Responsible entity: Higherlife Skills College
Status: Operational portal notice. HSC's Information Officer should approve and keep this notice aligned with actual processing, contracts and regulator requirements.
Higherlife Skills College processes personal information for admissions, student administration, teaching and assessment, HR/payroll, recruitment, procurement/suppliers, finance, security, compliance and related college operations. The responsible legal entity and Information Officer contact details should be maintained in the College's PAIA/POPIA governance records.
Depending on the relationship, HSC may process identity and contact information, education/qualification records, student records, attendance and assessment results, financial/account information, employment/payroll records, recruitment information, supplier/CIPC/tax/CSD/banking information, security-card and verification information, disability/support information where necessary, and electronic portal/audit information.
Purposes include processing applications, verifying identity/qualifications, concluding and administering student/employment/supplier relationships, delivering education and support, assessments and certification, accounts and payments, payroll and tax administration, legal/regulatory compliance, fraud/conflict prevention, security and access control, complaints, audit and system security.
Processing may rely on consent where appropriate, performance or steps related to a contract, legal obligations, protection of legitimate interests, legitimate operational interests balanced against privacy rights, or another lawful basis available under applicable law. HSC should not use consent where a different mandatory legal basis is more appropriate.
Where health/disability, biometric-like access data, criminal-verification information or children's information is processed, access should be restricted and the processing must have an appropriate legal basis and safeguards. Applicants under 18 may be asked for parent/guardian details or proof of authority where necessary.
Information may be shared with authorised staff, regulators/accreditors, verification providers, banks/payment providers, payroll/tax authorities, funders/sponsors, IT/hosting/email providers, professional advisers and other parties where lawful and necessary. HSC maintains a third-party/operator register and should have appropriate confidentiality/security terms in place.
If information is hosted, accessed or transferred outside South Africa, the transfer must be assessed under POPIA and, where applicable, foreign data-protection rules such as the EU or UK GDPR. Appropriate contractual or other safeguards must be documented where required.
Records are retained only for as long as necessary for the purpose, statutory/contractual obligations, accreditation/academic needs, tax/audit requirements, dispute management or lawful archival requirements. The HSC retention schedule controls review, legal holds and secure disposal.
The portal uses role-based permissions, view/edit rights, authentication throttling, protected sessions, security logging, protected uploads, audit trails, HTTPS/security headers, background queues and restricted document access. No system can eliminate all security risk, so controls must be monitored, patched and backed up.
Subject to applicable law and lawful exceptions, individuals may request access, correction, deletion/destruction where permissible, objection to certain processing, withdrawal of consent where consent is the basis, and information about processing. PAIA requests may also be submitted where applicable.
