Ngozidhlamini Training Centre Learning Management System

Ngozidhlamini Training Centre — Learner and LMS Privacy Notice

Version 1.0 | Effective 24 September 2026

1. Who is responsible for your information

Ngozidhlamini (Pty) Ltd, trading as Ngozidhlamini Training Centre, registration number 2017/232906/07, is the responsible party for the learner information it determines how and why to process. This notice covers our learning management system at https://lms.ngozidhlaminitraining.co.za/ and related training administration.

Physical/postal address: 17 Hans Strydom Avenue, Springvalley Klipfontein, Emalahleni, 1034, South Africa.
Information Officer: Ngozidhlamini Administrator, Ngozidhlamini (Pty) Ltd.
Privacy enquiries: info@ngozidhlaminitraining.co.za (address enquiries to the Information Officer / Management). Registered users can also use the “Contact the privacy officer” and data-request options in their LMS profile.

2. Information we process and where it comes from

Depending on your programme and the services you use, records may include your name, contact details, learner/account identifiers, qualifications and entry evidence, enrolment and attendance, submitted work, assessment results and feedback, workplace evidence, certification information, and communications with training staff. Identity documents or demographic information are requested only where relevant to a specified verification or reporting requirement.

LMS activity records include access times, actions taken and technical information such as IP addresses. Session cookies support login and navigation; an optional remembered-username feature may store your username on your device. Do not use remembered login details on a shared device.

We obtain information from you, your LMS activity, assessors and facilitators, and, where applicable, authorised employers, sponsors, workplace mentors and verification or quality-assurance bodies. Additional collection or use will be explained where necessary.

3. Why we use information and the basis for doing so

We use relevant information to administer enrolment and accounts, deliver learning and support, assess and moderate work, verify achievement, maintain programme records, communicate about training, support applicable certification/reporting requirements, and investigate misuse or security incidents.

Processing must have an applicable basis under POPIA, such as performing a learner agreement, meeting a legal obligation, pursuing a justified legitimate interest, or specific consent where appropriate. Consent is not the basis for every activity. Where a particular law requires information, the relevant form or programme notice will identify that requirement; a request from a third party is not automatically a legal obligation.

Required and optional fields must be identified when information is requested. Without information necessary to verify entry, assess work or administer certification, we may be unable to complete the relevant service. Optional marketing participation is separate from access to training. We will not treat acknowledgement of this notice as marketing consent.

4. Access and disclosure

Information is to be accessed by staff, facilitators, assessors, moderators and authorised workplace representatives only to the extent needed for their duties. Relevant records may be shared with the applicable SETA, QCTO, certification or verification bodies, an authorised employer or sponsor, and service providers supporting LMS hosting and administration, where a lawful basis and defined purpose exist.

Service providers processing information on our behalf must act under written instructions and appropriate confidentiality and security arrangements. Reports and transfers must be limited to the required information. Personal portfolios, results and identity documents must not be posted in public forums. Names and contributions submitted to a course discussion may be visible to that discussion’s authorised participants; use private submission channels for confidential evidence.

5. Hosting and transfers outside South Africa

Hosting provider and location: Our Moodle LMS is hosted by Domains.co.za in the Republic of South Africa (RSA). Moodle is the LMS software. Any proposed processing outside South Africa, including overseas backup storage or remote support access, must be assessed against section 72 of POPIA before it is authorised. Where such a transfer is intended, we will explain the destination and applicable safeguards. The South African hosting location does not by itself establish the location of every separate service or support arrangement.

6. Security and confidentiality

The LMS uses HTTPS, account login controls, profile and profile-picture login restrictions, password safeguards, temporary failed-login lockout, administrator email multi-factor authentication and activity logging. Access to personal records must be restricted according to duties. Users should keep passwords confidential, sign out on shared devices and promptly report suspicious access or incorrect disclosure.

We will review technical and organisational safeguards and address identified weaknesses. No online service can promise absolute security. Suspected compromises must be reported through the privacy contact or administration office without delay. Where POPIA section 22 applies, we will notify the Information Regulator and affected individuals as soon as reasonably possible, subject to the statutory exceptions.

7. Retention and disposal

Records must be kept only for a justified period linked to their purpose and applicable legal, assessment, reporting, contractual or dispute requirements, and then securely deleted or de-identified when continued retention is not justified. A request for deletion does not override a valid obligation to retain a record.

IQMS retention provisions: Our IQMS Record Retention Schedule specifies seven years for learner registration records, assessment evidence and moderation records, or longer where a specific accreditation requirement applies. These are organisational schedule provisions, not a universal retention period imposed by POPIA. The responsible record owner must identify the applicable retention trigger and any legal, accreditation, contractual or dispute requirement for the particular record.

Under the IQMS records-control and archiving procedures, records are held securely with authorised access, retention requirements are reviewed, and disposal must be approved and recorded. Records needed for a current legal hold, audit or investigation are not destroyed until the applicable requirement ends. Other information, including enquiries, account details, technical logs and backups, is reviewed according to its purpose and applicable requirements and must not be retained longer than justified. You may ask the Information Officer about the retention arrangements for a particular record.

LMS implementation: Automated retention settings are still being aligned with the IQMS. Activity logs currently have no automatic expiry; this setting does not authorise indefinite retention without justification. The Information Officer and responsible record owners must review retention and arrange authorised disposal, including relevant backup copies, when continued retention is no longer justified.

8. Recordings and sensitive information

Where a supervised assessment is recorded, learners will be informed of its purpose, viewers and retention arrangements before recording. Assessment recordings must not be reused for advertising without a separate lawful basis. Health, disability/support information and other special personal information require an applicable POPIA authorisation and restricted handling. Where a learner is under 18, the appropriate authorisation for processing children’s information must be established; an ordinary LMS checkbox is not a substitute.

9. Your rights and requests

You may request confirmation of whether we hold your information, seek access, request correction, and request deletion or restriction where the applicable conditions are met. You may object to processing on the grounds provided by POPIA. Where processing depends on consent, you may withdraw it without affecting processing already lawfully performed. We will explain where another lawful basis or retention requirement continues to apply.

Use the privacy contact above or the LMS profile request options. We may take proportionate steps to verify your identity before releasing or changing records. Please identify the relevant record and request; do not send unnecessary identity documents in an initial enquiry. Any applicable procedure, permitted fee or reason a request cannot be granted will be explained.

10. Complaints

You may raise a concern with our Information Officer or complain directly to the Information Regulator (South Africa). Website: https://inforegulator.org.za/ ; POPIA complaints: POPIAComplaints@inforegulator.org.za ; general enquiries: enquiries@inforegulator.org.za ; telephone: 010 023 5200 or 0800 017 160. Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. The Regulator’s website provides complaint forms and current submission channels.

11. Updates and acknowledgement

We will identify revisions by version and date and communicate material changes through the LMS or another appropriate channel. Acknowledging this notice confirms that it has been presented to you. It does not waive your rights, authorise unrelated processing or provide blanket consent. Any genuinely optional consent will be requested separately for its specific purpose.