DRAFT: This text may change before the site opens.

Privacy policy

Version privacy-2026-10-draft-4, 06/10/2026

This policy explains what personal information Bisacc Learn collects, why, who can see it, and your rights under the Protection of Personal Information Act, 2013 (POPIA).

Who we are

Bisacc Learn is run by Bisacc Bookkeeping, a business owned by Roxanne De Coning (a sole proprietor). Bisacc Bookkeeping is the "responsible party" for your personal information under POPIA, and Roxanne De Coning is our Information Officer.

Roxanne De Coning t/a Bisacc Bookkeeping (sole proprietor)
Email: info@bisacc.co.za
Phone: 083 261 7958
Postal address: P O Box 747, Betty's Bay, 7141
Street address for legal documents: 29 Salvia Road, Betty's Bay, Western Cape, 7141

Our PAIA manual explains how to ask for records we hold, under the Promotion of Access to Information Act.

What we collect

From you, when you create an account or change your details:

Your full name and email address. These are required: we need them to give you access and to issue your certificate.
Your date of birth, so that we know whether a parent or guardian needs to agree to you joining.
If you are under 18: your parent's or guardian's name and email address, and whether and when they agreed.
Your phone number, if you choose to give it.
Your agreement to this policy and our terms of use, with the date and version you agreed to.
Whether you want emails about new courses (optional), and when you last changed that choice.

From your use of the course:

Lessons completed, your exercise, quiz and final assessment answers, and your scores.
Certificates issued to you, each with a verification code.

Automatically, to keep the site working and secure:

Cookies that keep you signed in. We use no advertising or tracking cookies, and no analytics.
Technical records kept by our service providers for security, such as your IP address, browser type and the time of each sign-in.

We do not collect your ID number, banking details or any special personal information (such as health, religion or race).

Why we use it

To create and manage your account and give you access to the courses you enrolled in.
To check your age and, if you are under 18, to ask your parent or guardian to agree.
To track your progress, mark your work and issue your certificate.
To let employers and others confirm that a certificate is genuine, using its verification code.
To send you emails about your account: confirming your email address, sign-in links and password resets.
To email you when a new Bisacc course opens, but only if you asked us to.
To improve the course, for example by seeing which questions learners find hardest.
To keep the site secure and find out what went wrong when something fails.

We use your information because you (or, if you are under 18, your parent or guardian) agreed to it, because we need it to provide the course you asked for, and, for security records, because we have a legitimate interest in keeping the site safe.

Course news emails

We only email you about new courses if you ticked the box for it, at sign-up or on your Account page. You can change your mind at any time on your Account page, and every course news email says who sent it and how to stop them. We never send other advertising, and we never give your email address to anyone else for marketing.

Learners under 18

If you are under 18, a parent or guardian must agree before you can use the course. When you sign up, we ask for their name and email address. Once you have confirmed your own email address, we email them a link to read this policy and our terms of use, and to agree or not. Your account waits until they agree, and we record when they agreed and to which version.

If your parent or guardian doesn't agree, or doesn't reply within 30 days, we delete your account and data. A parent or guardian may contact us at any time to see, correct or delete their child's information, or to withdraw their agreement.

Who can see it

You, when you are signed in.
Our administrators, who approve members and help learners with the course.
If you are under 18, your parent or guardian, who sees your name in our email asking for their agreement.
Anyone you give your certificate's verification code to. On our verification page they see only your name, the course, the date it was issued and whether it is still valid.
Our service providers, who process it for us under written agreements and may not use it for anything else:
- Supabase stores our database and runs sign-in, on servers in London, United Kingdom.
- Vercel runs the website on servers in London, United Kingdom, and delivers its pages through a worldwide network.
- Resend sends our emails, from servers in Ireland.
- Domains.co.za hosts our email inbox, so it holds any emails you send us.
A court or government authority, but only if the law requires us to share it.

We do not sell your information or use it for advertising.

Information stored outside South Africa

Your information leaves South Africa in three ways:

It is stored in the United Kingdom, by Supabase and Vercel.
It passes through Ireland, in the European Union, when Resend sends you an email.
It may be accessed from the United States, because Supabase, Vercel and Resend are US companies whose staff may need to reach it, for example to fix a technical problem.

POPIA (section 72) allows this mainly because each of these providers is bound by a written data processing agreement that protects your information to a standard substantially similar to POPIA, including when they pass it on to their own subcontractors. The United Kingdom and the European Union also have data protection laws that give protection substantially similar to POPIA. In addition, the transfer is part of how we run the course you signed up for.

How long we keep it

We keep your account and course records while your account is open.
If you don't sign in for 3 years, we email you a warning. If you still don't sign in, we delete your account and data.
If you are under 18 and your parent or guardian hasn't agreed within 30 days of signing up, we delete your account and data.
You can download or delete your data at any time from your Account page.
Certificates: if you delete your data after earning a certificate, we normally keep only your name, the course, the issue date and the verification code, so that anyone you gave your certificate to can still confirm it is genuine. Everything else is deleted. When you delete your data, you can choose to delete this certificate record too. Your certificate can then no longer be verified.
Deleted information may stay in our providers' backups for up to 7 days, and in their security records for a short time, before it is removed.

Your rights

Under POPIA you (and, if you are under 18, your parent or guardian) may:

See the personal information we hold about you. Use "Download my data" on your Account page.
Correct it. You can change your name and phone number on your Account page. To change anything else, contact us.
Delete it. Use "Delete my data" on your Account page.
Withdraw your agreement to course news emails, on your Account page.
Object to how we use your information, by contacting us.
Complain to the Information Regulator, at inforegulator.org.za. We would appreciate the chance to sort out your concern first.

Members who are still waiting for approval, or whose access is paused, can also download or delete their data after signing in.

Cookies and your browser

We use only the cookies needed to keep you signed in. While you work on a quiz or the final assessment, your answers are saved in your own browser until you submit them, so you can carry on later on the same device. They are removed when you submit.

Security

Access to your information is limited by account and role, connections to the site are encrypted, and your password is never stored in a readable form. If we learn that someone has accessed your information without permission, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.

Changes to this policy

When we change this policy, we will update the version and date at the top of this page. If a change affects how we use your information, we will email you about it before it takes effect.