Privacy Policy - IC Workbook

1. Introduction

This Privacy Policy explains how personal information is processed in connection with the IC Workbook platform.[cite: 10] In relation to personal information processed within a subscribing Organisation's IC Workbook workspace, the relevant Organisation is the Responsible Party and Al Campus (Pty) Ltd is the Operator, processing personal information on documented instructions from that Organisation.[cite: 11] Al Campus acts as a Responsible Party only in relation to personal information it processes for its own business purposes, including corporate administration, contracting, billing, support, security, website enquiries, and related operational activities.[cite: 12] This Policy is intended to provide a general description of how IC Workbook and Al Campus approach privacy and personal information processing.[cite: 13] It does not replace any collection notice, programme-specific privacy notice, or other POPIA notice that a subscribing Organisation may be required to provide in relation to a specific processing activity.[cite: 14]

2. Who This Policy Applies To

This Policy applies to personal information processed in connection with IC Workbook, including information relating to:[cite: 16]

authorised users of the Platform, such as employees, administrators, managers, contractors, and other approved workspace members;[cite: 17]
external document approvers, portal participants, and other persons whose information is processed through an Organisation's IC Workbook workspace;[cite: 18]
service providers, partners, and other third parties whose information may be processed through approved workflows;[cite: 19]
visitors to Al Campus websites or persons who contact Al Campus directly;[cite: 20] and job applicants, suppliers, and business contacts of Al Campus where Al Campus acts as Responsible Party.[cite: 21]

3. Definitions

For purposes of this Policy:[cite: 23]

"Al Campus" means Al Campus (Pty) Ltd.[cite: 24]
"Data Subject" means the natural person to whom personal information relates and, where applicable under POPIA, includes a juristic person where the context requires.[cite: 25]
"Organisation" means any private body, public body, or other entity that subscribes to and uses IC Workbook.[cite: 26]
"Information Officer" means, as the context requires, the information officer of the relevant Responsible Party or the information officer of Al Campus in relation to personal information for which Al Campus is itself the Responsible Party.[cite: 29]
"Operator" means a person or entity that processes personal information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party.[cite: 30]
"Personal Information" has the meaning assigned to it in POPIA and includes information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person.[cite: 31]
"Platform" means the IC Workbook platform and its modules (Engage, Project, and Document Approval), interfaces, services, workflows, and supporting infrastructure made available by Al Campus.[cite: 32]
"POPIA" means the Protection of Personal Information Act, 4 of 2013, together with regulations and applicable guidance issued under it.[cite: 33]
"Processing" means any operation or activity concerning personal information, whether or not by automatic means, including collection, receipt, recording, storage, organisation, updating, retrieval, use, dissemination, restriction, deletion, destruction, or any combination of those activities.[cite: 34]
"Responsible Party" means the public or private body, or any other person, that determines the purpose of and means for processing personal information.[cite: 35]
"Special Personal Information" means personal information falling within the categories recognised by POPIA as special personal information.[cite: 36]
"Sub-Operator" means a third party engaged by Al Campus to process personal information on behalf of an Organisation in connection with the delivery of the Platform or related services.[cite: 37]

6. Personal Information We May Process

The categories of personal information processed through IC Workbook vary according to the Organisation's configuration, module usage, and authorised use cases.[cite: 88]

6.1 Platform User Information

This may include:[cite: 90]

names and surnames;[cite: 91]
email addresses and contact details;[cite: 92]
phone numbers (where applicable);[cite: 93]
job title, role, department, and team name;[cite: 96]
profile photograph;[cite: 97]
usernames and authentication-related records (login credentials are stored in encrypted form);[cite: 98]
roles, permissions, and organisational designations;[cite: 99]
login history, access logs, user actions, and audit records; and[cite: 100]
records relating to support requests, approvals, or workflow actions.[cite: 101]

6.2 Engage Module (Social Feed)

Depending on the Organisation's use of the Engage module, this may include:[cite: 103]

posts, comments, replies, and reactions;[cite: 105]
shares and reposts;[cite: 106]
attachments uploaded to feed posts; mentions and tags; and[cite: 107]
time and date of activity.[cite: 108]

Content posted through the Engage module is visible to users within the relevant workspace or authorised team as configured by the Organisation.[cite: 109]

6.3 Project Module (Task Management)

Depending on the Organisation's use of the Project module, this may include:[cite: 111]

task titles, descriptions, and assignees;[cite: 112]
due dates, deadlines, and priority settings;[cite: 113]
task status updates and completion timestamps;[cite: 114]
attachments and internal comments;[cite: 115]
activity history; and[cite: 116]
supporting evidence or records uploaded into approved workflows.[cite: 117]

Al Campus may generate derived metadata from Project module activity, including task completion times, overdue task indicators, and workflow analytics.[cite: 118] Section 20 of this Policy describes how automated processing and analytics are handled.[cite: 119]

6.4 Document Approval Module

This module processes business information that may be sensitive or legally significant. Depending on the Organisation's configuration, this may include:[cite: 121]

uploaded files (PDF, Word, Excel, images, scanned documents); approval and rejection comments;[cite: 122]
workflow routing information and approval sequences;[cite: 123]
digital acknowledgements and timestamps;[cite: 124]
user identity of approvers and rejecters;[cite: 125]
version history, download logs, and access logs.[cite: 128]

Data processed through the Document Approval module may constitute official business records and may be subject to extended retention periods as described in Section 18.[cite: 129]

6.5 Special Personal Information

Al Campus does not intentionally collect special personal information as defined in sections 26 to 33 of POPIA.[cite: 131] However, users may upload or post content through IC Workbook that incidentally contains special personal information, including information concerning a data subject's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour.[cite: 132] Where such information is processed through IC Workbook, it is processed only within the Organisation's workspace and under that Organisation's instructions.[cite: 133] The Organisation, as Responsible Party, is responsible for ensuring that any special personal information processed within its workspace is processed in accordance with sections 26 to 33 of POPIA, including obtaining any required authorisation from the Information Regulator under section 27(2).[cite: 134]

6.7 Technical and System Information

We may process technical and system information such as:[cite: 141]

device, browser, and operating-system information; IP address and network metadata;[cite: 142]
system and application logs;[cite: 143]
API and integration logs; performance and diagnostic data; and security monitoring and incident records.[cite: 144]

6.8 Al Campus Business Records

Where Al Campus acts as Responsible Party for its own records, personal information may include:[cite: 148]

names, business contact details, and correspondence records;[cite: 149]
contractual, billing, tax, and payment information;[cite: 150]
support and service-management records;[cite: 151]
supplier and vendor contact information;[cite: 152]
recruitment, application, and interview records;[cite: 153]
website form submissions; and[cite: 154]
visitor, access-control, and internal security records.[cite: 155]

7. Sources of Personal Information

Depending on the context, personal information may be collected:[cite: 157]

directly from the data subject;[cite: 158]
from the relevant Organisation;[cite: 159]
from another authorised user, implementing partner, service provider, or authorised third party acting for the Organisation;[cite: 160]
through forms, uploads, integrations, or workflows configured by the Organisation; from system use, audit logging, or security monitoring; or[cite: 161]
from publicly available or official sources where lawfully permitted.[cite: 162]

Where personal information is not collected directly from the data subject, the relevant Organisation is responsible for ensuring that any notice obligations under POPIA are met, unless an exception applies.[cite: 163]

10. Mandatory or Voluntary Supply of Information

Whether the supply of personal information is mandatory or voluntary depends on the specific workflow, module, form, legal obligation, or service context.[cite: 207] Where an Organisation collects information through IC Workbook, that Organisation is responsible for informing the data subject, where required by law, whether the provision of the information is mandatory or voluntary, the consequences of failing to provide it, and any law authorising or requiring the collection.[cite: 208] Where Al Campus collects personal information directly for its own business purposes, the relevant form, process, contract, or notice will indicate whether provision is mandatory or voluntary and the consequences of non-provision where applicable.[cite: 209]

11. Data Minimisation, Purpose Limitation, and Quality

Al Campus supports the processing of personal information in a manner that is adequate, relevant, and not excessive for the purpose for which it is processed.[cite: 211] IC Workbook includes configurable tools and controls that may support:[cite: 212]

role-based or permission-based access;[cite: 213]
workspace and module restrictions;[cite: 214]
validation rules and required fields;[cite: 215]
versioning and audit trails;[cite: 216]
correction workflows; and[cite: 217]
records of changes to information.[cite: 220]

The availability and configuration of these controls depend on the deployment and the Organisation's instructions.[cite: 221] The relevant Organisation remains responsible for deciding what information is collected and ensuring that information is accurate, complete, not misleading, and updated where necessary for the intended purpose.[cite: 222]

4. About IC Workbook

IC Workbook is a collaboration and project management platform used to support organisational communication, task management, document approval workflows, and related functions.[cite: 39] Depending on the Organisation's configuration, the Platform may be used for functions such as:[cite: 40]

social collaboration and communication through the Engage module (posts, comments, reactions, mentions, attachments);[cite: 41]
task and project management through the Project module (task assignment, status tracking, deadlines, activity history);[cite: 42]
document approval workflows through the Document Approval module (file uploads, approval routing, rejection comments, audit trails, version history);[cite: 43]
workspace administration, user management, and permissions;[cite: 44]
internal dashboards, analytics, and reporting; and[cite: 47]
public and private portal environments.[cite: 48]

Where an Organisation configures public-facing portals, those outputs must contain only information that the Organisation is lawfully entitled to publish, whether in anonymised, aggregated, de-identified, or otherwise authorised form.[cite: 49]

5. Role of the Organisation and Al Campus

5.1 Organisation as Responsible Party

In relation to an Organisation's IC Workbook workspace, the Organisation is the Responsible Party.[cite: 52] The Organisation determines the purpose of the processing and the lawful basis on which personal information is processed.[cite: 53] The Organisation is responsible for, among other things:[cite: 54]

ensuring that there is a lawful basis for the processing activity; issuing collection notices or privacy notices where required;[cite: 55]
determining what information is collected and how it is used; deciding who should have access to the information;[cite: 56]
responding to data subject requests where required by law; and[cite: 57]
ensuring compliance with any sector-specific, archival, records-management, or statutory requirements that apply to the processing.[cite: 58]

5.2 Al Campus as Operator

Al Campus processes personal information within an Organisation's IC Workbook workspace only on documented instructions from the relevant Organisation and in accordance with a written operator agreement concluded in terms of section 21 of POPIA (or equivalent binding instrument) between Al Campus and the Organisation.[cite: 60] Each operator agreement addresses, at a minimum:[cite: 61]

(a) the obligation on Al Campus to process personal information only in accordance with the Organisation's documented instructions;[cite: 62]
(b) the security measures that Al Campus must implement and maintain;[cite: 63]
(c) confidentiality obligations binding on Al Campus and its personnel;[cite: 64]
(d) conditions governing the engagement of Sub-Operators, including the requirement for the Organisation's prior written consent or a general authorisation subject to a right of objection;[cite: 65]
(e) obligations relating to assistance with data subject requests, breach notification, and data protection impact assessments;[cite: 66]
(f) obligations on return, deletion, or de-identification of personal information upon termination of services; and[cite: 67]
(g) audit and inspection rights.[cite: 68]

As Operator, Al Campus does not determine the Organisation's substantive lawful basis for processing and does not use personal information from an Organisation's IC Workbook workspace for Al Campus's own commercial purposes.[cite: 71] Al Campus may, however, process limited personal information as necessary to provide the contracted services, including support, maintenance, security, access administration, monitoring, incident response, and related operational functions, always subject to the Organisation's mandate and the applicable contractual framework.[cite: 72]

5.3 Al Campus as Responsible Party for Its Own Records

Al Campus is a Responsible Party in relation to personal information it processes for its own independent business purposes, including:[cite: 74] customer and contracting records;[cite: 75] invoicing and payment administration;[cite: 76] support-contact records;[cite: 77] internal security and access records;[cite: 78] website enquiries and marketing communications where lawfully permitted;[cite: 79] supplier and vendor management;[cite: 80] recruitment and hiring;[cite: 81] legal compliance; and[cite: 82] the exercise or defence of legal rights.[cite: 83]

5.4 Client-Specific Collection Notices

This Policy is a general privacy policy. It does not replace any collection notice, privacy notice, employee notice, or other programme-specific notice that an Organisation may be required to provide in relation to a specific processing activity.[cite: 85] The relevant Organisation remains responsible for ensuring that data subjects are informed, where reasonably practicable, of the matters required by POPIA in relation to a specific collection or processing activity.[cite: 86]

8. Purposes of Processing

8.1 Within an Organisation's IC Workbook Workspace

Al Campus may process personal information on behalf of an Organisation for purposes such as:[cite: 166]

administering and operating the Platform;[cite: 167]
enabling collaboration, communication, and content sharing through the Engage module;[cite: 168]
managing tasks, projects, deadlines, and workflows through the Project module;[cite: 169]
routing document approvals and managing approval workflows through the Document Approval module;[cite: 170]
generating reports, dashboards, analytics, and audit-support outputs; enforcing access controls, permissions, and authentication;[cite: 171]
maintaining audit trails and evidentiary records;[cite: 174]
synchronising data across devices;[cite: 175]
delivering notifications and alerts;[cite: 176]
maintaining platform security, resilience, integrity, and availability; providing technical support, maintenance, and troubleshooting;[cite: 177] and
complying with lawful instructions and contractual obligations.[cite: 178]

8.2 For Al Campus's Own Business Purposes

Where Al Campus acts as Responsible Party, it may process personal information for purposes such as:[cite: 180] contracting and account administration;[cite: 181] invoicing, collections, and financial administration;[cite: 182] service delivery and customer support;[cite: 183] internal governance, compliance, and audit;[cite: 184] supplier and procurement management;[cite: 185] recruitment and hiring;[cite: 186] website administration and response to enquiries;[cite: 187] fraud prevention, security, and incident investigation; and[cite: 188] establishing, exercising, or defending legal rights.[cite: 189]

9. Lawful Basis for Processing

9.1 Organisation Processing

For personal information processed by or on behalf of a subscribing Organisation through IC Workbook, the applicable lawful basis depends on the nature and purpose of the processing activity.[cite: 192] Depending on the use case, an Organisation may rely on any lawful basis recognised by POPIA, including consent, contractual necessity, legal obligation, legitimate interest, or the proper performance of a public law duty by a public body.[cite: 193] The relevant Organisation remains responsible for identifying, documenting, and communicating the lawful basis applicable to its processing activities.[cite: 194]

9.2 Al Campus's Own Processing

Where Al Campus processes personal information for its own business purposes, the applicable lawful basis for each primary category of processing is as follows:[cite: 196]

Contracting, invoicing, and account administration: Processing is necessary for the conclusion or performance of a contract to which the data subject is a party (section 11(1)(b)) and/or for compliance with a legal obligation (section 11(1)(c)).[cite: 197]
Customer support and service management: Processing is necessary for the performance of a contract (section 11(1)(b)) or is in pursuit of the legitimate interests of Al Campus (section 11(1)(f)), having regard to the reasonable expectations of data subjects.[cite: 200]
Security, fraud prevention, and incident investigation: Processing is necessary for the pursuit of the legitimate interests of Al Campus or of a third party to whom the information is supplied (section 11(1)(f)).[cite: 201]
Website enquiries and marketing: Where voluntary consent has been given (section 11(1)(a)) and, in respect of direct marketing by electronic communication, with consent as required by section 69.[cite: 202]
Recruitment and hiring: Processing is necessary for pre-contractual measures (section 11(1)(b)) and, where special personal information is processed, on a lawful ground under section 27.[cite: 203]
Supplier and vendor management: Processing is necessary for the performance of a contract (section 11(1)(b)).[cite: 204]
Legal compliance and defence of rights: Processing is necessary for compliance with a legal obligation (section 11(1)(c)) or for the establishment, exercise, or defence of a right or obligation in law (section 11(1)(e)).[cite: 205]

20. Automated Processing and Analytics

20.1 IC Workbook may include features such as task completion analytics, productivity metrics, overdue task indicators, user activity trends, workflow bottleneck analysis, engagement statistics, and other automated support functions.[cite: 329] These features are designed to support human decision-making and operational workflows.[cite: 330]

20.2 In their default configuration, IC Workbook's automated features do not make decisions based solely on automated processing that produce legal effects concerning a data subject or that affect a data subject to a substantial degree as contemplated by section 71 of POPIA.[cite: 331]

20.3 Individual-level performance data generated by the Project module is accessible only to workspace administrators and authorised management users designated by the subscribing Organisation.[cite: 332] Data subjects have the right to object to the processing of their personal information for analytics purposes in accordance with section 11(3) of POPIA.[cite: 333]

20.4 Where an Organisation configures or uses a feature in a manner that may result in solely automated decision-making with legal or similarly significant effects, the Organisation, as Responsible Party, is responsible for:[cite: 334]

(a) identifying a lawful basis that permits such processing;[cite: 335]
(b) putting in place appropriate safeguards, including the opportunity for the data subject to make representations;[cite: 336]
(c) informing affected data subjects of the nature and implications of the automated processing; and[cite: 337]
(d) ensuring that any exemption relied upon is lawfully available.[cite: 338]

20.5 Al Campus does not accept liability for decisions made by an Organisation's users or systems based on outputs generated by IC Workbook's automated features, except to the extent that such liability arises directly from a defect in the Platform attributable to Al Campus.[cite: 339]

21. Future Al-Assisted Features

21.1 Al Campus does not currently use customer data to train Al models.[cite: 341] "Customer data" means any personal information or content uploaded, created, or processed by users within their IC Workbook workspaces.[cite: 342] This commitment does not apply to de-identified or aggregated data that cannot reasonably be linked to any identifiable data subject.[cite: 343]

21.2 If Al-assisted features are introduced in future (such as task summarisation, workflow recommendations, smart document classification, or approval risk alerts), such features will be opt-in only, and a separate Al Data Processing Notice will be provided to data subjects and subscribing Organisations before activation.[cite: 344][cite: 347]

21.3 A Prior Impact Assessment will be conducted before any Al feature is deployed.[cite: 348]

12. Disclosure of Personal Information

Al Campus does not sell, rent, or trade personal information.[cite: 224] Personal information may be disclosed only where permitted by law and authorised under the relevant arrangement, including disclosure:[cite: 225]

within the relevant Organisation's workspace where necessary and authorised; to authorised collaborators, administrators, and users in accordance with configured permissions;[cite: 226]
to service providers, infrastructure providers, support providers, or other operators or Sub-Operators engaged for lawful service delivery;[cite: 227]
where required by law, court order, subpoena, lawful regulatory process, or other binding legal requirement;[cite: 228]
where necessary to investigate security incidents, fraud, or unlawful conduct;[cite: 229] or
where necessary to protect lawful interests, rights, safety, or property, subject to applicable law.[cite: 230]

Where Al Campus engages Sub-Operators or service providers, it takes reasonable steps to ensure that such parties are bound by appropriate confidentiality, security, and data-protection obligations.[cite: 231]

13. Direct Marketing

13.1 Al Campus will only send electronic direct marketing communications to persons who have given their prior consent in accordance with section 69 of POPIA, or where section 69(2) applies.[cite: 233]

13.2 Every electronic direct marketing communication sent by Al Campus will include the identity of Al Campus, the email address or other contact detail from which the communication originates, and a clear and functional mechanism to opt out of further communications at no cost to the recipient.[cite: 234]

13.3 Opt-out requests will be processed without charge and within a reasonable period, and in any event within 5 business days of receipt.[cite: 235]

13.4 In accordance with the POPIA Amendment Regulations of 17 April 2025, an opt-out from future communications does not constitute consent for the purposes of section 69. Consent for unsolicited electronic direct marketing must be obtained in writing on a form substantially similar to Form 4 prescribed under the Regulations.[cite: 236]

13.5 Al Campus does not engage in direct marketing on behalf of an Organisation through IC Workbook unless specifically instructed and authorised by the Organisation in writing.[cite: 239]

14. Sub-Operators

14.1 Al Campus may engage Sub-Operators to assist in delivering the Platform and related services.[cite: 241] Before engaging a new Sub-Operator that will process personal information from an Organisation's IC Workbook workspace, Al Campus will:[cite: 242]

(a) notify the Organisation of the identity and location of the proposed Sub-Operator; and[cite: 243]
(b) obtain the Organisation's prior written consent, unless the applicable operator agreement provides for general authorisation subject to a right of objection.[cite: 244]

14.2 Al Campus will ensure that each Sub-Operator is bound by written terms that impose data-protection, confidentiality, and security obligations no less protective than those binding Al Campus under the applicable operator agreement.[cite: 245]

14.3 Al Campus remains accountable to the Organisation for the acts and omissions of its Sub-Operators in respect of the processing of personal information.[cite: 246]

14.4 A current list of Sub-Operators engaged for each deployment will be made available to the relevant Organisation on request.[cite: 247]

15. Cross-Border Processing and Transfers

15.1 IC Workbook infrastructure is primarily hosted within the Republic of South Africa.[cite: 249]

15.2 Certain ancillary services, including email delivery, error monitoring, security threat intelligence, and disaster-recovery replication, may involve the processing of limited personal information outside the Republic of South Africa.[cite: 250] Such processing will take place only in jurisdictions that provide an adequate level of protection as contemplated by section 72(1)(a) of POPIA, or where one or more of the following conditions is satisfied:[cite: 251]

(a) the data subject has consented to the proposed transfer;[cite: 252]
(b) the transfer is necessary for the performance of a contract between the data subject and the Responsible Party, or for pre-contractual measures taken in response to the data subject's request;[cite: 253]
(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the Responsible Party and a third party;[cite: 254] or[cite: 255]
(d) the transfer is for the benefit of the data subject and it is not reasonably practicable to obtain the consent of the data subject, but if it were, the data subject would be likely to give it.[cite: 256]

15.3 Where an Organisation's deployment involves or may involve cross-border processing, Al Campus will, on request, provide the Organisation with a list of countries and Sub-Operators involved in the processing, together with the applicable legal basis for each transfer.[cite: 257]

16. Information Security

Al Campus implements and maintains reasonable technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, and destruction, having regard to generally accepted information security practices, the nature of the information, and the risks associated with the processing.[cite: 261] Depending on the deployment, hosting model, contractual scope, and Organisation's configuration, these measures may include:[cite: 262]

AES-256 encryption of personal information at rest;[cite: 263]
TLS encryption of personal information in transit;[cite: 264]
role-based access control (RBAC) and least-privilege permissions; session timeout controls and authentication controls;[cite: 265]
audit logging and monitoring;[cite: 266]
vulnerability and patch management;[cite: 267]
backup and recovery controls;[cite: 268]
incident management procedures;[cite: 269]
confidentiality obligations for personnel; and[cite: 270]
due diligence and contractual controls for third parties.[cite: 271]

No method of transmission, storage, or processing is completely secure.[cite: 272] For that reason, Al Campus does not warrant that any environment or communication channel will be completely immune from all security risks.[cite: 273]

17. Security Incidents

17.1 If Al Campus becomes aware that personal information processed on behalf of an Organisation has been, or is reasonably believed to have been, accessed or acquired by an unauthorised person, Al Campus will:[cite: 275]

(a) notify the relevant Organisation without undue delay and in any event within hours after becoming aware of the incident, providing such information as is reasonably available at that time; and[cite: 276]
(b) provide follow-up information as it becomes available to support the Organisation's assessment, notification decisions, and remediation.[cite: 278]

17.2 The initial notification will include, to the extent reasonably ascertainable at the time:[cite: 279]

(a) a description of the nature of the incident, including the categories and approximate number of data subjects and records affected;[cite: 280]
(b) the likely consequences of the incident; and[cite: 281]
(c) the measures taken or proposed to address the incident and mitigate its effects.[cite: 282]

17.3 The relevant Organisation as Responsible Party remains responsible for determining whether notification to the Information Regulator (via the eServices portal at https://eservices.inforegulator.org.za, mandatory from 1 April 2025) or to affected data subjects is required under section 22 of POPIA and for issuing such notification.[cite: 286]

17.4 Where Al Campus is itself the Responsible Party in respect of the compromised information, Al Campus will notify the Information Regulator via the eServices portal and notify affected data subjects as required by section 22 of POPIA, including providing the prescribed notification content under sections 22(4) and 22(5).[cite: 287]

17.5 Al Campus may also maintain internal incident records, conduct investigations, and implement remediation measures in accordance with its security and incident-response procedures.[cite: 288]

18. Data Retention and Deletion

18.1 Organisation Data

Retention periods for information processed within an Organisation's IC Workbook workspace are determined primarily by the relevant Organisation's legal, regulatory, archival, records-management, operational, and contractual requirements.[cite: 291] Upon expiry of the applicable retention period, or upon termination of the relevant services, Al Campus will, subject to applicable law, backup cycles, dispute preservation requirements, legal hold requirements, security logging requirements, and contractual obligations, delete, return, anonymise, or otherwise deal with the information in accordance with the Organisation's documented instructions and the applicable agreement.[cite: 292] For the Document Approval module, approval logs, timestamps, identity records, and version history may be retained for up to 7 years, or longer where required by contract, sectoral regulation, litigation hold, or the Organisation's internal policies, given the legal significance of such records.[cite: 293]

18.2 Al Campus Records

Where Al Campus acts as Responsible Party for its own records, it retains personal information only for as long as reasonably necessary for the purpose for which it was collected, or as required by law, contract, internal governance requirements, or the establishment, exercise, or defence of legal rights.[cite: 295]

18.3 Indicative Retention Periods for Al Campus Records

The following indicative retention periods apply to Al Campus's own records, subject to applicable law, litigation hold requirements, and regulatory obligations:[cite: 297]

Contracting and invoicing records: Duration of the contract plus 5 years.[cite: 298]
Support and service-management records: Duration of the contract plus 3 years.[cite: 299]
Website enquiries and marketing consent records: 3 years from last meaningful contact or until consent is withdrawn, whichever is earlier.[cite: 300]
Recruitment records (unsuccessful applicants): 12 months from decision, unless the applicant consents to a longer retention.[cite: 303]
Security and access logs: 12 months, or longer where required for an ongoing investigation.[cite: 304]
Supplier and vendor records: Duration of the relationship plus 5 years.[cite: 305]

22. Data Protection Impact Assessments

22.1 Where an Organisation's use of IC Workbook involves processing that is likely to result in a high risk to the rights of data subjects, including large-scale processing of special personal information, systematic monitoring, or innovative use of technology, Al Campus recommends that the Organisation conduct a data protection impact assessment prior to commencing the relevant processing.[cite: 350]

22.2 Al Campus will provide reasonable assistance to the Organisation in conducting such an assessment, including by providing information about the Platform's technical and organisational measures, data flows, and processing operations, to the extent such information is within Al Campus's possession.[cite: 351]

22.3 Al Campus may also conduct its own internal risk assessments in relation to the Platform's design, features, and security posture.[cite: 352]

23. Cookies and Similar Technologies

23.1 The IC Workbook web interface uses cookies, tokens, and similar technologies that are strictly necessary for secure authentication, session management, fraud prevention, system integrity, and service performance.[cite: 354]

23.2 The following categories of cookies may be used:[cite: 355]

Strictly necessary cookies: Session tokens, CSRF tokens, and authentication cookies required for Platform functionality.[cite: 356] These expire at the end of the browser session or within a short period.[cite: 357]
Performance and monitoring cookies: Cookies or similar technologies used by security monitoring or performance tools to collect limited technical data (such as page load times, error rates, and anonymised usage patterns).[cite: 358]

23.3 IC Workbook does not use advertising cookies, behavioural-tracking cookies, or third-party marketing cookies.[cite: 359]

23.4 Users may manage or disable cookies through their browser settings, but disabling strictly necessary cookies may impair Platform functionality.[cite: 360]

24. Ownership of Workspace Content

All content created within an Organisation's workspace (including posts, comments, task updates, approval records, and uploaded files) is considered organisational business data and remains the property of the subscribing Organisation.[cite: 362] If a user leaves the Organisation, certain records may be retained to preserve business continuity, workflow integrity, and audit trail requirements.[cite: 365] Such retention does not override the data subject's rights under POPIA as set out in Section 19 of this Policy.[cite: 366]

25. Non-Repudiation (Document Approval Module)

For the Document Approval module, digital approval logs, timestamps, identity records, approval comments, and rejection comments constitute the official and authoritative record of the transaction.[cite: 368] These records may be relied upon for legal, audit, and compliance purposes.[cite: 369] Non-repudiation provisions (under which an approver may not deny that an approval or rejection was performed through their authenticated account) are governed by the applicable Terms of Service or service agreement between Al Campus and the subscribing Organisation.[cite: 370] This Privacy Policy does not constitute a contractual agreement for the purposes of non-repudiation.[cite: 371]

19. Data Subject Rights

19.1 Organisation-Controlled Processing

Where personal information is processed within an Organisation's IC Workbook workspace, requests to exercise rights under POPIA should be directed, in the first instance, to the relevant Organisation as Responsible Party, using that Organisation's Information Officer or other published channel.[cite: 308] Al Campus, as Operator, will assist the Organisation where required under contract or law.[cite: 309]

19.2 Rights Under POPIA

Subject to POPIA and any applicable limitations or exemptions, data subjects may have the right to:[cite: 311]

be notified that personal information is being collected or has been accessed or acquired by an unauthorised person where notification is required by law;[cite: 312]
request confirmation of whether personal information is held;[cite: 313]
request access to personal information and information relating to that processing;[cite: 314]
request correction, deletion, destruction, or restriction of personal information in circumstances recognised by law;[cite: 315]
object, on reasonable grounds relating to their particular situation, to certain processing where permitted by POPIA;[cite: 316]
object to direct marketing where applicable;[cite: 317]
withdraw consent where processing is based on consent, subject to the lawfulness of prior processing;[cite: 318]
not be subject, in the circumstances contemplated by POPIA, to a decision based solely on automated processing that has legal consequences or similarly significant effects; and[cite: 319][cite: 320]
lodge a complaint with the Information Regulator or seek other remedies available under law.[cite: 321]

In accordance with the POPIA Amendment Regulations of 17 April 2025, data subjects may exercise these rights free of charge and through any accessible channel, including email, post, hand delivery, telephone (provided the request is recorded and made available to the data subject on request), SMS, or WhatsApp.[cite: 322] Al Campus will respond to requests directed to it within 30 days of receipt.[cite: 323]

19.3 How to Contact the Information Regulator

Current complaint channels, forms, and contact details for the Information Regulator are published on the Information Regulator's official website at https://inforegulator.org.za.[cite: 327]

6.6 Children's Personal Information

IC Workbook is not a consumer-facing platform directed at children (persons under the age of 18 years).[cite: 136] Al Campus does not knowingly collect personal information from children.[cite: 137]

Where an Organisation's use case involves the lawful processing of information relating to children, the Organisation, as Responsible Party, remains responsible for ensuring that the processing is lawful and that any additional safeguards required by sections 34 and 35 of POPIA are in place, including obtaining consent from a competent person where required by section 35.[cite: 138]

If Al Campus becomes aware that it has processed the personal information of a child without valid consent from a competent person and without another lawful basis, it will take reasonable steps to notify the Organisation and, where appropriate, delete such information.[cite: 139]

Steps to Deactivate Your Account

Log in to your account.
Navigate to your profile icon (in the top-right corner).
Click on the profile icon to open the menu.
Select Deactivate Account.
Follow any confirmation prompts to complete the process.

27. Changes to This Policy

27.1 Al Campus may update this Policy from time to time to reflect changes in law, regulation, technology, security practices, services, or business operations.[cite: 385]

27.2 Where a proposed change is material, Al Campus will publish the updated Policy at least 30 days before the change takes effect and will notify affected Organisations by email or through the Platform.[cite: 386] A change is material if it alters the categories of personal information processed, introduces new categories of recipients or cross-border transfers, modifies data subject rights, or materially reduces Al Campus's security or confidentiality commitments.[cite: 387]

27.3 Each version of this Policy will bear a version number and effective date.[cite: 388] Prior versions will be available on request.[cite: 389]

26. Al Campus Information Officer Contact Details

26.1 Al Campus has designated and registered an Information Officer with the Information Regulator in terms of section 56 of POPIA.[cite: 373]

Organisation: Al Campus (Pty) Ltd[cite: 374]
Role: Information Officer[cite: 375]
Email: popia@aicampus.co.za[cite: 376]
Postal Address: Ground Floor, 35 Ferguson Road, Illovo, Sandton, 2196, Gauteng, South Africa[cite: 377]

Requests addressed to Al Campus in its capacity as Responsible Party will be handled in accordance with applicable law, Al Campus's PAIA Manual where relevant, and any applicable internal procedures.[cite: 378]

26.2 PAIA Manual

Al Campus has compiled a manual in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000.[cite: 380] The PAIA Manual describes the categories of records held by Al Campus, the process for requesting access to those records, prescribed fees, and related information required by law.[cite: 380] A copy of the PAIA Manual is available on Al Campus's website and may also be obtained by written request to the Information Officer at the contact details set out in section 26.1.[cite: 381]

28. Governing Law

This Policy is governed by the laws of the Republic of South Africa.[cite: 391] Where applicable, requests for access to records held by Al Campus are also governed by the Promotion of Access to Information Act, 2 of 2000, and Al Campus's PAIA Manual.[cite: 392]

IC Workbook Privacy Policy
Issued by Al Campus (Pty) Ltd[cite: 394]
Approved and Issued by Al Campus (Pty) Ltd Information Officer[cite: 395]
Effective Date: 23 April 2026[cite: 396]
Version: 3.0[cite: 7]