Privacy before guidance.

Last updated: July 2026

1. Who We Are

Vela Technologies PTY LTD ("Vela", "we", "us") operates the Vela guidance platform at velaguide.co.za and via WhatsApp. Vela is the Responsible Party under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains how we collect, use, protect and retain personal information, and what rights you have under POPIA.

Our Information Officer can be reached at privacy@velaguide.co.za.

2. Scope

This policy applies to:

Visitors to velaguide.co.za (the website)
Individuals who submit their details via our waitlist form
Learners who use the Vela guidance service via WhatsApp
Parents and guardians who provide consent on behalf of learners under 18

3. Personal Information We Collect

Website and waitlist

When you join our waitlist we collect your email address and your role (learner, parent, teacher, or partner). We use this only to notify you when pilot access opens and to understand who is interested in Vela.

WhatsApp guidance product

When you use the Vela WhatsApp service we collect the following to prepare your personalised action plan:

Phone number: stored only as a one-way cryptographic hash (HMAC-SHA256). We cannot reverse this hash to recover your number. It is used solely to match your session if you return.
Province: to apply geographic eligibility rules for programmes and trades routes.
Subjects and marks: to calculate your APS score and evaluate programme eligibility.
Pathway preference: university/diploma, paid work-and-study routes, or both.
Interest discovery responses: answers to seven scenario-based questions used to match you to suitable career paths. We never expose the underlying categories to you.
Financial proxy answers: four questions (SASSA grant status, household size, employment status, home ownership) used to classify your funding band. Raw answers are used only for this classification and are not surfaced in any output.
Financial band classification: the result of the proxy questions (NSFAS-eligible, partial, or self-funded). Used to match funding opportunities.
Consent record: the timestamp, version, and source of your consent. Required by POPIA before any processing begins.

Technical data

We maintain session state in Redis with a 24-hour expiry. Our error monitoring captures technical errors. Personal information is deliberately excluded from all error logs. We do not use tracking pixels, advertising cookies, or behavioural analytics tools.

4. Legal Basis for Processing

We process your personal information on the following grounds under POPIA Section 11:

Consent (Section 11(1)(a)): your affirmative "YES" in the WhatsApp flow constitutes informed consent under POPIA and the Electronic Communications and Transactions Act 25 of 2002 (ECTA). No personal information is processed before this consent is recorded.
Legitimate interest (Section 11(1)(f)): technical security logging (without PII) to protect the integrity of the service.

You may withdraw consent at any time by replying STOP in the WhatsApp flow or by emailing privacy@velaguide.co.za. Withdrawal does not affect the lawfulness of processing before the withdrawal.

5. Processing of Minors' Personal Information

POPIA Section 34 prohibits processing the personal information of a child (under 18) without the consent of a competent person, meaning a parent or guardian. Our WhatsApp consent gate explicitly asks whether the learner is 18 or older, or has parental or guardian permission before any data is collected. We do not knowingly process a minor's personal information without this confirmation.

6. Processing of Special Personal Information

POPIA Section 35 places stricter rules on special categories of personal information. Certain bursaries and funding opportunities in South Africa have race-based eligibility criteria that are lawful under the Employment Equity Act 55 of 1998 and the Broad-Based Black Economic Empowerment Act 53 of 2003. Where this is relevant to a funding match, such criteria are stored in our database and evaluated automatically. We do not ask learners to self-identify their race. This data is used only to determine eligibility for specific named funding opportunities and is never disclosed or used for any other purpose.

7. How We Use Personal Information

We use your personal information only for the purposes for which it was collected:

Calculating your APS score and evaluating programme eligibility
Matching you to suitable career routes, institutions, and funding opportunities
Generating and delivering your action plan
Sending deadline reminders you have consented to receive
Notifying you when NSFAS or other funding windows open
Remembering your goals, plans, and progress across school years so guidance continues from where you left off instead of starting over each season
Reaching out, with your consent, at important moments in your journey — such as results day, application deadlines, registration, and bursary renewal, including after you enrol
Sending waitlist updates (website subscribers only)
Improving the accuracy and relevance of the guidance product

We do not use your personal information for advertising, profiling for commercial purposes, or any purpose unrelated to your guidance.

Automated guidance

Vela's guidance is generated with the help of AI, checked against verified institution and funding data. It never makes a final decision about you, and you can ask to speak to a person at any time.

8. Disclosure to Third Parties

We do not sell your personal information. We share personal information only with service providers who process it on our behalf and under confidentiality obligations:

WhatsApp Business partner: an authorised WhatsApp Business Solution Provider delivers our messages. Your messages transit their infrastructure under their confidentiality obligations.
PayFast: payment processing for paid tiers. PayFast receives only the information necessary to complete a transaction. Vela does not store card or banking details.
Cloud hosting provider: infrastructure for the API and database. Data is stored in South Africa or the closest available region.
Error monitoring provider: technical error tracking. Personal information is explicitly excluded from error logs.
AI language technology: helps compose Vela's replies and understand what you type. Providers process information only on our instructions, under written agreements, never for their own purposes, and never to train their AI models.

We may disclose personal information where required by law, a court order, or a lawful request from a regulatory authority.

9. International Transfers

Vela operates in South Africa. Some of our service providers process information outside South Africa. When they do, equivalent protections apply under written agreements with binding data protection obligations, as required by POPIA Section 72.

10. Retention and Deletion

We retain personal information for as long as necessary for the purpose it was collected, subject to the following schedule:

Data	Retention period	What happens after
Active learner profile	For the duration of your guided journey, while you maintain an active, consented relationship with Vela — from school through to your first qualification — and for 24 months after your last interaction with us	Contact details removed; profile anonymised. Deleted earlier at any time on request
Anonymised plan data	Indefinitely	Used for aggregate product improvement; no individual is identifiable
Waitlist email	Until you unsubscribe or 12 months of inactivity	Deleted on request or after inactivity period
Redis session state	24 hours	Automatically expired
Consent records	Indefinitely	Required for audit and legal compliance

Returning learners who use Vela in a subsequent season receive a fresh consent prompt before any prior data is accessed. At each major stage of your journey — for example the start of application season — we ask again whether you want Vela to stay with you; replying STOP at any point ends proactive contact immediately. If we have not heard from you for an extended period, we will send one message asking whether you want us to keep your information before the 24-month deletion takes effect.

You can ask Vela at any time to show you what it remembers about you, and to correct or delete any of it, directly in the WhatsApp conversation.

11. Security

We implement the following security measures under POPIA Section 19:

Phone numbers are stored only as HMAC-SHA256 hashes, never in plaintext or reversible form
Data is encrypted at rest
Database backups run daily to a separate location
Least-privilege access controls: only personnel who need data to perform their role can access it
Personal information is explicitly excluded from all error logs and monitoring systems
All data transfers use TLS encryption in transit

In the event of a data breach that is likely to result in prejudice to you, we will notify the Information Regulator and affected individuals as required by POPIA Section 22.

12. Your Rights Under POPIA

As a data subject under POPIA Sections 23–25, you have the right to:

Access: request confirmation of whether we hold your personal information and a copy of it
Correction: request correction of inaccurate, incomplete, or misleading information
Deletion: request deletion of information that is no longer necessary for the purpose it was collected, subject to our legal retention obligations
Objection: object to processing of your personal information
Withdraw consent: withdraw consent at any time (reply STOP in WhatsApp, or email us)

To exercise any of these rights, contact our Information Officer at privacy@velaguide.co.za. We will respond within 30 days.

13. Complaints to the Information Regulator

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

Website: www.inforegulator.org.za
Email: POPIAComplaints@inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

14. Updates to This Policy

We may update this policy as the product evolves or legal requirements change. Material changes will be communicated via the website. The "Last updated" date at the top of this page reflects the most recent version. Continued use of the service after an update constitutes acceptance of the revised policy.

15. Contact

Privacy questions, access requests, and consent withdrawals: privacy@velaguide.co.za
General enquiries: hello@velaguide.co.za