Privacy Policy

1. Introduction

• 1.1 This Privacy Policy explains how Inala Software (Pty) Ltd ("Inala", "we", "us") processes Personal Information in connection with our platform and services ("Services").
• 1.2 We are committed to protecting Personal Information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable data protection laws.
• 1.3 By using the Services, you acknowledge that Personal Information will be processed as described herein.

2. Roles & Responsibilities

• 2.1 Responsible Party (Controller): Our clients (Training Providers/Organisations) determine why and how Personal Information is processed. They hold the primary legal responsibility under POPIA.
• 2.2 Operator (Processor): Inala processes data strictly on the instruction of the Responsible Party to provide the Services.
• 2.3 User Duty: The Responsible Party warrants they have obtained all necessary consents and provided required notifications to data subjects (learners/staff) before uploading data to Inala.

3. Categories of Data Processed

Inala processes the following, but not limited to, data as submitted by Users:

• Identity Data: Full names, ID/Passport numbers, date and place of birth, nationality, gender, home language, and ethnicity (for SETA/B-BBEE reporting).
• Contact Data: Email addresses, phone numbers, and physical addresses.
• Special Personal Information (Biometrics): Photos or facial templates used exclusively for identity verification and attendance "clock-in" features. Such biometric data is used solely for identity verification and attendance control, and is not used for profiling or automated decision-making.
• Special Personal Information (Disability): Disability status (for SETA/B-BBEE reporting).
• Geolocation Data: Specific GPS coordinates captured only at the moment of an attendance event (e.g., clocking in/out) to verify site presence. We do not perform continuous background tracking.
• Financial Data: Bank account details (e.g., for learner stipends).
• Professional Data: Assessment results, competency levels, training progress, employment status, and applications for learnerships and other opportunities.
• Documents: Copies of documents uploaded to the platform, such as identity documents and certificates.
• Communications Data: Messages exchanged with learners and staff by email and WhatsApp.
• Technical Data: IP addresses, browser types, and platform activity logs for security and audit purposes.

4. Purpose of Processing

We process data solely to:

• Operate the Inala Platform and track learner journeys.
• Verify attendance and prevent fraudulent training claims.
• Generate compliance reports for SETAs and regulatory bodies.
• Provide technical support and ensure platform security.
• Send messages to learners and staff by email and WhatsApp.
• Help users set up projects from their own documents, using AI (see section 11).
• Direct Marketing: We may contact Account Administrators regarding system updates or new features. We do not market to Learners unless explicitly authorized.

5. Legal Basis for Processing

Processing is conducted based on:

• Consent: Obtained by the Responsible Party from the data subject.
• Contractual Necessity: Required to deliver the services agreed upon with the client.
• Legal Obligation: To comply with South African skills development and labor regulations.

6. Data Sharing & Sub-Processors

• 6.1 Inala does not sell Personal Information.
• 6.2 We share data with the following trusted sub-processors, under strict confidentiality agreements: Supabase and Google Cloud (hosting and storage); Vercel (hosting of our web apps); Mailgun (email notifications); Meta (WhatsApp) (WhatsApp messaging with learners and staff); Paystack (card payments); Google Maps (maps and address lookups); Anthropic (the AI features described in section 11); PostHog (platform analytics, see section 10); Sentry (error monitoring); Featurebase and Slack (in-app support).
• 6.3 Cross-Border Transfers: Data may be stored or processed on secure servers outside South Africa (e.g., EU or US). We ensure that such transfers comply with Section 72 of POPIA, including ensuring that the recipient is subject to laws, binding agreements, or frameworks that provide an adequate level of protection.

7. Security Measures

Inala implements rigorous technical measures, including:

• Encryption: Data is encrypted both "at rest" (on servers) and "in transit" (between your device and our servers).
• Access Control: Strict role-based access ensuring only authorized personnel see specific data.
• Audits: Regular security reviews to identify and mitigate vulnerabilities.

8. Retention & Deletion

• 8.1 Data is retained for as long as the User's account is active.
• 8.2 Exit Period: Upon termination of a Paid Plan, Users have 30 days to export their records.
• 8.3 Deletion: After the exit period, Inala may delete or de-identify data, unless legal or audit obligations (e.g., SETA requirements) necessitate longer retention.

9. Data Subject Rights

• Under POPIA, data subjects (Learners/Staff) have the right to access, correct, or object to the processing of their data. Because Inala is an Operator, subjects should first contact their Training Provider (the Responsible Party) to exercise these rights. Inala will provide all reasonable assistance to our clients to fulfill these requests. Inala does not have a direct relationship with individual data subjects (e.g., learners), and processes such data solely on behalf of the Responsible Party.

10. Platform Usage Analytics

• 10.1 Separately from the data we process on behalf of our clients, we collect information about how the Inala platform itself is used, so that we can maintain and improve it. For this limited category of data, Inala acts as the Responsible Party rather than as an Operator.
• 10.2 When a user is signed in, we record which pages are visited within the platform, interactions such as clicks and form submissions, and basic technical information about the device and browser. Each record is linked to the user account and the organisation it belongs to.
• 10.3 We do not record users' screens, and we do not send learner records, identity numbers, biometric data, banking details or the contents of completed forms to our analytics provider. Text displayed on the page is masked before any interaction is recorded.
• 10.4 This analytics data is hosted in the European Union and is processed on the basis of our legitimate interest in maintaining, securing and improving the platform. We do not use it for advertising, and we do not sell it or make it available to third parties for their own purposes.

11. AI-Assisted Features

• 11.1 Some features of the platform use artificial intelligence (AI) provided by Anthropic, PBC, a company in the United States, acting as our sub-processor. Currently these are the project import and Inala Assistant.
• 11.2 Project import: when a user uploads documents to set up a project (for example a training plan, a schedule, a curriculum or a learner list), the documents are sent to Anthropic so that the AI can read them and draft the project for the user. To match what the documents say to the organisation's existing records, the AI also receives details from the organisation's own account, for example details of its clients, venues, qualifications and projects, and the names, email addresses and roles of its staff and of the facilitators, assessors and moderators it works with. The AI only prepares a draft. Nothing is created until a user has reviewed the draft and confirmed it.
• 11.3 Inala Assistant: staff of an organisation can ask questions about that organisation's own data, for example how many learners are active on a project, which learners' attendance is below a threshold, or which sessions still need an attendance register. To answer, the platform retrieves the figures and records the question needs, from that organisation's data only, and sends them with the question to Anthropic. These can include the names of learners and staff and learners' Inala codes; enrolment, attendance, assessment and training progress details; the names of projects, clients, groups, venues and qualifications; and, when a question asks for them, demographic details (gender, race, age, home language, province and disability status). Race and disability status are Special Personal Information under POPIA and are used only for the reporting the organisation asks for.
• 11.4 Inala Assistant never receives identity or passport numbers, dates of birth (only an age), tax numbers, contact details or addresses, bank details, GPS positions, photos, uploaded documents, or internal comments and support messages. It can read data but cannot change it.
• 11.5 The AI does not make decisions about learners or staff, and it is not used for profiling.
• 11.6 Anthropic processes this data only to provide its service to Inala, under a data processing agreement, and may not use it to train its AI models. Anthropic deletes it within 30 days, unless it is flagged as a possible breach of Anthropic's usage policies (it may then be kept for up to 2 years) or the law requires it to be kept longer.
• 11.7 Inala deletes the uploaded documents of a project import, and what the AI read and drafted from them, 14 days after the import was last worked on. Inala Assistant conversations, and the results and reports made in them, are visible only to the user who had them and are deleted 30 days after they were last used. The projects, learners and other records a user confirms are kept like any other platform data (see section 8).

12. Contact Us

For any privacy inquiries or to reach our Information Officer:

• Inala Software (Pty) Ltd
• Attn: Information Officer
• Email: data@inala.io
• Address: 7 Bree St, Cape Town City Centre, Cape Town, 8001