Privacy before guidance.

Last updated: May 2026

1. Who We Are

Vela Technologies PTY LTD ("Vela", "we", "us") operates the Vela guidance platform at velaguide.co.za and via WhatsApp. Vela is the Responsible Party under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains how we collect, use, protect and retain personal information, and what rights you have under POPIA.

Our Information Officer can be reached at privacy@velaguide.co.za.

2. Scope

This policy applies to:

Visitors to velaguide.co.za (the website)
Individuals who submit their details via our waitlist form
Learners who use the Vela guidance service via WhatsApp
Parents and guardians who provide consent on behalf of learners under 18

3. Personal Information We Collect

Website and waitlist

When you join our waitlist we collect your email address and your role (learner, parent, teacher, or partner). We use this only to notify you when pilot access opens and to understand who is interested in Vela.

WhatsApp guidance product

When you use the Vela WhatsApp service we collect the following to prepare your personalised action plan:

Phone number — stored only as a one-way cryptographic hash (HMAC-SHA256). We cannot reverse this hash to recover your number. It is used solely to match your session if you return.
Province — to apply geographic eligibility rules for programmes and trades routes.
Subjects and marks — to calculate your APS score and evaluate programme eligibility.
Pathway preference — university/diploma, paid work-and-study routes, or both.
Interest discovery responses — answers to seven scenario-based questions used to match you to suitable career paths. We never expose the underlying categories to you.
Financial proxy answers — four questions (SASSA grant status, household size, employment status, home ownership) used to classify your funding band. Raw answers are used only for this classification and are not surfaced in any output.
Financial band classification — the result of the proxy questions (NSFAS-eligible, partial, or self-funded). Used to match funding opportunities.
Consent record — the timestamp, version, and source of your consent. Required by POPIA before any processing begins.

Technical data

We maintain session state in Redis with a 24-hour expiry. Error monitoring via Sentry captures technical errors — personal information is deliberately excluded from all error logs. We do not use tracking pixels, advertising cookies, or behavioural analytics tools.

4. Legal Basis for Processing

We process your personal information on the following grounds under POPIA Section 11:

Consent (Section 11(1)(a)) — your affirmative "YES" in the WhatsApp flow constitutes informed consent under POPIA and the Electronic Communications and Transactions Act 25 of 2002 (ECTA). No personal information is processed before this consent is recorded.
Legitimate interest (Section 11(1)(f)) — technical security logging (without PII) to protect the integrity of the service.

You may withdraw consent at any time by replying STOP in the WhatsApp flow or by emailing privacy@velaguide.co.za. Withdrawal does not affect the lawfulness of processing before the withdrawal.

5. Processing of Minors' Personal Information

POPIA Section 34 prohibits processing the personal information of a child (under 18) without the consent of a competent person — a parent or guardian. Our WhatsApp consent gate explicitly asks whether the learner is 18 or older, or has parental or guardian permission before any data is collected. We do not knowingly process a minor's personal information without this confirmation.

6. Processing of Special Personal Information

POPIA Section 35 places stricter rules on special categories of personal information. Certain bursaries and funding opportunities in South Africa have race-based eligibility criteria that are lawful under the Employment Equity Act 55 of 1998 and the Broad-Based Black Economic Empowerment Act 53 of 2003. Where this is relevant to a funding match, such criteria are stored in our database and evaluated automatically — we do not ask learners to self-identify their race. This data is used only to determine eligibility for specific named funding opportunities and is never disclosed or used for any other purpose.

7. How We Use Personal Information

We use your personal information only for the purposes for which it was collected:

Calculating your APS score and evaluating programme eligibility
Matching you to suitable career routes, institutions, and funding opportunities
Generating and delivering your action plan
Sending deadline reminders you have consented to receive
Notifying you when NSFAS or other funding windows open
Sending waitlist updates (website subscribers only)
Improving the accuracy and relevance of the guidance product

We do not use your personal information for advertising, profiling for commercial purposes, or any purpose unrelated to your guidance.

8. Disclosure to Third Parties

We do not sell your personal information. We share personal information only with service providers who process it on our behalf and under confidentiality obligations:

360dialog / Clickatell — WhatsApp Business Solution Providers. Your messages transit their infrastructure. Their own privacy policies apply to message delivery.
PayFast — payment processing for paid tiers. PayFast receives only the information necessary to complete a transaction. Vela does not store card or banking details.
Hosting provider (DigitalOcean or AWS) — infrastructure for the API and database. Data is stored in South Africa or the closest available region.
Sentry — error monitoring. Personal information is explicitly excluded from error logs.

We may disclose personal information where required by law, a court order, or a lawful request from a regulatory authority.

9. International Transfers

For Season 1 (2026), Vela operates in South Africa only. Where any service provider infrastructure is located outside South Africa, we take reasonable steps to ensure equivalent protection as required by POPIA Section 72. Cross-border transfers will be addressed explicitly in our Season 3 expansion documentation.

10. Retention and Deletion

We retain personal information for as long as necessary for the purpose it was collected, subject to the following schedule:

Data	Retention period	What happens after
Active learner profile	While engaged + 2 years after last active season	Contact details removed; profile anonymised
Anonymised plan data	Indefinitely	Used for aggregate product improvement — no individual is identifiable
Waitlist email	Until you unsubscribe or 12 months of inactivity	Deleted on request or after inactivity period
Redis session state	24 hours	Automatically expired
Consent records	Indefinitely	Required for audit and legal compliance

Returning learners who use Vela in a subsequent season receive a fresh consent prompt before any prior data is accessed.

11. Security

We implement the following security measures under POPIA Section 19:

Phone numbers are stored only as HMAC-SHA256 hashes — never in plaintext or reversible form
Data is encrypted at rest
Database backups run daily to a separate location
Least-privilege access controls: only personnel who need data to perform their role can access it
Personal information is explicitly excluded from all error logs and monitoring systems
All data transfers use TLS encryption in transit

In the event of a data breach that is likely to result in prejudice to you, we will notify the Information Regulator and affected individuals as required by POPIA Section 22.

12. Your Rights Under POPIA

As a data subject under POPIA Sections 23–25, you have the right to:

Access — request confirmation of whether we hold your personal information and a copy of it
Correction — request correction of inaccurate, incomplete, or misleading information
Deletion — request deletion of information that is no longer necessary for the purpose it was collected, subject to our legal retention obligations
Objection — object to processing of your personal information
Withdraw consent — withdraw consent at any time (reply STOP in WhatsApp, or email us)

To exercise any of these rights, contact our Information Officer at privacy@velaguide.co.za. We will respond within 30 days.

13. Complaints to the Information Regulator

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

Website: www.inforegulator.org.za
Email: POPIAComplaints@inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

14. Updates to This Policy

We may update this policy as the product evolves or legal requirements change. Material changes will be communicated via the website. The "Last updated" date at the top of this page reflects the most recent version. Continued use of the service after an update constitutes acceptance of the revised policy.

15. Contact

Privacy questions, access requests, and consent withdrawals: privacy@velaguide.co.za
General enquiries: hello@velaguide.co.za