Scenda helps South African learners apply to universities, for NSFAS funding, for bursaries and for accommodation. Doing that means we handle information that is personal to you, and some of it (your ID number, your results, your household's financial need) is sensitive. This notice explains exactly what we collect, why we are allowed to, who else sees it, and what you can make us do about it.

It is written to be read, not to be survived. If anything here is unclear, email community@scenda.co.za and ask.

Who is responsible

Scenda (Pty) Ltd (registration number 2025/457579/07) is the responsible party for your personal information. You can reach us at community@scenda.co.za or +27 74 696 4520.

Our Information Officer is Hopewell Fakude. Queries and complaints about how we handle your personal information can be sent to the contact details above and will reach them.

What we collect

We collect only what an application actually needs.

  • Your account. Your name, email address, WhatsApp number, the intake year you are applying for, and a password we store only as a one-way hash. We never hold your password itself and cannot read it. If you sign in with Google, we also keep the account identifier Google gives us, so we can recognise you next time.
  • Your learner profile. Your ID number, gender, phone number, province, school, subjects and marks, matric average, intended field of study and career path, the institutions and programmes you choose, and your household income band and wish to apply for funding. Your ID number and financial information are collected because institutions and NSFAS require them on the application; nothing else uses them.
  • Disability, only if you choose to tell us. Whether you have a disability is health information, which POPIA treats as special personal information. The question is optional. If you answer it, you consent to us using the answer only to include it in applications where the institution or NSFAS asks for it (for example for support services or NSFAS's higher income threshold).
  • Your parent or guardian. Their name, relationship to you, phone number and email, and, if you apply for funding, their ID and proof of income. Please tell them you are sharing this. If they pay for you through a payment link, their name and email as given to our payment provider are kept with the payment record.
  • Chats with our WhatsApp assistant. If you message Scenda on WhatsApp, we keep the conversation and the answers you give it (such as your marks) so it can pick up where you left off.
  • Security records. The network address of failed sign-in attempts and of new sign-ups, kept for a short time to stop password guessing and fake accounts, and a record of the consents you have given or withdrawn.
  • Documents you upload. Identity documents, results and supporting paperwork. These are held in private storage. The database records only a reference to the file, never a public link, and the files are served through an authenticated route that checks on every single request that the file is yours to see.
  • Your applications. Which institutions, bursaries, residences, NSFAS and NBT applications you have made, their status, and the messages and notifications attached to them. Your specialist may add working notes (such as reference numbers and what an institution said) and supporting files to an application.
  • Payment records. Whether you have paid, when, and the reference. Your card details are entered on our payment provider's systems, never on ours. We never see or store a card number.

Why we are allowed to process it

Every item above rests on one of three lawful bases in POPIA:

  • Your consent, given at sign-up, for preparing and submitting applications on your behalf. You can withdraw it at any time (see below). Withdrawing it stops future processing; it does not undo an application already sent to an institution, because we cannot recall it from them.
  • Performance of our agreement with you: we cannot deliver the service you paid for without sending your application to the institutions you chose.
  • Our legal obligations: payment and tax records we are required to keep.

If you are under 18, POPIA treats you as a child and requires the consent of a parent or guardian. The sign-up form asks you to confirm that a parent or guardian has agreed to this notice and our Terms of Service on your behalf. A parent or guardian can contact us at any time to ask what we hold or to withdraw that consent.

Automated processing

Some work is done by software rather than by a person. Our WhatsApp assistant is an AI system that answers questions and works out an estimated APS score and which programmes you may qualify for from the marks you give it. Our application tools check your profile and documents and prepare each application for your specialist.

None of this decides anything about you on its own. Estimates are guidance, a verified Scenda specialist reviews every application before it is submitted, and the decision to admit you or fund you is always made by the institution or funder. You can ask a person at Scenda to review anything the software told you.

Who else sees it

We do not sell your personal information, and we do not share it for advertising. It goes only to the recipients below:

  • Your Scenda specialist. When you sign up, Scenda assigns you a verified Application Support Specialist, who can see your profile, documents and applications and prepares and submits them for you. If your specialist changes, the previous one loses access.
  • The institutions and funders you apply to. This is the point of the service. Once your application reaches a university, NSFAS, a bursary fund or a residence, that organisation becomes responsible for the copy it holds, under its own privacy terms. We cannot delete it on your behalf.
  • Admissions staff of those institutions, inside Scenda. Where an institution uses Scenda's admissions portal, its staff can see your name, email, profile, results and the documents in your vault, but only while you have an application with that institution. They see only their own institution's applications, never your applications elsewhere, our working notes or files your specialist attached to other applications.
  • Our messaging provider (Twilio). They deliver our WhatsApp messages and, on most deployments, our emails, so they handle your phone number, email address and the contents of those messages. They operate in the United States.
  • Our AI provider (Anthropic). Messages you send our WhatsApp assistant, and the marks and choices you give it, are processed by Anthropic's AI service to write the replies. They operate in the United States.
  • Google, if you choose “Sign in with Google”. Google confirms your identity and gives us your name and email address. Our own team also uses Google's email service, so internal alerts about new sign-ups (your name, email and WhatsApp number) pass through Google. If you choose application-email forwarding, only the messages you forward are received in our Workspace mailbox. We do not request access to your personal inbox. Your assigned specialist and Scenda administrators can read shared copies. App copies are encrypted and removed after 90 days or when you disable receiving; already delivered Workspace mailbox copies follow its retention policy and can be removed on request. Remove your own forwarding filter when you stop sharing. We do not automatically accept offers or import email attachments. Optional Meet invitations and private document filing also use Google Workspace when enabled. Our use of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements.
  • Our payment provider (PayFast). They process your payment and hold the card details we never see.
  • Our email provider. They deliver the emails we send you, so they handle your email address and the contents of those messages. They operate outside South Africa (see below).
  • Our hosting provider (Fly.io). Our application and database run on their infrastructure, in their Johannesburg region.
  • Our file storage provider. The documents you upload are not kept in the database. They are kept in a separate file store, which is not restricted to South Africa. See below.

If you engage your own agent or school representative to apply on your behalf through Scenda, they can see and upload documents on your profile, because that is what you engaged them to do.

Where it is stored, and how long we keep it

Two different systems hold your information and they are not in the same place. We would rather set that out than round it off to “South Africa”.

Your account and your answers stay in South Africa. Your profile, your ID number, your results, your applications and your messages are in our database, which runs in our hosting provider's Johannesburg region.

The files you upload do not stay in South Africa. The copy of your ID, your results and your supporting documents go to a separate file store that is not restricted to any one country. A file is kept in the region nearest to where it was uploaded, and a copy is made in another region if it is opened from there; small files are distributed worldwide immediately. So a document you upload to Scenda may be held outside South Africa. We are telling you that rather than leaving you to assume otherwise.

Messages leave the country too. Emails and WhatsApp messages go through our messaging provider, WhatsApp chats with our assistant are processed by our AI provider, and Google sign-in and our team's email run on Google. These providers operate in the United States.

POPIA (section 72) allows personal information to be sent outside South Africa where the transfer is needed to perform our agreement with you, or where the recipient is bound by law or by binding agreement to protect it to a standard comparable to POPIA. We rely on both: each of these providers is needed to deliver the service, and each processes your information under its own data-protection terms. Your payment is processed by PayFast, in South Africa. The providers named in this notice are the only ones we send your information abroad to.

We keep your information for as long as your account is open, because an application cycle runs for months and outcomes arrive long after you submit.

Deleting your account is a request, not a button: a person at Scenda receives it and carries it out, and we do it as soon as we reasonably can. When we do, we erase your stored documents first and then delete your record, which cascades to your profile, applications, documents, messages and notifications. Payment records are the exception: tax law requires us to keep them for five years. We keep them without your account attached, but they still hold the payment reference and the payer's name and email as recorded by the payment provider. If there is anything else we cannot delete because the law requires us to keep it, we will tell you what it is and why.

We have not yet set a fixed period after which a dormant account is deleted automatically. Until we do, deletion happens when you ask for it, and you can ask at any time.

Your rights, and how to use them

POPIA gives you rights over your information. All of them work today:

  • See what we hold. Your profile, documents and applications are visible to you in your dashboard at any time.
  • Correct it. Edit your profile directly; nothing is locked.
  • Withdraw consent. Use the consent controls under Privacy & data in your dashboard.
  • Have it deleted. Request deletion from the same page. A person at Scenda actions it. See above for what we delete and what we have to keep.
  • Object, or complain. Email us first at community@scenda.co.za. We would rather fix it. You also have the right to complain directly to the Information Regulator of South Africa (complaints: POPIAComplaints@inforegulator.org.za), and you do not need our permission to do so.

How we protect it

Passwords are stored only as hashes, and repeated wrong passwords are blocked. Uploaded documents are never public: the database holds a storage key rather than a URL, and every download is authorised per request. Access to learner data inside Scenda is limited to the roles that need it to process an application, and a specialist loses access to a learner the moment they are reassigned or stop being verified. Everything travels over encrypted connections.

No system is perfect. If we discover a breach that puts your information at risk, we will notify you and the Information Regulator as POPIA requires.

Changes to this notice

If we change how we use your information we will update this page and change the effective date at the top. If the change is significant, we will tell you rather than rely on you noticing.

Questions about anything on this page: community@scenda.co.za.