Your data. Your call.
This policy explains what personal information we collect, why, who we share it with, and the rights you have over it under the Protection of Personal Information Act (POPIA). We wrote the plain-language version first — the formal clauses follow.
We collect your marks, your profile, and what you do on Prospectus so we can match you to programmes, funding and careers.
We only share your information with a university or funder when you choose to apply — and you can take that consent back. We never sell your data. If you're under 18, a parent or guardian consents with you.
Who we are
Prospectus (Pty) Ltd ("Prospectus", "we", "us") is a South African company that helps school-leavers find tertiary programmes, funding and careers that fit them. We are the responsible party for your personal information as defined in POPIA.
This policy applies to the Prospectus website, the student dashboard, and any service that links to it. It works alongside our Terms of Service and Cookie Notice.
What information we collect
We collect only what we need to match you well. You give us most of it directly; some is generated as you use the platform.
| Category | Examples | Source |
|---|---|---|
| Identity | Name, email, mobile number, province, matric year | You |
| Academic | Subjects, marks, APS, school, language of instruction | You |
| Eligibility | Household income band, citizenship, disability (optional) | You |
| Capability | Self-assessment answers, interests, the capability profile we build | Generated |
| Activity | Programmes viewed, saved, compared; applications started | Generated |
| Technical | Device, browser, approximate location, session data | Automatic |
Fields marked optional in the product are exactly that — optional. You can use most of Prospectus without ever entering income or disability information, though some funding matches depend on them.
Why we process it
POPIA requires us to have a lawful basis and a specific purpose for everything we do with your information. Ours are:
- To match you — calculating your APS, ranking eligible programmes, surfacing funding you qualify for, mapping careers to your capability profile. (Basis: performance of our service to you.)
- To route applications — when you apply, we send the relevant parts of your profile to that institution or funder. (Basis: your consent, per application.)
- To improve the platform — understanding which matches are useful, in aggregate and de-identified where possible. (Basis: our legitimate interest.)
- To keep you informed — deadline reminders, application status, funding alerts. (Basis: your consent; you can opt out anytime.)
- To meet legal obligations — fraud prevention, responding to lawful requests. (Basis: compliance with the law.)
Students under 18
Many of our users are matriculants who are 17 or younger. POPIA treats the personal information of children with extra care, and so do we.
If you are under 18, a parent or legal guardian must consent to your use of Prospectus and to any application you submit through us. We ask for this consent at sign-up and again before your information is sent to any institution or funder.
A parent or guardian can review, correct or delete a minor's information at any time by contacting our Information Officer. We do not knowingly process a child's information for any purpose beyond the matching and application services described here, and never for advertising.
Sharing with institutions & funders
This is the part that matters most, so we'll be precise.
When you submit an application to a university, TVET college, or funder through Prospectus, we share the information that application requires — your identity, academic record, and the eligibility fields relevant to that specific opportunity. We share it because you asked us to, one application at a time.
Your consent is revocable. If you withdraw consent, we stop sharing and notify the institution that the application is withdrawn — though we cannot retrieve information they have already lawfully processed on their side.
Operators who process data for us
We use a small number of trusted service providers ("operators" under POPIA) for hosting, email delivery, and analytics. They process your information only on our instructions, under written contracts, and only to deliver our service.
Cross-border transfers
Our primary infrastructure is hosted in South Africa. Where an operator processes data outside the country, we ensure they are bound by safeguards that provide a level of protection substantially similar to POPIA, as required by section 72 of the Act.
What we never do
- We never sell your personal information.
- We never share it with advertisers or data brokers.
- We never let a funder's referral fee change where they rank in your matches — paid listings carry a visible "Sponsored" tag and are ranked on fit like everything else.
- We never process a minor's data for marketing.
How we protect it
We take the security measures POPIA requires of a responsible party, including encryption in transit and at rest, role-based access controls, audit logging, and regular review of our safeguards. No system is perfectly secure, but we treat your information as if it were our own — because the trust of a 17-year-old deciding their future is not something we take lightly.
If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22 of POPIA.
How long we keep it
We keep your information for as long as your account is active, plus a reasonable period afterward to support re-applications across admission cycles. You can delete your account at any time, after which we erase or de-identify your personal information within 90 days — except where we are legally required to retain certain records for longer.
Your rights under POPIA
You — or your parent/guardian if you are a minor — have the right to:
Most of these you can action yourself from Settings → Privacy & data. For anything else, contact our Information Officer and we'll respond within a reasonable time, and always within the periods POPIA prescribes.
Complaints to the Regulator
If you believe we have mishandled your personal information and we haven't resolved it to your satisfaction, you may lodge a complaint with the Information Regulator of South Africa:
- Email (complaints): complaints.IR@inforegulator.org.za
- Web: inforegulator.org.za
We'd genuinely prefer you talk to us first — most issues are a misunderstanding we can fix the same day.
Our Information Officer
POPIA requires us to appoint an Information Officer who is accountable for how we handle your data. Reach them directly:
Changes to this policy
We update this policy as the platform and the law evolve. When we make a material change, we'll tell you in the dashboard and by email before it takes effect. The version number and effective date at the top always reflect the current policy; we keep prior versions on request.