Privacy Policy & Data Protection

1. Institutional Entity Details

This Privacy Policy is issued on behalf of Gauteng Central College (Pty) Ltd ("GCC", "the Institution", "we", "us", or "our"), an accredited private educational provider incorporated under the company laws of the Republic of South Africa.

2. Scope & Applicable Laws

This Privacy Policy governs the processing of personal information collected through our official website (https://gautengcentralcollege.co.za), digital admissions application portals, in-house student tracking registries, and on-campus administration desks.

GCC is strictly committed to compliance with statutory requirements under:

• The Protection of Personal Information Act (POPIA Act No. 4 of 2013);
• The Promotion of Access to Information Act (PAIA Act No. 2 of 2000);
• The South African Schools Act (SASA Act No. 84 of 1996);
• The Continuing Education and Training Act (CET Act No. 16 of 2006);
• The National Qualifications Framework Act (NQF Act No. 67 of 2008);
• The Consumer Protection Act (CPA Act No. 68 of 2008); and
• The Electronic Communications and Transactions Act (ECTA Act No. 25 of 2002).

3. Categories of Personal Information We Collect

Depending on your relationship with Gauteng Central College (prospective student, applicant, enrolled learner, parent/legal guardian, job applicant, or site visitor), we may collect and process the following categories of data:

A. Student & Applicant Identification Information

• Full names, surname, title, and preferred name;
• South African National Identity Number (ID) or valid Foreign Passport Number / Study Permit;
• Date of birth, biological sex, nationality, and home language;
• Physical residential address, postal address, and contact numbers (mobile phone, WhatsApp, email).

B. Academic Credentials & Educational History

• Previous school reports, National Senior Certificate (NSC) statements of symbols, or Grade 9/11 records;
• Technical N-diploma records, NATED examination statements, or certified trade test certificates;
• Attendance registries, examination results, disciplinary records, and official GCC transcripts.

C. Parent & Legal Guardian Details (For Minors)

• Full names, South African ID / passport number of parents or designated legal guardians;
• Employment status, residential proof, employer details, and direct emergency contact numbers;
• Documented legal guardianship awards, court custody frameworks, or foster care notices where applicable.

D. Financial, Fee Settlement & Bursary Documentation

• Bank account holder details for debit order fee collection, proof of payment slips, and tuition payment histories;
• Household income verification documentation (e.g. 3 months' payslips or SASSA pension letters) submitted voluntarily for study bursary evaluations.

E. Technical Browsing & Portal Session Data

• Internet Protocol (IP) addresses, browser type, operating system version, and system access timestamps;
• Local storage session keys (such as `gcc_theme` for dark/light mode preference) and secure authentication session tokens.

4. Purpose & Lawful Basis of Processing

In accordance with Section 11 of POPIA, Gauteng Central College processes personal information solely on verified lawful grounds:

• Contractual Performance: To evaluate admission eligibility, process enrolment contracts, register students on our Noltec Student Information Management System, and provide curriculum instruction;
• Legal & Statutory Duty: To comply with mandatory reporting directives mandated by the Department of Higher Education & Training (DHET), the Quality Council for Trades and Occupations (QCTO), UMALUSI, and the Gauteng Department of Education (GDE);
• Legitimate Interests: To maintain campus security, prevent fraudulent qualification submissions, manage academic records, and facilitate student fee relief awards;
• Explicit Informed Consent: Received directly from the applicant, student, or legal guardian at the point of digital submission on our application portals.

5. Processing of Children’s Information (Minors)

We do not process the personal information of children without the prior, explicit, written or digital consent of a parent, legal guardian, or competent adult caregiver, unless authorized by law or required for educational assessment. Parental consent is permanently recorded in the student's digital archive and may be revoked in writing subject to educational retention laws.

6. Technical, Physical & Operational Security Safeguards

Under Section 19 of POPIA, GCC has implemented rigorous technical and organizational measures to protect personal information against loss, unauthorized destruction, alteration, or unlawful access:

• End-to-End Transport Layer Security (TLS/SSL): All web traffic, portal interactions, and document transmissions are encrypted using modern 256-bit TLS encryption protocols;
• Self-Hosted Secure Data Architecture: Student databases, application records, and supporting documents are stored in dedicated, isolated server directories protected with server-level access rules (`.htaccess` direct access denials);
• Role-Based Access Control (RBAC): Administrative access to admissions, inquiries, and student files is strictly segmented across Developer, Super Admin, Campus Manager, and Admissions roles. Inactive roles automatically disappear from the application surface;
• Mandatory Multi-Factor Authentication: Root administrative profiles are secured with Two-Factor Authentication (2FA) enforced via single-use 6-digit email One-Time Pins (OTP);
• Automated Session Inactivity Timeouts: Administrative sessions and student tracking portals automatically expire after 15 minutes of idle time to prevent session hijacking.

7. Third-Party Disclosures & Cross-Border Transfers

We do not sell, rent, trade, or monetize personal information under any circumstances.

Personal information is disclosed strictly to authorized statutory bodies, regulatory councils, and trusted educational service operators:

• Statutory Authorities: Department of Higher Education and Training (DHET), Quality Council for Trades and Occupations (QCTO), UMALUSI, Sector Education and Training Authorities (SETAs), and the Gauteng Department of Education;
• Accredited Examination Bodies: National Examinations & Assessment directorates, DHET Technical NATED Examination Centres, and Umalusi for certificate issuance;
• Accredited IT Infrastructure Providers: Secure web hosting servers and telecom operators supporting our official admissions portals under binding confidentiality agreements.

We do not transfer personal information outside the Republic of South Africa unless the recipient country affords an adequate level of data protection substantially similar to POPIA (Section 72).

8. Data Retention & Secure Disposal

In accordance with South African education statutes and the National Archives and Records Service of South Africa Act:

• Academic Transcripts & Graduate Records: Retained indefinitely to allow graduates and former learners to request replacement transcripts, syllabus verification, or qualification validation;
• Unsuccessful Admissions Applications: Retained for a maximum period of 12 months following the close of the academic intake, after which digital files and supporting documents are securely expunged;
• Financial & Accounting Documentation: Retained for a statutory minimum of 5 years pursuant to the Companies Act No. 71 of 2008 and the Tax Administration Act No. 28 of 2011.

9. Cookies, Session Tokens & Local Storage

Our website utilizes minimal, essential cookies and browser LocalStorage items to enable core functionality:

• Theme Preference (`gcc_theme`): Stores your visual preference (`light` or `dark` mode) locally on your device;
• Session State Tokens: Temporary cryptographic tokens maintaining your authentication state when navigating between application steps or administrative desks;
• No Invasive Advertising Trackers: We do not employ third-party behavioral tracking cookies or retargeting pixels that monitor your activity across external websites.

10. Your Rights as a Data Subject

Under Chapter 3 of POPIA, you and your enrolled dependents hold actionable rights regarding your personal information:

• Right of Access (Section 23): You have the right to request confirmation of whether we hold personal information about you and receive a copy of that record;
• Right to Rectification (Section 24): You have the right to request the correction or updating of inaccurate, irrelevant, excessive, or out-of-date personal information;
• Right to Erasure / Deletion: You have the right to request the destruction of personal information that we are no longer authorized to retain under educational or tax law;
• Right to Object (Section 11(3)): You may object at any time on reasonable grounds to the processing of personal information, provided processing is not mandated by statute;
• Right to Lodge a Complaint: You have the right to lodge a formal complaint with the South African Information Regulator if you believe your rights under POPIA have been infringed.

11. Information Officer & Regulatory Contacts

To exercise any of your data rights, request document corrections, or submit an inquiry regarding our data handling procedures, please contact our designated Information Officer:

If you are dissatisfied with our response, you are entitled to submit a formal dispute directly to the national supervisory authority: