, manage the customer relationship, or comply with the relevant agreement.

Enterprise or partner arrangements may be subject to additional privacy, data-processing, security, reporting, retention, and confidentiality terms.

Free individual access is not intended as a substitute for managed team rollout, organizational reporting, cohort administration, enterprise deployment, integrations, or broader internal training use unless AISDI™ agrees otherwise in writing.

20. Changes to this Policy

AISDI™ may change this Policy from time to time.

The effective date and version number show when the Policy was last changed. AISDI™ may notify users of material changes through the website, email, account notices, checkout notices, customer portal notices, or other reasonable methods.

Changes may apply immediately to new users, new accounts, new purchases, free access, and new subscriptions. Where required by law, AISDI™ will provide additional notice or obtain consent.

Continued use of AISDI™ services after a policy change takes effect means that the user acknowledges the changed Policy.

21. Contact details

Privacy and data requests can be sent to:

Use this email for:

1. privacy requests;
2. data access requests;
3. correction or deletion requests;
4. objections to processing;
5. marketing opt-out help;
6. ALMA™ data questions;
7. certificate or learning-record questions;
8. security concerns;
9. general privacy complaints.

South African privacy complaints may also be lodged with the Information Regulator: