Privacy Policy

Effective Date: 1 September 2026

1. Introduction

This Privacy Policy explains how KTH Projects (Pty) Ltd, trading as KTH-Tech (“we”, “us”, “our”, or “KTH-Tech”), collects, uses, stores, shares, and protects your personal information when you access or use the iQ-X career intelligence assessment platform (“iQ-X” or “the Platform”), including the website, assessment portal, parent portal, and any related services.

We are committed to protecting your privacy and processing your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and all applicable South African data protection legislation.

By registering for or using iQ-X, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.

2. Responsible Party

In terms of POPIA, the Responsible Party for the processing of your personal information is:

The Information Officer is responsible for ensuring compliance with POPIA and for addressing any queries or complaints regarding the processing of your personal information.

3. Definitions

For the purposes of this Privacy Policy:

• “Personal Information” means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, including but not limited to names, email addresses, identification numbers, online identifiers, and assessment responses, as defined in section 1 of POPIA.
• “Special Personal Information” means personal information concerning a data subject’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour, as well as psychometric data where applicable, as contemplated in sections 26 to 33 of POPIA.
• “Data Subject” means the person to whom personal information relates — in this context, any user of the iQ-X Platform.
• “Processing” means any operation or activity, whether automated or not, concerning personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, consultation, use, dissemination, merging, restriction, degradation, erasure, or destruction of information.
• “Consent” means any voluntary, specific, and informed expression of will in terms of which permission is given for the processing of personal information.
• “Competent Person” means a parent or legal guardian of a child, as defined in section 1 of the Children’s Act 38 of 2005, who has the legal authority to consent on behalf of the child.
• “Operator” means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party, as defined in section 1 of POPIA.
• “POPIA” means the Protection of Personal Information Act 4 of 2013, as amended, including any regulations promulgated thereunder.

4. Personal Information We Collect

We collect the following categories of personal information when you use the Platform:

4.1 Registration Data

• Full name
• Email address
• Password (stored as a cryptographic hash; we never store plaintext passwords)
• Account type (learner, parent, school administrator, coach)

4.2 Demographic Data

• Age or date of birth
• Grade or education level
• School or institution name (where applicable)

4.3 Assessment Data

• Responses to 200 assessment items across 7 psychometric frameworks
• Assessment completion timestamps
• Calculated scores and dimension results
• Career match scores and profile rankings

4.4 Parent Portal Data

• Parent/guardian name and email address
• Learner registration details (name, grade, age, school)
• Consent records (date, time, version, and identity of consenting parent)
• Assessment link sharing history

4.5 Coaching Data

• Coaching session notes (if you subscribe to a coaching package)
• Action plans and recommendations generated during coaching
• Coach-learner interaction records

4.6 Usage Data

• Login timestamps and session duration
• Portal activity and navigation patterns
• Feature usage and interaction data

4.7 Device and Technical Data

• Browser type and version
• Operating system
• Screen resolution
• IP address (anonymised where possible)
• Device type (desktop, tablet, mobile)

5. Special Personal Information

iQ-X is a psychometric career assessment platform. Assessment responses and results may constitute psychometric data, which is classified as Special Personal Information under POPIA.

In accordance with section 27 of POPIA, we process this Special Personal Information only with your explicit, informed consent, which you provide at the time of commencing the assessment. You have the right to withdraw this consent at any time (see Section 13 below), subject to any legal or contractual obligations.

Where psychometric assessments are conducted in respect of learners under 18, consent is obtained from a parent or legal guardian in accordance with section 35 of POPIA (see Section 14 below).

6. Purpose of Processing

We process your personal information for the following specific, explicitly defined, and lawful purposes:

1. Assessment scoring and analysis: To score your responses across 7 psychometric frameworks and generate a personalised career intelligence report.
2. Career report generation: To match your psychometric profile against 70+ South African career profiles and present ranked career recommendations.
3. Parent portal services: To enable parents and guardians to register their children, provide POPIA-compliant consent, and monitor assessment progress.
4. Coaching facilitation: To enable assigned coaches to access your results (coaching package only) and provide personalised career guidance.
5. School analytics: To provide school administrators with aggregated, anonymised analytics on learner cohorts (school programme only).
6. Platform improvement: To analyse usage patterns and improve the iQ-X Platform, assessment instruments, and user experience.
7. Communication: To send you assessment results, account notifications, and service-related communications.
8. Legal compliance: To comply with applicable laws, regulations, and legal processes.
9. Contractual performance: To perform our obligations under any contract with you, including the provision of the assessment and related services.

We will not process your personal information for any purpose other than those listed above without first obtaining your consent or establishing another lawful basis for such processing.

7. Legal Basis for Processing

We process your personal information on the following legal bases as provided for in POPIA:

• Consent (section 11(1)(a)): You provide explicit consent when you register for iQ-X and when you commence the assessment. This is the primary basis for processing assessment data and Special Personal Information.
• Contractual necessity (section 11(1)(b)): Processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. This applies to the delivery of assessment results and coaching services.
• Legal obligation (section 11(1)(c)): Processing is necessary for compliance with an obligation imposed by law, such as record-keeping requirements.
• Legitimate interest (section 11(1)(f)): Processing is necessary for the purposes of the legitimate interests pursued by KTH-Tech or by a third party to whom the information is supplied, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject. This applies to platform security, fraud prevention, and service improvement.

8. How We Collect Information

We collect personal information through the following means:

8.1 Directly from You

• When you register an account on iQ-X
• When you complete the career intelligence assessment
• When you interact with coaching services
• When you contact us via email or through the Platform
• When you update your profile or account settings

8.2 From Parents and Guardians

• When a parent or legal guardian registers a Learner under 18 through the Parent Portal
• When a parent provides consent for the processing of a Learner’s personal information

8.3 Automatically

• Usage logs generated when you access and interact with the Platform
• Device and browser information transmitted by your device when connecting to the Platform
• Session management data stored via localStorage (see Section 15 below)

8.4 From Third Parties

• From your school or institution, if you are enrolled through a school programme (limited to name, grade, and email address for account provisioning)

9. Data Storage and Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction.

9.1 Technical Safeguards

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted using industry-standard encryption algorithms
• Passwords are stored as salted cryptographic hashes and are never stored or transmitted in plaintext
• Access to personal information is restricted to authorised personnel on a need-to-know basis
• Regular security audits and vulnerability assessments are conducted

9.2 Infrastructure

• The Platform is hosted on secure cloud infrastructure with enterprise-grade physical and logical security controls
• Data is stored in South Africa or in jurisdictions that provide an adequate level of data protection, where possible
• Regular backups are maintained to ensure data integrity and availability

9.3 Organisational Measures

• All employees and contractors with access to personal information are bound by confidentiality agreements
• Staff undergo regular data protection training
• Access controls are reviewed periodically

10. Data Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law.

• Assessment data: Retained for a period of five (5) years from the date of the assessment, or until you request deletion, whichever occurs first. This retention period allows for longitudinal comparison and re-assessment.
• Account data: Retained for the duration that your account remains active. If you close your account, we will delete or anonymise your account data within ninety (90) days, except where retention is required by law.
• Parent consent records: Retained for the duration of the Learner’s account and for five (5) years thereafter, as evidence of lawful processing of a child’s personal information.
• Coaching data: Retained for the duration of the coaching engagement plus two (2) years thereafter, unless you request earlier deletion.
• Usage and technical data: Retained in anonymised or aggregated form for up to two (2) years for platform improvement purposes.
• Legal and compliance records: Retained for the period prescribed by applicable legislation.

Upon expiry of the relevant retention period, personal information is securely deleted or irreversibly anonymised.

11. Sharing and Disclosure

We do not sell, rent, or trade your personal information to any third party. Your personal information may be shared only in the following limited circumstances:

11.1 Parent Access

Parents and legal guardians who have registered a Learner through the Parent Portal have access to the Learner’s assessment status, completed Reports, and assessment links. This access is inherent to the parent-child relationship and the consent provided during registration.

11.2 Coach Access (Coaching Package Only)

If you subscribe to a coaching package, the coach assigned to your profile will have access to your assessment results, career match scores, and coaching session notes. Coaches are bound by strict confidentiality obligations.

11.3 School Administrator Access (School Programme Only)

If you participate through a school programme, your school administrator may have access to aggregated, anonymised analytics relating to learner cohorts. Individual assessment results are not shared with school administrators unless you (or your parent/guardian, if you are a minor) provide explicit consent.

11.4 Service Providers (Operators)

We may engage trusted service providers who process personal information on our behalf (Operators), such as cloud hosting providers and email service providers. All Operators are contractually bound to process personal information only on our instructions and in accordance with POPIA, and are subject to appropriate security obligations.

11.5 Legal Requirements

We may disclose your personal information where we are required to do so by law, regulation, or valid legal process (such as a court order or subpoena), or where disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.

11.6 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred to the acquiring entity, provided that the acquiring entity agrees to be bound by the terms of this Privacy Policy and the requirements of POPIA.

12. Cross-Border Transfers

We endeavour to store your personal information within South Africa. Where it is necessary to transfer personal information to a jurisdiction outside of South Africa (for example, where our cloud infrastructure providers maintain servers in other jurisdictions), we will ensure that such transfers comply with section 72 of POPIA, which requires that the recipient country provides an adequate level of protection for personal information, or that one of the permitted exceptions applies.

Specifically, cross-border transfers will only occur where:

• The recipient is subject to law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to the conditions for the lawful processing of personal information under POPIA; or
• You have consented to the transfer; or
• The transfer is necessary for the performance of a contract between you and us; or
• The transfer is necessary for the conclusion or performance of a contract concluded in your interest; or
• The transfer is for your benefit and it is not reasonably practicable to obtain your consent, and if it were, you would be likely to give it.

13. Your Rights under POPIA

In terms of sections 23 to 25 of POPIA, you have the following rights regarding your personal information:

1. Right to access (s23): You have the right to request confirmation of whether we hold personal information about you, and to request access to such information. We will provide you with a copy of your personal information in a commonly used electronic format within a reasonable time.
2. Right to correction (s24): You have the right to request the correction or deletion of personal information about you that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
3. Right to deletion (s24): You have the right to request the deletion or destruction of personal information that we are no longer authorised to retain. Upon receiving a valid deletion request, we will delete or anonymise the relevant information within a reasonable time, except where retention is required by law.
4. Right to object (s11(3)): You have the right to object, on reasonable grounds relating to your particular situation, to the processing of your personal information. Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal.
5. Right to lodge a complaint: You have the right to lodge a complaint with the Information Regulator if you believe that we have interfered with the protection of your personal information. Contact details for the Information Regulator are set out in Section 18 below.

To exercise any of these rights, please contact us at enterprise@kth-tech.com. We will respond to your request within a reasonable time, and in any event within thirty (30) days. We may request verification of your identity before processing your request.

14. Children’s Data

iQ-X is designed for use by learners, including those under the age of 18. We take the protection of children’s personal information extremely seriously.

In accordance with section 35 of POPIA, the processing of personal information of a child (a person under the age of 18) is only permitted where:

• Processing is carried out with the prior consent of a competent person (parent or legal guardian);
• Processing is necessary for the establishment, exercise, or defence of a right or obligation in law;
• Processing is necessary to comply with an obligation of international public law;
• Processing is for historical, statistical, or research purposes; or
• Processing of the personal information is of such a nature that it is manifestly in the interest of the child.

Where a learner is under 18 years of age:

• A parent or legal guardian must register the Learner through the Parent Portal and provide informed consent for assessment and data processing;
• The Parent Portal records the identity of the consenting parent, the date and time of consent, and the version of the Terms and Privacy Policy consented to;
• The parent or guardian is entitled to exercise data subject rights on behalf of the child;
• We implement age-appropriate privacy protections;
• Special Personal Information (psychometric assessment data) is processed only with the explicit consent of the parent or guardian;
• Children’s personal information is never used for direct marketing purposes;
• A parent may withdraw consent at any time by contacting enterprise@kth-tech.com, and KTH-Tech will process the withdrawal within fourteen (14) calendar days.

15. Cookies and Tracking

iQ-X uses localStorage (a browser-based storage mechanism) for session management, authentication tokens, and user preferences. localStorage data remains on your device and is not transmitted to third parties.

We do not use third-party tracking cookies, advertising cookies, or any third-party analytics platforms that track your behaviour across other websites.

The Platform may use essential session identifiers to maintain your logged-in state and ensure the security and proper functioning of the service. These are strictly necessary and do not require separate consent under POPIA.

16. Data Breach Notification

In accordance with section 22 of POPIA, in the event of a security compromise (data breach) that results in the unauthorised access to, or acquisition of, personal information that creates a reasonable belief that identity theft or other harm to a data subject may result, we will:

1. Notify the Information Regulator as soon as reasonably possible after the discovery of the compromise, providing all relevant details as required by section 22(3) of POPIA.
2. Notify affected data subjects as soon as reasonably possible after the discovery of the compromise, providing sufficient information to allow the data subject to take protective measures, including:
   • A description of the possible consequences of the breach;
   • A description of the measures taken or to be taken to address the breach;
   • A recommendation of measures to be taken by the data subject to mitigate the possible adverse effects of the breach; and
   • The identity of the unauthorised person who may have accessed or acquired the personal information, if known.
3. Take immediate steps to contain the breach, investigate its cause, and implement measures to prevent recurrence.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable laws. When we make material changes, we will:

• Post the updated Privacy Policy on this page with a revised effective date;
• Notify registered users via email or through the Platform prior to the changes taking effect;
• Where changes relate to the processing of Special Personal Information, seek fresh consent where required.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

18. Information Regulator

If you are not satisfied with our response to any privacy-related concern, or if you believe that we have interfered with the protection of your personal information, you have the right to lodge a complaint with the Information Regulator:

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal information, please contact us:

We will acknowledge receipt of your query within five (5) business days and endeavour to provide a substantive response within thirty (30) days.