Your data. Your call.
This policy explains what personal information we collect, why, who we share it with, and the rights you have over it under the Protection of Personal Information Act (POPIA). We wrote the plain-language version first — the formal clauses follow.
We collect your marks, your profile, and what you do on Prospectus so we can match you to programmes, funding and careers.
We only share your information with a university or funder when you choose to apply — and you can take that consent back. We never sell your data. If you're under 18, a parent or guardian consents with you.
Who we are
Prospectus ("Prospectus", "we", "us") is a South African platform that helps school-leavers find tertiary programmes, funding and careers that fit them, operated ahead of formal company registration. We are the responsible party for your personal information as defined in POPIA.
This policy applies to the Prospectus website, the student dashboard, and any service that links to it. It works alongside our Terms of Service and Cookie Notice.
What information we collect
We collect only what we need to match you well. You give us most of it directly; some is generated as you use the platform.
| Category | Examples | Source |
|---|---|---|
| Identity | Name, email, mobile number, province, matric year | You |
| Academic | Subjects, marks, APS, school, language of instruction | You |
| Eligibility | Household income band, citizenship, disability (optional) | You |
| Capability | Self-assessment answers, interests, the capability profile we build | Generated |
| Activity | Programmes viewed, saved, compared; applications started | Generated |
| Technical | Device, browser, approximate location, session data | Automatic |
| Usage analytics | Pages visited and buttons pressed (never the details in a web address). Signed out, for that visit only. Signed in and 18 or older, also your account number and recordings of how you move through our pages, with every word on screen and everything you type hidden. Only if you say yes; never for a signed-in learner under 18. | With your consent |
Fields marked optional in the product are exactly that — optional. You can use most of Prospectus without ever entering income or disability information, though some funding matches depend on them.
Why we process it
POPIA requires us to have a lawful basis and a specific purpose for everything we do with your information. Ours are:
- To match you — calculating your APS, ranking eligible programmes, surfacing funding you qualify for, mapping careers to your capability profile. (Basis: performance of our service to you.)
- To route applications — when you apply, we send the relevant parts of your profile to that institution or funder. (Basis: your consent, per application.)
- To improve the platform — understanding which pages and matches are useful and where people get stuck. Usage analytics run only if you say yes on our cookie banner or Cookie Notice. Signed out, they count that visit only, with no cookie. For a signed-in learner who is 18 or older they are linked to your account number (never your name or email) and may include recordings of how you move through our pages, with every word on screen and everything you type hidden. Pages that hold sensitive details, such as the reasons in an NSFAS appeal, are never recorded. Deleting your account deletes these analytics and recordings too. (Basis: your consent, which you can withdraw at any time on the Cookie Notice.)
- To keep you informed — deadline reminders, application status, funding alerts. (Basis: your consent; you can opt out anytime.)
- To meet legal obligations — fraud prevention, responding to lawful requests. (Basis: compliance with the law.)
Students under 18
Many of our users are matriculants who are 17 or younger. POPIA treats the personal information of children with extra care, and so do we.
If you are under 18, a parent or legal guardian must consent to your use of Prospectus and to any application you submit through us. We ask for this consent at sign-up and again before your information is sent to any institution or funder.
A parent or guardian can review, correct or delete a minor's information at any time by contacting our Information Officer. We do not knowingly process a child's information for any purpose beyond the matching and application services described here, and never for advertising. That includes usage analytics: if you are signed in and under 18 — or we don't know your date of birth — we collect none, and record nothing, even if you said yes. A yes given before your 18th birthday doesn't carry over: once you're 18, we ask you again.
Sharing with institutions & funders
This is the part that matters most, so we'll be precise.
When you submit an application to a university, TVET college, or funder through Prospectus, we share the information that application requires — your identity, academic record, and the eligibility fields relevant to that specific opportunity. We share it because you asked us to, one application at a time.
Your consent is revocable. If you withdraw consent, we stop sharing and notify the institution that the application is withdrawn — though we cannot retrieve information they have already lawfully processed on their side.
Operators who process data for us
We use a small number of trusted service providers ("operators" under POPIA). They process your information only on our instructions, under written contracts, and only to deliver our service:
- Supabase — our database and sign-in. Hosted in the European Union (Stockholm, Sweden).
- Vercel — hosts the website. A United States company serving pages from a global network.
- PostHog — usage analytics, only with your consent. Hosted in the European Union.
- Resend — sends our emails. Hosted in the European Union (Ireland).
- Sentry — error reports, so we can fix what breaks. United States.
- Anthropic — powers the "Ask" assistant when you use it. United States.
- Paystack — takes payments. Card details go straight to Paystack and never touch our servers.
- Twilio — sends WhatsApp and SMS reminders, if you turn them on. United States.
Cross-border transfers
Our database is hosted in the European Union (Stockholm, Sweden), and some of the operators above process data in the European Union or the United States. Where an operator processes data outside South Africa, we ensure they are bound by safeguards that provide a level of protection substantially similar to POPIA, as required by section 72 of the Act.
What we never do
- We never sell your personal information.
- We never share it with advertisers or data brokers.
- We never let a funder's referral fee change where they rank in your matches — paid listings carry a visible "Sponsored" tag and are ranked on fit like everything else.
- We never process a minor's data for marketing.
How we protect it
We take the security measures POPIA requires of a responsible party, including encryption in transit and at rest, role-based access controls, audit logging, and regular review of our safeguards. No system is perfectly secure, but we treat your information as if it were our own — because the trust of a 17-year-old deciding their future is not something we take lightly.
If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22 of POPIA.
How long we keep it
We keep your information for as long as your account is active, plus a reasonable period afterward to support re-applications across admission cycles. You can delete your account at any time, after which we erase or de-identify your personal information within 90 days — except where we are legally required to retain certain records for longer.
Your rights under POPIA
You — or your parent/guardian if you are a minor — have the right to:
Most of these you can action yourself from Settings → Privacy & data. For anything else, contact our Information Officer and we'll respond within a reasonable time, and always within the periods POPIA prescribes.
Complaints to the Regulator
If you believe we have mishandled your personal information and we haven't resolved it to your satisfaction, you may lodge a complaint with the Information Regulator of South Africa:
- Email (complaints): complaints.IR@inforegulator.org.za
- Web: inforegulator.org.za
We'd genuinely prefer you talk to us first — most issues are a misunderstanding we can fix the same day.
Our Information Officer
POPIA requires us to appoint an Information Officer who is accountable for how we handle your data. Reach them directly:
Changes to this policy
We update this policy as the platform and the law evolve. When we make a material change, we'll tell you in the dashboard and by email before it takes effect. The version number and effective date at the top always reflect the current policy; we keep prior versions on request.