Privacy Notice
1. Who is responsible for your information
The responsible party for personal information processed through this website is [TO CONFIRM: full legal name and status of the operator, for example "N Steyn trading as CuraPraxis" or the registered company name and number], of [TO CONFIRM: physical address] ("CuraPraxis", "we", "us"). You can reach us at curapraxis@proton.me [TO CONFIRM: mailbox once the domain exists].
2. What we collect, and what we deliberately do not
Information that stays on your device
The course stores your study state in your own browser's local storage: your first name or chosen display name, the practitioner role you selected at onboarding (attorney, advocate, candidate attorney or academic), which modules you have opened, your assessment scores and practice activity, your tier, and the claim token described below. This information is saved on your device so the course works offline and remembers your progress. It is never transmitted to us, and we cannot see it. Clearing your browser data erases it.
Information we receive and store
- When you buy a tier or an upgrade: the name you entered for your certificate and a randomly generated claim token pass through the checkout so that your certificate can be issued to the right person and retrieved only by your browser. Our payment provider sends us a payment reference number and, where available, the email address you used to pay.
- When a certificate is issued: we store the certificate ID, your name as it appears on the certificate, the course and certificate name, the issue date, the certificate status, the payment reference and the claim token.
- Technical logs: our hosting provider keeps short-lived request logs (such as IP addresses and pages requested) for security and fault diagnosis. We do not use them to profile you.
Payment card details
We never see or store your card number or banking credentials. Payment is processed by PayFast, a South African payment provider, on its own secure pages, under its own privacy policy. PayFast is an independent responsible party for the payment information you give it.
3. Why we process this information, and on what basis
| Purpose | POPIA justification |
|---|---|
| Processing your purchase and issuing your certificate | Performance of the contract you conclude with us when you buy a tier (section 11(1)(b)) |
| Public verification of certificates (see section 4 below) | Performance of the contract, and our and your legitimate interests in credible, checkable credentials (section 11(1)(f)) |
| Emailing your certificate to you | Performance of the contract |
| Security, fraud prevention and fault diagnosis | Our legitimate interests (section 11(1)(f)) |
| Complying with tax and financial record-keeping laws | Legal obligation (section 11(1)(c)) |
Providing your name at checkout is voluntary, though without it we cannot put a name on your certificate. We do not use your information for direct marketing. If that ever changes, we will ask for your consent first, as POPIA section 69 requires.
4. Certificate verification is public by design
The point of a CuraPraxis certificate is that anyone, a client, a firm, a court or a colleague, can check it. If a person has your certificate ID, our verification page will show them your name as it appears on the certificate, the course and certificate name, the issue date and whether the certificate is valid. Nothing else is disclosed, and the ID itself cannot be guessed from your name. Share your certificate ID with the people you want to be able to verify it.
5. Who processes information on our behalf
We use a small number of service providers as operators under POPIA section 20: [TO CONFIRM: hosting provider at go-live, for example Vercel] (website hosting and serverless functions), Supabase (the database that stores certificate and payment records) and Resend (certificate email delivery). Each processes information only on our instructions and under contractual confidentiality and security obligations.
6. Cross-border transfers
Our hosting, database and email providers store information on infrastructure outside South Africa, principally in the United States. POPIA section 72 permits this where the recipient is bound by a law or binding agreement providing substantially similar protection, or where the transfer is necessary for the performance of your contract with us. Our providers are bound by contractual data protection terms, and the transfer of your name and payment reference is necessary to deliver the service you bought. By accepting this notice you also consent to these transfers. Note that this concerns your details as a buyer only: no client information, matter information or study activity of yours ever reaches us or these providers.
7. How long we keep information
- Certificate records: for as long as the verification service exists, because deleting them would silently invalidate the certificate you earned.
- Payment records: at least five years, as tax and financial legislation requires.
- Technical logs: days to weeks, per our hosting provider's standard retention.
8. Security
Certificate IDs are cryptographically signed, so forged IDs fail verification. All traffic to the site is encrypted in transit. Database access is restricted to keys held server-side, and the public can never read claim tokens, email addresses or payment references from our database. No system is perfectly secure, and POPIA section 22 obliges us to notify you and the Information Regulator if a breach of your personal information ever occurs.
9. Your rights
Under POPIA you may ask us: what personal information we hold about you (also see our PAIA Manual); to correct or delete information that is inaccurate, irrelevant, excessive, out of date or unlawfully held; and to object to processing based on legitimate interests. Deleting your certificate record is possible at your request, on the understanding that your certificate will then no longer verify. Write to curapraxis@proton.me and we will respond within a reasonable time.
You may also complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za; general enquiries enquiries@inforegulator.org.za; 010 023 5200.
10. A course for adults
The course is written for legal practitioners and legal academics and is sold to adults only; the Terms of Use require buyers to be at least 18. Nothing on the site is directed at children, and we do not knowingly process the personal information of children as contemplated in POPIA sections 34 and 35.
11. Cookies and similar technologies
We set no advertising or analytics cookies. The site uses your browser's local storage and a service worker cache for one purpose only: making the course work, offline included. These hold your study state and copies of course files on your device, under your control.
12. Changes to this notice
If we change this notice materially, we will update the version and date above and ask you to accept the new version before you continue using the course.
See also the Terms of Use, the Disclaimer and the PAIA Manual.