Privacy Policy

The responsible party under POPIA is Richard Catto, a sole proprietor trading as Catto Learning. The Information Officer is Richard Catto.

Responsible party

Richard Catto, trading as Catto Learning

Information Officer

Richard Catto

Physical address

215 Ujala Towers, 258 Main Road, Kirstenhof, 7945, Western Cape, South Africa

Telephone

+27 81 495 1212

Email address

admin@prettythings.capetown

Website

prettythings.capetown

We may change this policy from time to time. The date at the top of this page shows when it last changed. If a change affects how we use information we already hold about you, we will email you before it takes effect.

• Your account. Your names, your display name, your email addresses and your date of birth. If you give them: your gender, cell number, identification number, profile picture and links to your social media. Your role on the site and the company you belong to, if any. Your account reference, which the site gives your account when it is made. Checkout asks for your first name, last name and cell number.
• Identity verification. The result of each identity check, your verified name, the type, number and issuing country of your identity document, your date of birth and when you were verified. No image of your document or of your face is kept on this site.
• Billing details. Your billing name, organisation, tax number and address. They are copied into each order you place.
• Orders and payments. Your orders, what you bought and the prices, your invoices, receipts and credit notes, and each payment's method, amount and reference. For an EFT, the bank reference and date we confirmed it with. Any refund request, what you wrote in it and our decision, and any refund and the reason for it. For money back by EFT, the bank details you give us are used only to make that payment and are not stored on this site. We do not receive or store card numbers or banking login details.
• Your wallet. Each amount of wallet credit added to your wallet, spent or expired, with its date and expiry date, and the reminders we email you before credit expires.
• Emails about your payments. An email we send you about a payment, a refund or your wallet is recorded with the transaction it is about.
• Learning records. The courses you are enrolled on, your progress, every answer you give in an assessment and how long you took to answer, your marks and results, course requests and their notes, and your certificates and transcripts, with whether you have made each one public.
• Reviews. Your rating and what you write. Once a review is approved it is shown publicly with your first name and the first letter of your surname.
• Activity log. A record of actions on your account, such as signing in or changing your details. The activity log stores the IP address of each recorded action. You can see your own activity in your account.
• Sessions. Each browser session and each sign-in session stores a hashed IP address and your browser's user agent. This applies to every visitor, signed in or not. A request for a sign-in link also stores a hashed IP address.
• Analytics events. Our own record of events such as a course page being viewed, a checkout being started or a course being bought. An event stores your user number if you are signed in, or a random visitor number kept only for your browser session, with the course or order concerned and any campaign tags in the address you arrived by. Analytics events store neither an IP address nor a user agent.
• Messages. A message you send through the contact form: what it is about, your name, email address and message, your account reference and an order number or course if you give them, and the answers the form asks for its reason, such as the day, amount and reference of an EFT payment. It is kept on this site and emailed to us, and we email you its reference.

If you belong to a company, your Company Administrator can see your name, email address and role, the courses you are on and your status, progress and dates on them. The company also sees totals for each course with an average result.

We use personal information only for these purposes:

• to give you an account, sign you in and give you access to your courses
• to take orders, confirm payments, make refunds and issue invoices, receipts and credit notes
• to mark your assessments, record your results and issue certificates and transcripts
• to verify your identity before a certificate or transcript is issued
• to make sure that you are 18 or older
• to let a company manage the courses of its staff members
• to keep the site secure and to investigate misuse
• to measure which courses are viewed and bought
• to answer your questions and complaints
• to keep the financial records the law requires

We do not sell personal information.

This site is for adults. Learners must be 18 or older. You give your date of birth when you register, or the first time you sign in if someone else created your account. If you are under 18 we refuse the registration and keep nothing you typed. If your verified identity document shows that you are under 18, your account cannot be used.

You may take a course under any name you choose.

A certificate proves that you took a course. It never states that you passed. You earn it when you have completed every assessment in the course, whether you pass or fail. A certificate and a transcript are issued only after your identity has been verified. Both state your name exactly as it appears on your identity document.

Your identity is verified by an identity verification provider. On its secure page you photograph your identity document and take a live selfie, and the provider checks them. The provider tells this site the result. This site keeps no images. It keeps only the result, your verified name, the type, number and issuing country of your document, your date of birth and when you were verified.

The purpose is to protect the credibility of certificates and transcripts.

A certificate shows your verified name, the course, the date you completed it, the certificate number, the accreditation and the provider. It shows no mark or grade. A transcript records each module assessment mark, the final assessment mark and the overall grade, which is 50% module assessments and 50% final assessment.

The site sets three cookies. None is an advertising or third-party tracking cookie.

• catto_learning_web keeps your browser session: your cart, your checkout steps, form protection and the random analytics visitor number. It is set for every visitor. It ends when you close your browser, and its record on the server is removed after 24 hours without use.
• catto_learning_session keeps you signed in. It is set when you sign in. It lasts 24 hours and is renewed while you use the site.
• cl_palette remembers the colour palette the site is shown in. It is set when a theme that offers colour palettes is shown. It lasts 1 year.

The site also keeps small display settings in your browser's local storage, such as the chosen palette and the position of the menu. They stay in your browser.

• A payment provider. A card payment is made on our payment provider's secure page. Card details and banking logins are entered there and never reach this site. The payment provider tells this site whether the payment succeeded. It may process personal information outside South Africa.
• An identity verification provider. When you verify your identity, you photograph your identity document and take a live selfie on the provider's secure page. The provider checks them and tells this site the result, with your verified name, the type, number and issuing country of your document and your date of birth. It may process personal information outside South Africa.
• A hosting provider. The site and its database are hosted on a server in Canada. Your personal information is therefore stored outside South Africa.
• Email. Email is sent from the site's own mail server on the same host.
• A web font service. When the site is shown in the Gilded Noir or Light Default theme, your browser loads fonts from a web font service, which then receives your IP address.
• A video service. Some course videos are embedded from a video service in its privacy-enhanced mode. When you open a page with such a video, your browser connects to that service.
• Your company. Your Company Administrator sees the information set out in section 2.
• The public. An approved review, as section 2 explains, and a certificate or transcript you have made public, as section 5 explains.

We also disclose personal information when the law requires it.

Orders and transaction records

At least 5 years

Activity log

5 years

Analytics events

5 years

Contact messages

5 years

Sign-in links

30 minutes

Sessions

24 hours

Your account details, your date of birth, your identity verification results, learning records, certificates and reviews are kept for as long as you have an account. Activity log entries, analytics events and contact messages older than 5 years are deleted automatically every day.

• The site has no passwords. You sign in with a one-time link that expires after 30 minutes.
• Sign-in links and sign-in sessions are stored only in hashed form.
• Card details and banking logins are entered on our payment provider's pages and never reach this site.
• Identity documents and selfies are checked on the identity verification provider's page. This site never receives or keeps an image of them.
• You can see your active sessions in your account and end any of them.

If a security breach affects your personal information, we will tell you and the Information Regulator as POPIA requires.

Under POPIA you have the right to:

• ask whether we hold personal information about you and ask for a copy of it
• ask us to correct or delete personal information that is inaccurate, out of date, excessive or unlawfully obtained
• ask us to delete personal information we no longer have a right to keep
• object to the processing of your personal information on reasonable grounds
• withdraw a consent you have given
• complain to the Information Regulator

You can correct most of your details yourself in your account profile. To exercise any other right, contact the Information Officer, Richard Catto:

• email admin@prettythings.capetown
• telephone +27 81 495 1212
• post to 215 Ujala Towers, 258 Main Road, Kirstenhof, 7945, Western Cape, South Africa

We may ask you to prove who you are before we act on a request. Records that the law requires us to keep, such as order and transaction records, cannot be deleted while that duty lasts.

You have the right to complain to the Information Regulator at https://inforegulator.org.za.