Privacy Notice

Edukat (Pty) Ltd

Effective date: September 2026

Edukat (Pty) Ltd (“Edukat”, “we”, “us” or “our”) is a South African consultancy and digital solutions provider specialising in student success, youth employability and education-sector solutions.

We recognise the importance of protecting personal information and respecting the privacy rights of individuals and organisations with whom we engage.

This Privacy Notice explains how Edukat collects, uses, discloses, stores and protects personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African laws.

1. Scope of this Privacy Notice

This Notice applies to personal information processed by Edukat in connection with its website, business operations, consulting and advisory services, recruitment activities, professional engagements and other interactions with clients, prospective clients, employees, applicants, suppliers and stakeholders.

It applies where Edukat determines the purposes and means of processing personal information and acts as the responsible party under POPIA.

Where Edukat processes personal information on behalf of a client, its responsibilities are determined by the applicable contractual arrangements, the client’s instructions and relevant legal requirements. Additional privacy notices may apply to particular programmes, platforms or services.

2. Personal information we collect

The personal information processed by Edukat depends on the nature of the relationship, service or interaction.

This may include names, identification details, contact information, employment and professional information, qualifications, academic records, financial or contractual information, business correspondence and information required for recruitment or administrative purposes.

In connection with authorised student-success, employability and related programmes, information may include educational background, programme participation, funding information, student engagement and support records.

When individuals interact with our website or digital services, technical information such as Internet Protocol (IP) addresses, browser information, device details and relevant usage records may also be processed.

Certain activities may involve special personal information or information relating to children. Such information is subject to the specific legal requirements and safeguards prescribed by POPIA.

Edukat seeks to limit the personal information processed to information that is adequate, relevant and necessary for an identified, lawful purpose.

3. How we obtain personal information

Edukat may obtain personal information directly from individuals through enquiries, correspondence, meetings, applications, contractual engagements and interactions with our services.

Information may also be received from client organisations, educational institutions, authorised representatives, service providers or other lawful sources where necessary for an authorised business or programme purpose.

Certain technical information may be generated automatically through interactions with our website or digital systems.

Where personal information is obtained from a source other than the individual concerned, Edukat will comply with applicable notification requirements and any relevant lawful exceptions.

4. Purposes for which we process personal information

Edukat processes personal information for specified, lawful purposes connected with its business activities and service obligations.

These purposes may include responding to enquiries and requests; preparing proposals and entering into agreements; delivering consulting, advisory and programme services; administering client and supplier relationships; undertaking recruitment and employment administration; maintaining business records; protecting information and systems; and complying with applicable legal and regulatory obligations.

Personal information may also be processed to manage complaints, resolve disputes, protect lawful interests and communicate with stakeholders in connection with relevant business activities.

Processing must be supported by an appropriate justification under POPIA. Depending on the circumstances, this may include consent, performance or conclusion of a contract, compliance with a legal obligation, protection of a data subject’s legitimate interests, or the legitimate interests of Edukat or a third party where permitted by law.

Consent will be obtained where required. Merely accessing Edukat’s website or reading this Notice does not constitute consent to all forms of personal information processing.

5. Providing personal information

The provision of personal information may be voluntary or necessary, depending on the circumstances.

Certain information may be required to respond to an enquiry, fulfil a contractual obligation, verify relevant details, provide an agreed service or comply with applicable legislation.

Where required information is not provided, Edukat may be unable to complete the relevant request, engagement or service. Where appropriate, additional information about these requirements and their consequences will be provided at the point of collection.

6. Client programmes and the Axola platform

Edukat provides consulting, student-success, employability and related solutions to institutional and other clients, including services supported by the Axola digital platform.

These engagements may involve personal information relating to students, graduates, applicants, programme participants, institutional representatives and other relevant stakeholders.

Where the client determines the purposes and means of processing, the client is ordinarily the responsible party and Edukat acts as an operator within the authorised scope of the engagement.

Personal information processed on behalf of a client is subject to the applicable service agreement, authorised instructions and legal requirements. Any proposed use outside those purposes, including independent marketing or AI-related development, requires appropriate authorisation and a lawful basis.

Individuals participating in client-administered programmes should also consult the privacy information provided by the relevant institution or programme owner.

7. Special personal information and information relating to children

Certain Edukat engagements may involve information that receives additional protection under POPIA, including health-related information, other special personal information or personal information concerning children.

Such information may only be processed where an applicable legal authorisation exists and the relevant processing requirements are satisfied.

The nature of the safeguards and authorisations required will depend on the information, its purpose and Edukat’s role in the particular engagement.

8. Disclosure of personal information

Edukat may disclose personal information where reasonably necessary for an authorised purpose and where the disclosure is lawful.

Recipients may include authorised personnel, relevant clients or client representatives, contracted technology and hosting providers, professional advisers, administrative service providers and other parties assisting with legitimate business or service requirements.

Personal information may also be disclosed to regulatory authorities, law-enforcement agencies or other recipients where required or permitted by law.

Disclosures to service providers must be subject to appropriate confidentiality, security and contractual requirements where applicable.

Personal information must not be used or disclosed for an unrelated purpose without an appropriate lawful basis and any required notification or consent.

9. International transfers of personal information

Some technology, hosting, support or service arrangements may involve personal information being stored in, accessed from or transferred to locations outside South Africa.

Where POPIA applies to a transfer of personal information to a third party in another country, Edukat will ensure that an applicable condition under section 72 of POPIA is satisfied.

The relevant arrangements may depend on the service or client engagement. Additional information concerning international processing arrangements may be provided through engagement-specific documentation or an appropriate privacy enquiry.

10. Website information, cookies and third-party services

Edukat’s website may use cookies and similar technologies to support website operation, functionality, security and, where implemented, performance analysis.

These technologies may process technical information relating to website visits, devices and browsing activities.

Visitors can manage certain cookie preferences through their browser settings or through website preference controls where these are available. Restricting some cookies may affect website functionality.

Edukat’s website may contain links to external websites, platforms or services. Those third parties may process personal information independently under their own privacy notices. Visitors are encouraged to review the applicable notices when accessing external services.

11. Direct marketing communications

Edukat may communicate information about its services, activities, events or relevant business developments where permitted by applicable law.

Electronic direct marketing will be undertaken in accordance with section 69 of POPIA, including the requirements relating to consent and any applicable existing-customer exception.

Recipients of direct marketing communications will be provided with an appropriate means of objecting to, or opting out of, further marketing communications.

Requests to discontinue marketing communications may also be submitted to legal@edukat.co.za.

12. Information security and security compromises

Edukat is committed to applying appropriate organisational and technical measures designed to protect personal information against unauthorised access, unlawful processing, disclosure, alteration, loss or destruction.

The measures required depend on the nature and sensitivity of the personal information, the relevant processing activities and the risks involved.

Where there are reasonable grounds to believe that a security compromise has occurred, Edukat will address its obligations under applicable law.

Where Edukat is the responsible party, this includes notification to the Information Regulator and affected data subjects when required by POPIA. Where Edukat acts as an operator, it must notify the relevant responsible party in accordance with its legal and contractual obligations.

13. Retention and disposal of personal information

Edukat retains personal information for as long as necessary to fulfil its authorised purpose, comply with applicable legal or contractual obligations, meet legitimate recordkeeping requirements or establish, exercise or defend legal rights.

Retention requirements vary according to the category of information and the applicable circumstances.

When personal information is no longer lawfully required, Edukat will take appropriate steps to delete, destroy or de-identify it, or return it where applicable.

Personal information processed on behalf of a client is subject to the relevant contractual and lawful retention and disposal requirements.

14. Your rights under POPIA

Subject to the requirements and limitations of applicable law, individuals have the right to:

• Request confirmation of whether Edukat holds personal information about them.
• Request access to their personal information.
• Request correction, updating or deletion of personal information where legally warranted.
• Object to certain processing activities on grounds recognised by POPIA.
• Withdraw consent where processing is based on consent, without affecting processing already lawfully undertaken or processing justified on another lawful basis.
• Object to the processing of personal information for direct marketing.
• Receive protection in relation to certain solely automated decisions, as provided for by POPIA.
• Lodge a complaint with the Information Regulator concerning an alleged interference with their personal information rights.

Requests relating to personal information may be submitted to legal@edukat.co.za.

Edukat may require reasonable identity verification and sufficient information to identify and assess the request. Requests will be considered in accordance with applicable law, including any lawful restrictions on access or deletion.

Where the information is controlled by a client organisation, Edukat may direct the individual to the relevant responsible party or coordinate the request with that organisation.

Requests for access to records under the Promotion of Access to Information Act 2 of 2000 (“PAIA”) are handled in accordance with the applicable legal procedure and Edukat’s PAIA Manual.

15. Privacy enquiries and complaints

For questions, requests or concerns regarding this Notice or Edukat’s processing of personal information, please contact:

Edukat (Pty) Ltd

Information Officer: Mr Katlego Thindisa

Deputy Information Officer: Mr Kopano Molefe

Email: legal@edukat.co.za

Website: https://edukat.co.za/

Physical address: Thornhill Office Park, Building 10, 94 Bekker Road, Vorna Valley, Midrand, Gauteng, South Africa, 1686.

Individuals may also lodge complaints with the Information Regulator (South Africa).

Information Regulator

Website: https://inforegulator.org.za/

POPIA complaints: POPIAComplaints@inforegulator.org.za

General enquiries: enquiries@inforegulator.org.za

Telephone: 010 023 5200

The Information Regulator’s official website provides information about applicable complaint procedures and submission channels.

16. Updates to this Privacy Notice

Edukat may revise this Notice to reflect changes in its operations, services, technology, legal obligations or personal information processing activities.

The current version will be made available on Edukat’s website, together with its effective date.

Where required by applicable law, affected individuals will receive additional notification or be asked to provide consent in relation to material changes in processing.

NOTICES AND REVISIONS

If you have any concern about our privacy and data protection Policy, please e-mail us a thorough description and we will try to resolve the issue for you. Our business changes constantly and this policy and the website terms andconditions will also change from time to time. We may e-mail periodic reminders of our notices and conditions, unless you have instructed us not to, but you should check our web site frequently to see any recent changes. Unless statedotherwise, our current privacy policy applies to all Personal Information that we have about you and your interactions with Us.

However, we stand behind the promises we make and will never materially change our policies and practices to make them less protective unless we are legally entitled or obliged to do so.

This Privacy Policy may change from time to time. You understand and agree that you will be deemed to haveaccepted the updated privacy policy if you use our services/products after the updated privacy policy has been made public (as reflected in the effective date).

We may revise this privacy policy in our sole discretion, so please review it periodically. If you continue to visit our siteand use our services /products after such changes have been made, you thereby provide your consent to the changes.

If there are any material changes to this privacy policy, the Company will notify you by email or as otherwise requiredby applicable law. We will post any adjustments to the privacy policy on our various platforms e.g. website, and the revised version will be effective immediately when it is posted (or upon notice if applicable).

ENQUIRIES

If you have any questions, comments, complaints or concerns arising from this privacy policy or the way in which we handle personal information, please contact the below:

The Company

Information Officer: Mr. Katlego Thindisa Email: Legal@edukat.co.za.

Deputy Information Officer: Mr. Kopano Molefe Email: Legal@edukat.co.za.

Physical Address: Thornhill Office Park, Building 10, 94 Bekker Road, Vorna Valley, Midrand, Gauteng, South Africa, Southern Africa, 1686

The Information Regulator

www.inforegulator.org.za

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: inforeg@justice.gov.za

RECORDS AND ANNEXURES

The Personal Information is classified and grouped according to records relating to the following subjects and categories (See PAIA Manual):