Scenda helps South African learners apply to universities, for NSFAS funding, for bursaries and for accommodation. Doing that means we handle information that is personal to you, and some of it — your ID number, your results, your household's financial need — is sensitive. This notice explains exactly what we collect, why we are allowed to, who else sees it, and what you can make us do about it.

It is written to be read, not to be survived. If anything here is unclear, email community@scenda.co.za and ask.

Who is responsible

Scenda (Pty) Ltd is the responsible party for your personal information. You can reach us at community@scenda.co.za or +27 74 696 4520.

Our Information Officer is Hopewell Fakude. Queries and complaints about how we handle your personal information can be sent to the contact details above and will reach them.

What we collect

We collect only what an application actually needs.

  • Your account. Your name, email address, and a password we store only as a one-way hash — we never hold your password itself and cannot read it.
  • Your learner profile. Your ID number, phone number, province, matric average, intended field of study and career path, and an indication of financial need. Your ID number and your financial need are collected because institutions and NSFAS require them on the application; nothing else uses them.
  • Documents you upload. Identity documents, results and supporting paperwork. These are held in private storage — the database records only a reference to the file, never a public link — and are served through an authenticated route that checks on every single request that the file is yours to see.
  • Your applications. Which institutions, bursaries, residences, NSFAS and NBT applications you have made, their status, and the messages and notifications attached to them.
  • Payment records. Whether you have paid, when, and the reference. Your card details are entered on our payment provider's systems, never on ours — we never see or store a card number.

Why we are allowed to process it

Every item above rests on one of three lawful bases in POPIA:

  • Your consent — given at sign-up, for preparing and submitting applications on your behalf. You can withdraw it at any time (see below). Withdrawing it stops future processing; it does not undo an application already sent to an institution, because we cannot recall it from them.
  • Performance of our agreement with you — we cannot deliver the service you paid for without sending your application to the institutions you chose.
  • Our legal obligations — payment and tax records we are required to keep.

If you are under 18, POPIA treats you as a child and requires the consent of a parent or guardian. By signing up you confirm that a parent or guardian has agreed to this notice on your behalf.

Who else sees it

We do not sell your personal information, and we do not share it for advertising. It goes to four kinds of recipient, and no others:

  • The institutions and funders you apply to. This is the point of the service. Once your application reaches a university, NSFAS, a bursary fund or a residence, that organisation becomes responsible for the copy it holds, under its own privacy terms — we cannot delete it on your behalf.
  • Our payment provider (PayFast). They process your payment and hold the card details we never see.
  • Our email provider. They deliver the emails we send you, so they handle your email address and the contents of those messages. They operate outside South Africa — see below.
  • Our hosting provider (Fly.io). Our application and database run on their infrastructure, in their Johannesburg region.
  • Our file storage provider. The documents you upload are not kept in the database — they are kept in a separate file store, which is not restricted to South Africa. See below.

If an agent or school representative applies on your behalf through Scenda, they can see and upload documents on your profile, because that is what you engaged them to do.

Where it is stored, and how long we keep it

Two different systems hold your information and they are not in the same place. We would rather set that out than round it off to “South Africa”.

Your account and your answers stay in South Africa. Your profile, your ID number, your results, your applications and your messages are in our database, which runs in our hosting provider's Johannesburg region.

The files you upload do not stay in South Africa. The copy of your ID, your results and your supporting documents go to a separate file store that is not restricted to any one country. A file is kept in the region nearest to where it was uploaded, and a copy is made in another region if it is opened from there; small files are distributed worldwide immediately. So a document you upload to Scenda may be held outside South Africa. We are telling you that rather than leaving you to assume otherwise.

Email leaves the country too. Our email provider operates outside South Africa, so your email address and the contents of the emails we send you are processed abroad.

POPIA allows personal information to be sent outside the country where the recipient is subject to comparable protection, and that is what we rely on for both the file store and email. Your payment is processed by PayFast, in South Africa. Nothing else is sent out of the country by us.

We keep your information for as long as your account is open, because an application cycle runs for months and outcomes arrive long after you submit.

Deleting your account is a request, not a button: a person at Scenda receives it and carries it out, and we do it as soon as we reasonably can. When we do, we erase your stored documents first and then delete your record, which cascades to your profile, applications, documents, messages and notifications. Payment records are the exception: we are required to retain those for tax purposes. If there is anything else we cannot delete because the law requires us to keep it, we will tell you what it is and why.

We have not yet set a fixed period after which a dormant account is deleted automatically. Until we do, deletion happens when you ask for it — and you can ask at any time.

Your rights, and how to use them

POPIA gives you rights over your information. All of them work today:

  • See what we hold. Your profile, documents and applications are visible to you in your dashboard at any time.
  • Correct it. Edit your profile directly; nothing is locked.
  • Withdraw consent. Use the consent controls under Privacy & data in your dashboard.
  • Have it deleted. Request deletion from the same page. A person at Scenda actions it — see above for what we delete and what we have to keep.
  • Object, or complain. Email us first at community@scenda.co.za — we would rather fix it. You also have the right to complain directly to the Information Regulator of South Africa, and you do not need our permission to do so.

How we protect it

Passwords are stored only as hashes. Uploaded documents are never public: the database holds a storage key rather than a URL, and every download is authorised per request. Access to learner data inside Scenda is limited to the roles that need it to process an application.

No system is perfect. If we discover a breach that puts your information at risk, we will notify you and the Information Regulator as POPIA requires.

Changes to this notice

If we change how we use your information we will update this page and change the effective date at the top. If the change is significant, we will tell you rather than rely on you noticing.

Questions about anything on this page: community@scenda.co.za.