Privacy Policy

This policy explains what CelerSuite does with personal information on this platform — what we hold, why, who sees it, how long we keep it, and what you can ask us to do about it. It is written for people, not lawyers, but it follows the Protection of Personal Information Act (POPIA) section by section. Our Cookie Policy covers the small technical files our site stores in your browser; this page covers everything else.

Last updated: 31 October 2026

Who is responsible for your information

Under POPIA, the responsible party is whoever decides why and how your information is used, and an operator is someone who processes it on their behalf. On this platform those roles depend on whose site you are on. When you book a course, receive a certificate or contact us through a training provider's own site, the provider — CelerSuite — is the responsible party for that information, and the CelerSuite platform processes it as their operator under written agreement (POPIA s20–s21). Where we collect information on our own pages — marketing sign-ups, platform applications, contact messages about the platform itself — CelerSuite acts as the responsible party in its own right.

The personal information we hold

We keep only what running training operations requires (POPIA s10), collected either directly from you or, for delegates, from the person or organisation that booked them (s12):

• Account details — name, e-mail address, hashed password, and optional profile fields such as phone number, job title and company.
• Security records — login lockouts and two-factor authentication settings (two-factor secrets are stored encrypted; recovery codes are stored only as hashes).
• Bookings and delegates — who is booked on which course, including delegate names and e-mails supplied by whoever made the booking, access or dietary notes where provided, and internal notes attached to a booking.
• Organisations and permissions — companies you belong to on the platform, and who may book, view queues or see invoices on your behalf.
• Certificates — the record that you hold a qualification, with its declared validity period, plus facilitator photos and signatures where used.
• Financial records — quotes, pro-forma invoices and payment status. Payments are settled offline (EFT today): we record that a payment happened; we never see or store your card details or bank login credentials.
• Correspondence — copies of the letters and e-mails the platform sends (confirmations, reminders), and contact messages you send us.
• Feedback — course feedback responses, attributed to you only if you choose to give your name.
• Activity logs — a record of significant actions on the platform (who did what, when) so disputes can be reconstructed. Sensitive values such as passwords and tokens are deliberately never logged.

Why we process it, and our lawful basis

We process personal information to fulfil the contract between us — booking courses, delivering training, issuing certificates, billing for it — and to meet legal and tax obligations (POPIA s9). Marketing happens only with your explicit opt-in consent, and you can withdraw it at any time (s11, s69); we never treat silence or a failure to opt out as permission. Keeping accurate records of who holds which qualification serves delegates, employers and regulators alike, and a legitimate interest in platform security justifies the activity logs above.

Who sees your information

Within an organisation on the platform, people see what their role allows: a coordinator sees their delegates, an accounts person sees invoices — and nobody outside your organisation's tenant can see your records. That isolation is enforced technically and tested continuously. The platform's own staff reach data only through the console for support and operations; contact message contents are delivered to the intended recipient rather than stored by us; and our processors (hosting and e-mail delivery) act under operator agreements. If we ever move processing outside South Africa, POPIA s72's safeguards will be in place first.

How we protect it

Security is part of the product: HTTPS-only sessions with hardened cookies, industry-standard password hashing (Argon2id), optional two-factor authentication, protection against cross-site request forgery, tenant isolation enforced on every query, append-only activity logs, and automatic lockouts against brute-force attacks. If a breach does compromise your personal information, we will notify the Information Regulator and you as POPIA s22 requires — we would rather tell you early than tidily.

How long we keep it

POPIA s14 says records live no longer than their purpose needs. Account and booking records persist while the relationship is active. Certificate records are permanent by design — a qualification earned in 2016 must still be verifiable in 2036 — with declared validity periods governing how long they read as current. Financial and tax records are kept for at least five years from submission, as tax law requires. When you ask us to delete your account, we remove or de-identify your personal details while keeping the anonymised traces that law and honest record-keeping require. Copies of letters we send you are kept for a defined period for legal and tax record-keeping, then removed.

Your rights

You can ask to see your personal information (POPIA s23) — accounts have a My Data page that lets you export it — correct it (s24) through your profile or with our help, and request deletion from the same page or by contacting us. These requests are free, can be made through any convenient channel (the My Data page, e-mail or the contact form below), and we respond within 30 days of a complete correction or deletion request. You can object to processing and opt out of marketing at any time; every marketing e-mail carries an unsubscribe link (s69). If you are unhappy with how we handle your information, you may complain to the Information Regulator of South Africa (s74): inforegulator.org.za/complaints — [email protected], toll-free +27 80 001 7160.

Children

Our services are sold to organisations and training providers. If you are under 18, please have a parent or guardian read this policy with you before sharing personal information (POPIA s34–s35).

Changes to this policy

We update this page as the platform evolves; the "last updated" date above is the record. Material changes will be announced on the site and, where we may e-mail you about them, by e-mail.

Questions? Contact us. See also our Terms and Conditions and Cookie Policy.