This manual is published in terms of Section 51 of PAIA and POPIA for Education (Pty) Ltd. It describes your rights and how to exercise them.
The purpose of this manual is to assist data subjects and other potential requestors of information exercise their constitutional right to access information and privacy, as enacted by:
| - | Promotion of Access to Information Act 2, of 2000 (PAIA) |
| - | Protection of Personal Information Act 4, of 2013 (POPIA) |
| - | Regulations relating to the Protection of Personal Information of 2018 |
| - | Regulations relating to the Promotion of Access to Information Act of 2021. |
This manual contains information that will assist data subjects and other requestors make requests to access personal and other information from our company. It also contains information about the rights of data subjects and how they can be exercised.
This manual will be amended from time to time and the latest version published on our website, available for viewing as a hard copy at our company’s head office or obtainable from our information officer on request.
Section 50 of PAIA requires that a requester of access to records of a private body be given access to any record if:
| (a) | that record is required for the exercise or protection of any rights (including the right to privacy); |
| (b) | that person complies with the procedural requirements in this Act relating to a request for access to that record; and |
| (c) | access to that record is not refused in terms of any ground for refusal. |
| NOTE: If you are making a request on behalf of a public body (as defined in section 1 of PAIA), the request to access a record of our company to exercise or protect a right you must be acting in the public interest. | |
| NOTE. A request may include a request for access to a record containing personal information about the requester or the person on whose behalf the request is made. | |
Section 51 of PAIA requires that our chief executive officer must make this manual available containing:
| (i) | the postal and street address, phone and fax number and, if available, electronic mail address of our chief executive officer; |
| (ii) | a description of the guide, compiled by the Information Regulator, to assist a person who wishes to exercise any right contemplated in PAIA and POPIA, and how to obtain access to it; |
| (iii) | the latest notice in terms of section 52(2) of PAIA, if any, regarding the categories of record of the body which are available without a person having to request access in terms of PAIA; |
| (iv) | a description of the records of the body which are available in accordance with any other legislation; |
| (v) | sufficient detail to facilitate a request for access to a record of the body, a description of the subjects on which the body holds records and the categories of records held on each subject; |
| (vi) | the purpose of the processing; |
| (vii) | a description of the categories of data subjects and of the information or categories of information relating thereto; |
| (viii) | the recipients or categories of recipients to whom the personal information may be supplied; |
| (ix) | planned transborder flows of personal information; |
| (x) | a general description allowing a preliminary assessment of the suitability of the information security measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information which is to be processed. |
Section 10 of POPIA specifies that personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive. Section 13(1) of POPIA requires that personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party. Further, POPIA requires that steps be taken by our responsible party to ensure that data subjects are aware of the purpose of the collection of the information unless there is a legal basis not to do so.
Our responsible party has prepared this manual to assist data subjects and other potential requestors become familiar with the purposes for the collection and processing of their personal information. Our responsible party has ensured documentation of all processing operations under the company's responsibility or control is available to data subjects who are considering objecting to the processing of their personal information, or making another type of request.
Section 18(1) of POPIA states that where our company collects personal information, our responsible party must take reasonably practicable steps (which is done via this manual) to ensure that data subjects are aware of:
| (a) | the information being collected and where the information is not collected from the data subject, the source from which it is collected; | ||
| (b) | the name and address of the responsible party; | ||
| (c) | the purpose for which the information is being collected; | ||
| (d) | whether or not the supply of the information by that data subject is voluntary or mandatory; | ||
| (e) | the consequences of failure to provide the information;the consequences of failure to provide the information; | ||
| (f) | any particular law authorising or requiring the collection of the information; | ||
| (g) | the fact that, where applicable, the responsible party intends to transfer the information to a third country or international organisation and the level of protection afforded to the information by that third country or international organisation; | ||
| (h) | any further information such as the— | ||
| (i) | recipient or category of recipients of the information; | ||
| (ii) | nature or category of the information; | ||
| (iii) | existence of the right of access to and the right to rectify the information collected; | ||
| (iv) | existence of the right to object to the processing of personal information as referred to in section 11(3); and | ||
| (v) | right to lodge a complaint to the Information Regulator and the contact details of the Information Regulator. | ||
Section 23(1) of POPIA states that a data subject, having provided adequate proof of identity, has the right to request our responsible party to:
| (a) | confirm, free of charge, whether or not we hold personal information about the data subject |
| (b) | request the record or a description of the personal information about the data subject held by the responsible party |
| (c) | request information about the identity of all third parties, or categories of third parties, who have, or have had, access to the personal information of the data subject. |
Section 24(1) of POPIA states that a data subject, may request our responsible party to:
| (a) | correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully |
| (b) | destroy or delete a record of personal information about the data subject that the responsible party is no longer authorised to retain |
| (c) | provide, to his, her or its satisfaction, with credible evidence (i.e. assurance) in support of the information |
| (d) | take such steps as are reasonable in the circumstances where agreement cannot be reached between the responsible party and the data subject, and if the data subject so requests, to attach to the information in such a manner that it will always be read with the information, an indication that a correction of the information has been requested but has not been made. |
Section 18(1) of POPIA requires our responsible party to inform data subjects of their right:
| (a) | of access to the personal information our company has collected about themselves |
| (b) | to rectify the personal information collected |
| (c) | to object to the processing of their personal information by ourselves |
| (d) | to lodge a complaint to the Information Regulator about non-compliance with any of the conditions |
| (e) | to receive from our responsible party the contact details of the Information Regulator. |
Section 23(1) of POPIA requires our responsible party to inform data subjects of their right:
| (a) | to request the correction or deletion of personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; |
| (b) | to request the destruction or deletion a record of personal information about the data subject that the responsible party is no longer authorised to retain. |
This manual applies to Milpark Education (Pty) Ltd (Registration No. 2004/026244/07), which conducts business as a private higher education institution offering a variety of courses and programmes, including but not limited to Higher Education and Further Education and Training qualifications, short courses, and bespoke courses for corporate clients, with a focus on online learning.
Milpark Education is registered with the South African Department of Higher Education and Training (DHET) as a Private Higher Education Institution (No 2007/HE07/003). Milpark Education is part of Stadio Holdings. Milpark Education's Higher Education programmes are accredited by the Higher Education Quality Committee (HEQC), a permanent sub-committee of the Council on Higher Education (CHE). Milpark Education's qualifications are listed on the National Qualifications Framework by SAQA and is also accredited by a number of SETAs to offer tuition towards a variety of TVET learning programmes.
To view our service offering, visit www.milpark.ac.za.
Milpark Education appreciates the importance of the human right to privacy in the Information Age, and we recognise our ethical and legal duties to protect the personal information we process. Every employee has a role to play and is guided by our organisational values, policies and training. Together, we ensure that:
Our objectives are not only to comply with the law and align with best practices, but also to position Milpark as a trustworthy custodian of personal information and therefore, together with our commitment to quality education, as a preferred service provider to students and corporate clients.
| # | Business Area | Primary Functions |
|---|---|---|
| 1 | Academic Schools and College | Admissions, teaching, learning, assessment, quality control, alumni management |
| 2 | Student Administration & Support | Registration, student journey management, disciplinary processes, bursaries |
| 3 | Commercial / Sales | Corporate clients, learnerships, key accounts, Business to Business sales |
| 4 | Finance | Financial management, debtor management, BBBEE reporting, audit verification |
| 5 | Human Resources | Recruitment, payroll, performance management, employee wellness |
| 6 | Information Technology | System development, information security, disaster recovery, IT support |
| 7 | Marketing | Direct marketing, bulk communication, consent management, events |
| 8 | Facilities & Logistics | Access control, distribution of study materials, examination coordination |
Requests to Milpark Education in terms of PAIA or POPIA should be addressed to the Deputy Information Officer.
| Responsible Party | Business Functions | Information Officer |
|---|---|---|
| Milpark Education (Pty) Ltd Reg. No. 2004/026244/07 |
Private higher education institution — all business functions including academic delivery, student administration, HR, finance, marketing, and IT | Candice le Sueur Fisher Head: Risk & Compliance Information Officer |
| privacy@milpark.ac.za | |
| Telephone | 087 405 9632 / +27 87 405 9571 |
| Postal Address | PO Box 44235, Claremont, Cape Town, 7735 |
| Street Address | 3rd Floor, Deneb House, 368 Main Road, Observatory, Cape Town, 7925 |
| Reception | 086 999 0001 |
Obtainable from our information officer, in your preferred official language, is a guide prepared by the Information Regulator, containing information that will assist you exercise your right of access to information held by the State or another person, and that is required by you to exercise or protect any other rights.
| This guide includes a description of- | |||
| 4.01 | the objects of this Act | ||
| (a) | to give effect to the constitutional right of access to- | ||
| (i) | any information held by the State; and | ||
| (ii) | any information that is held by another person and that is required for the exercise or protection of any rights; | ||
| (b) | to give effect to that right- | ||
| (i) | subject to justifiable limitations, including, but not limited to, limitations aimed at the reasonable protection of privacy, commercial confidentiality and effective, efficient and good governance; and | ||
| (ii) | in a manner which balances that right with any other rights, including the rights in the Bill of Rights in Chapter 2 of the Constitution; | ||
| (c) | to give effect to the constitutional obligations of the State of promoting a human rights culture and social justice, by including public bodies in the definition of 'requester', allowing them, amongst others, to access information from private bodies upon compliance with the four requirements in this Act, including an additional obligation for certain public bodies in certain instances to act in the public interest; | ||
| (d) | to establish voluntary and mandatory mechanisms or procedures to give effect to that right in a manner which enables persons to obtain access to records of public and private bodies as swiftly, inexpensively and effortlessly as reasonably possible; and | ||
| (e) | generally, to promote transparency, accountability and effective governance of all public and private bodies by, including, but not limited to, empowering and educating everyone- | ||
| (i) | to understand their rights in terms of this Act in order to exercise their rights in relation to public and private bodies; | ||
| (ii) | to understand the functions and operation of public bodies; and | ||
| (iii) | to effectively scrutinise, and participate in, decision-making by public bodies that affects their rights. | ||
| 4.02 | the postal and street address, phone and fax number and, if available, electronic mail address of- | ||
| (i) | the information officer of every public body, and | ||
| (ii) | every deputy information officer of every public body designated in terms of section 17 (1); | ||
| 4.03 | such particulars of every private body as are practicable | ||
| 4.04 | the manner and form of a request for- | ||
| (i) | access to a record of a public body contemplated in section 11; and | ||
| (ii) | access to a record of a private body contemplated in section 50 | ||
| 4.05 | the assistance available from the information officer of a public body in terms of this Act | ||
| 4.06 | the assistance available from the Information Regulator in terms of this Act; | ||
| 4.07 | all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by this Act, including the manner of lodging- | ||
| (i) | an internal appeal; and | ||
| (ii) | an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision of the head of a private body | ||
| 4.08 | the provisions of sections 14 and 51 requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual; | ||
| 4.09 | the provisions of sections 15 and 52 providing for the voluntary disclosure of categories of records by a public body and private body, respectively; | ||
| 4.10 | the notices issued in terms of sections 22 and 54 regarding fees to be paid in relation to requests for access; and | ||
| 4.11 | the regulations made in terms of section 92. | ||
| POPIA section 110 has amended sections 51 of PAIA to the following extent: | ||||
| PAIA - Private Bodies |
||||
| Section 51 | (1) | The head of a private body must make a manual available containing- | ||
| (a) | in general— | |||
| (i) | the postal and street address, phone and fax number and, if available, electronic mail address of the head of the body and ; | |||
| (ii) | such other information as may be prescribed; | |||
| (b) | insofar as this Act is concerned— | |||
| (i) | a description of the guide referred to in section 10, if available, and how to obtain access to it; | |||
| (ii) | the latest notice, in terms of section 52(2), if any, regarding the categories of records of the body which are available without a person having to request access in terms of this Act; | |||
| (iii) | a description of the records of the body which are available in accordance with any other legislation; and | |||
| (iv) | sufficient detail to facilitate a request for access to a record of the body, a description of the subjects on which the body holds records and the categories of records held on each subject; | |||
| (c) | insofar as the Protection of Personal Information Act, 2013, is concerned— | |||
| (i) | the purpose of the processing; | |||
| (ii) | a description of the categories of data subjects and of the information or categories of information relating thereto; | |||
| (iii) | the recipients or categories of recipients to whom the personal information may be supplied; | |||
| (iv) | planned transborder flows of personal information; and | |||
| (v) | a general description allowing a preliminary assessment of the suitability of the information security measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information which is to be processed. | |||
| ORGANISATIONAL UNIT |
Finance |
| Function/Activity |
aaa |
| Process/Area/Service |
aaa |
| BUSINESS PURPOSE: | Administration, control and payment of staff salaries, entitlements and re-imbursements after deduction of Receiver, medical, health and other payments and contributions. |
| No. | Sub-process | Record | Possession | Data Subject Category | Information Category | Recipients | Transborder | Security Measures |
| 1 | sub-process | |||||||
| 2 | sub-process | |||||||
| 3 | sub-process |
Subjects and categories of records held by Milpark Education are set out below. In each instance, "including" will mean "including, but not limited to".
Contracts and agreements; correspondence; contact and biographical information; unique identifiers; records of current or past academic performance.
Direct marketing consent status; records of contact information and changes to consent.
Biographical information, education history, health information where necessary, supporting documentation; academic records, student statistics, conduct records, financial transaction records, disciplinary process records, assessment records, graduation and certification records, attendance registers; verification documents from third parties.
Records provided by the client; financial transaction records; records of students enrolled by corporate client; reports to clients.
Employment contracts, statutory employee records, disciplinary and grievance processes, performance appraisals, payroll records, health records, leave records, training records, BBBEE race information as required.
Registration documents, banking details, certificates, claim forms, correspondence.
CCTV footage; log-in/sign-in information and logs.
All records as required by law.
Records are retained as required by applicable legislation including the Basic Conditions of Employment Act, BBBEE Act, Companies Act, Consumer Protection Act, Employment Equity Act, Higher Education Act, Income Tax Act, Labour Relations Act, NQF Act, OHSA, PAIA, POPIA, Skills Development Acts, and UIF Acts.
Milpark Education processes personal information for the following purposes, listed per business area:
Pre-admission screening and admission applications, payments processing, recruitment of adjunct faculty, grading and moderation, quality control, processing special applications, providing student support, networking and marketing, contractor appointments, administration and management of academic journey, regulatory reporting, alumni relationship management, teaching and learning, responding to enquiries, at-risk student identification and intervention, monitoring of student engagement, compliance with obligations in law, online remote proctoring.
Assessment and results processing, certification, graduation organisation, qualification verification to prevent qualification fraud.
Processing enquiries and assisted applications for studying, student journey management, lead relationship management, consent management.
Customer relationship management, new business development, key accounts management, corporate student admission and registration administration, reporting, contracting, learnership and bursary administration, Business to Business Sales, onboarding and delivery, WSP/BBBEE scorecard management.
Financial management, due diligence, debtor management, fraud prevention, customer relationship management, processing payments, supplier management, financial and management reporting, BBBEE reporting, audit verification, compliance with legal requirements.
Compliance with legal requirements, recruitment and selection, employee management, facilitation of communication with wellness service provider, contract management, performance management, processing staff study and loan applications, conducting internal disciplinary hearings, payroll submissions, BBBEE assessments, employee exit process.
Compliance with legal requirements, system development, disaster recovery, fulfilling staff requests, student journey management, student communication, employee information management, asset management, IT support, information security management.
Direct marketing, bulk communication, directing enquiries, hosting webinars, competitions, and events, consent management.
Admissions and registrations for corporate clients, learnerships, and online applications; responding to queries; processing special applications including accommodation of disabilities; reporting to corporate clients; compliance with regulatory requirements; prevention of qualification fraud.
Processing and administration of surveys, bursaries, disciplinary hearings, student appeals, student complaints, student queries, reporting.
Note: Some purposes may span across various intersecting business areas, but have been listed with main areas only.
Milpark Education may share the personal information of data subjects with third parties as follows:
Milpark Education makes use of service providers and service partners who are in other countries or function as international organisations or process your information in other territories. Milpark Education aims to ensure that the requirements of Section 72 of POPIA are met, often by way of contracts.
Some service providers or partners may not offer protections similar to POPIA, and data subjects may refer to their contracts with Milpark Education, or the relevant Privacy Notices for more information.
Cloud hosting and backup services may store data in the European Union or United States. Details of specific transfers are available on request from the Information Officer at privacy@milpark.ac.za.
Information is a critical asset and Milpark Education, along with its employees, is committed to ensuring the confidentiality, integrity and availability of personal information and other data that are processed by our services and business operations.
The following documents are available for public inspection in compliance with the Higher Education Act:
Available on the Milpark Education website at no cost, or at head office in Cape Town during normal business hours.
No categories of information available from Milpark Education, without making a request in terms of PAIA, have been published in terms of Section 52 of PAIA.
If you are a student or alumnus, personal information is accessible on myMilpark, the student portal, where you can access, view and update most personal information fields and view academic records without contacting the Deputy Information Officer.
To make a request in terms of PAIA or POPIA, use this Information Officer Portal:
| Request Type | When to use |
|---|---|
| Information request | Confirm whether Milpark holds personal information about you |
| Access request | Request access to a record in terms of PAIA or POPIA |
| Objection notification | Object to processing of your personal information |
| Destruction / Restriction | Request destruction or restriction of personal information |
All requests are subject to identity verification. Response timeframes: within 30 days (extendable by a further 30 days with written notice).
For assistance, contact the Information Officer at privacy@milpark.ac.za or 087 405 9632.
Milpark Education does not charge any fees for requests made in terms of PAIA or POPIA.
If a request for access to information is denied by Milpark Education's Information Officer or a duly authorised person, the requestor is entitled to apply to a court with appropriate jurisdiction, or the Information Regulator, for relief.
A downloadable PDF version of this manual is available on request from the Information Officer.
This Information Officer Portal comprises several components designed to assist information officers perform their duties and engage with data subjects.