Privacy Policy

Inala Software (Pty) Ltd · Effective Date: April 1, 2026

1. Introduction

1.1 This Privacy Policy explains how Inala Software (Pty) Ltd ("Inala", "we", "us") processes Personal Information in connection with our platform and services ("Services").
1.2 We are committed to protecting Personal Information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable data protection laws.
1.3 By using the Services, you acknowledge that Personal Information will be processed as described herein.

2.1 Responsible Party (Controller): Our clients (Training Providers/Organisations) determine why and how Personal Information is processed. They hold the primary legal responsibility under POPIA.
2.2 Operator (Processor): Inala processes data strictly on the instruction of the Responsible Party to provide the Services.
2.3 User Duty: The Responsible Party warrants they have obtained all necessary consents and provided required notifications to data subjects (learners/staff) before uploading data to Inala.

Inala processes the following, but not limited to, data as submitted by Users:

Identity Data: Full names, ID/Passport numbers, date of birth, gender, and ethnicity (for SETA/B-BBEE reporting).
Contact Data: Email addresses, phone numbers, and physical addresses.
Special Personal Information (Biometrics): Photos or facial templates used exclusively for identity verification and attendance "clock-in" features. Such biometric data is used solely for identity verification and attendance control, and is not used for profiling or automated decision-making.
Geolocation Data: Specific GPS coordinates captured only at the moment of an attendance event (e.g., clocking in/out) to verify site presence. We do not perform continuous background tracking.
Professional Data: Assessment results, competency levels, and training progress.
Technical Data: IP addresses, browser types, and platform activity logs for security and audit purposes.

We process data solely to:

Operate the Inala Platform and track learner journeys.
Verify attendance and prevent fraudulent training claims.
Generate compliance reports for SETAs and regulatory bodies.
Provide technical support and ensure platform security.
Direct Marketing: We may contact Account Administrators regarding system updates or new features. We do not market to Learners unless explicitly authorized.

Processing is conducted based on:

Consent: Obtained by the Responsible Party from the data subject.
Contractual Necessity: Required to deliver the services agreed upon with the client.
Legal Obligation: To comply with South African skills development and labor regulations.

6.1 Inala does not sell Personal Information.
6.2 We share data with trusted sub-processors (e.g., Supabase and Google Cloud for hosting, Mailgun for email notifications, PostHog for platform analytics, Sentry for error monitoring, and Featurebase for in-app support) under strict confidentiality agreements.
6.3 Cross-Border Transfers: Data may be stored on secure servers outside South Africa (e.g., EU or US). We ensure that such transfers comply with Section 72 of POPIA, including ensuring that the recipient is subject to laws, binding agreements, or frameworks that provide an adequate level of protection.

Inala implements rigorous technical measures, including:

Encryption: Data is encrypted both "at rest" (on servers) and "in transit" (between your device and our servers).
Access Control: Strict role-based access ensuring only authorized personnel see specific data.
Audits: Regular security reviews to identify and mitigate vulnerabilities.

8.1 Data is retained for as long as the User's account is active.
8.2 Exit Period: Upon termination of a Paid Plan, Users have 30 days to export their records.
8.3 Deletion: After the exit period, Inala may delete or de-identify data, unless legal or audit obligations (e.g., SETA requirements) necessitate longer retention.

Under POPIA, data subjects (Learners/Staff) have the right to access, correct, or object to the processing of their data. Because Inala is an Operator, subjects should first contact their Training Provider (the Responsible Party) to exercise these rights. Inala will provide all reasonable assistance to our clients to fulfill these requests. Inala does not have a direct relationship with individual data subjects (e.g., learners), and processes such data solely on behalf of the Responsible Party.

10.1 Separately from the data we process on behalf of our clients, we collect information about how the Inala platform itself is used, so that we can maintain and improve it. For this limited category of data, Inala acts as the Responsible Party rather than as an Operator.
10.2 When a user is signed in, we record which pages are visited within the platform, interactions such as clicks and form submissions, and basic technical information about the device and browser. Each record is linked to the user account and the organisation it belongs to.
10.3 We do not record users' screens, and we do not send learner records, identity numbers, biometric data, banking details or the contents of completed forms to our analytics provider. Text displayed on the page is masked before any interaction is recorded.
10.4 This analytics data is hosted in the European Union and is processed on the basis of our legitimate interest in maintaining, securing and improving the platform. We do not use it for advertising, and we do not sell it or make it available to third parties for their own purposes.

For any privacy inquiries or to reach our Information Officer:

Empower the learner. Compliance follows. Abundance flows.