Privacy and POPIA notice

Last reviewed 29 July 2026

This notice explains what personal information we collect when you apply to the SME Development Programme or the Cooperatives Development Programme, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).

We have tried to write it in plain language. If anything is unclear, call 010 035 0558 and ask. You are entitled to understand this before you hand over your information.

1. Who is responsible for your information

Responsible party	REPLACE_WITH_LEGAL_ENTITY_NAME
Registration number	REPLACE_WITH_COMPANY_REGISTRATION_NUMBER
Address	REPLACE_WITH_PHYSICAL_ADDRESS
Information Officer	REPLACE_WITH_INFORMATION_OFFICER_NAME
Contact for privacy queries	REPLACE_WITH_INFORMATION_OFFICER_EMAIL 010 035 0558

2. What we collect

When you complete an application we collect:

• About the business or cooperative: registered name, trading name, CIPC registration number, date established or registered, legal form, sector body registration and reference numbers, FSP number, physical address, municipality, whether you operate in a township, informal settlement or hostel area, the nature of your activity, employee or member numbers, and business stage.
• About you: full name, South African ID number, position held, mobile number and email address. For cooperatives, the same for a second representative if you name one.
• Monitoring information: ownership demographics (race, gender, youth and disability indicators). This is optional, is used only for programme reporting, and does not affect your eligibility. You may leave it blank.
• Documents you upload: your CIPC registration certificate, Tax Clearance Certificate or SARS PIN, and a certified copy of an identity document. If you send a completed paper form, the scan or photograph of that form too.
• Access and requirements: whether you have a smartphone and reliable internet, and any dietary or accessibility requirements you tell us about so we can arrange them.
• Technical information: the IP address and browser description of the device used to submit the application, and the date and time. We keep this to detect abuse of the form and for our own security records. It is not used to assess your application.

Special personal information and children

Race and disability information are special personal information under POPIA. We collect them only with your consent, only for programme monitoring and reporting to our funder, and never as a basis for accepting or rejecting an application. This programme is for adults running businesses and cooperatives; we do not knowingly collect information about children.

3. Why we collect it and on what basis

Purpose	Basis under POPIA
Assessing whether you meet the published qualifying criteria, and selecting participants	Your consent, given when you submit the application
Contacting you about your application and the outcome	Your consent
Administering the programme if you are selected: registering you for accredited training, arranging mentorship, and issuing your Statement of Results and Certificate of Completion	Your consent, and performance of the arrangement between us
Reporting to INSETA and the Gauteng Enterprise Propeller on how public funds were used, including anonymised and aggregated demographic reporting	Our legal and contractual obligations as a funded delivery partner
Verifying the documents you submit are genuine, and detecting fraudulent applications	Our legitimate interests, and the public interest in the proper use of public funds
Keeping our own records for audit	Our legal obligations

We do not use your information for marketing, we do not sell it, and we do not share it with anyone for their own purposes.

4. Who we share it with

Your information is shared only with the three organisations delivering this programme, and only for programme purposes:

• INSETA: the funder, for reporting and audit of the funded project.
• Gauteng Enterprise Propeller (GEP): the project manager.
• PM Skillshouse: the delivery partner, including for registration of the accredited training under its accreditation with the relevant SETA.

Where accredited training is registered, the relevant SETA or quality assurance body may need your name and ID number in order to record your results. That is a normal part of receiving an accredited qualification and cannot be avoided if you want the credit.

We may also disclose information if we are legally required to, for example to a court, the South African Revenue Service, the Auditor-General, or a regulator conducting a lawful investigation.

We use a South African web hosting provider to run this website and store the documents you upload. They act as an operator on our behalf, under an obligation of confidentiality, and do not use your information for their own purposes.

Information leaving South Africa

Your application information is stored in South Africa. If our email provider processes messages outside South Africa, that transfer is limited to correspondence and is subject to safeguards equivalent to those required by section 72 of POPIA.

5. How we protect it

• The whole site is served over an encrypted HTTPS connection.
• Uploaded documents are stored outside the public area of the web server and cannot be reached by guessing a web address. They are stored under randomly generated filenames.
• Only authorised programme staff can view applications, using individual password-protected accounts.
• Every time a member of staff opens an application or downloads a document, that action is recorded with their username, the time and their IP address. This lets us show who accessed whose information.
• Access to your information is limited to the staff who need it to assess and administer the programme.

No system is perfectly secure. If a breach occurs that creates a real risk of harm to you, we will notify you and the Information Regulator as POPIA requires.

6. How long we keep it

We keep application records for 5 years from the closing date of the application window. That period is set by the audit and reporting requirements attached to public funding, and by the record-keeping rules for accredited training.

After that, application records and uploaded documents are deleted. Where we need to keep evidence that the programme was delivered, we keep only anonymised, aggregated statistics that cannot identify you.

If your application is unsuccessful, we keep it for the same period, because our funder may audit how applications were assessed and we must be able to show our reasoning was fair.

7. Your rights

Under POPIA you have the right to:

• Be told what personal information we hold about you.
• Ask for a copy of it. We must respond within a reasonable time. A fee may apply for copies, as POPIA permits, and we will tell you the amount before proceeding.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
• Object to our processing of your information on reasonable grounds.
• Withdraw your consent at any time. Please understand what this means in practice: if you withdraw consent while your application is being assessed, we can no longer assess it and it will be closed. Withdrawing consent does not undo processing that already lawfully took place.
• Complain to the Information Regulator (see below).
• Not be subject to a decision based solely on automated processing. No part of the selection for this programme is automated. Every application is read by a person, and final selection is made by a committee.

How to exercise a right

Email REPLACE_WITH_INFORMATION_OFFICER_EMAIL or call 010 035 0558. Quote your application reference number if you have one. We may ask you to confirm your identity first. That protects you, because we should not hand your information to someone claiming to be you.

8. Complaining to the Information Regulator

If you are not satisfied with how we have handled your information or your request, you may complain to the Information Regulator of South Africa. Please raise it with us first if you can, because we can usually fix it faster.

Body	The Information Regulator (South Africa)
Website	inforegulator.org.za
Complaints	Use the complaint form published on the Regulator's website, which lists their current postal address and email addresses for complaints.

9. Cookies and tracking

This website sets one cookie, a session cookie named YGSESS. It exists only to keep your form working while you fill it in and to keep staff logged in to the admin area. It contains no personal information, is not used for advertising, and is discarded when you close your browser.

We use no analytics, no advertising pixels, no social media trackers and no third-party scripts of any kind. Nothing on this site loads from another company's server. That is why you are not being asked to accept cookies. There is nothing to consent to beyond what is strictly necessary to make the form work.

10. Beware of fraud

This programme is free. Neither we nor any partner will ever ask you to pay a fee, at any stage, for any reason: not to apply, not to be shortlisted, not to attend, and not to receive a certificate. We will never ask you for your banking details or a One-Time PIN.

If anyone asks you for payment or banking information in connection with this programme, they are not acting for us. Please report it immediately on 010 035 0558 or info@pmskillshouse.co.za.

11. Changes to this notice

If we change this notice we will update the review date at the top. If a change materially affects how we use information you have already given us, we will contact applicants directly rather than relying on you to re-read this page.

Back to programme information Terms and disclaimers