Legal
Privacy notice
What we collect, why, where it is kept, and how to have it deleted — under the Protection of Personal Information Act 4 of 2013 (POPIA).
Who is responsible
The responsible party is TheronGroup of Consultants, an independent tuition and consulting practice in South Africa. Our Information Officer is Unite Mahaso, who can be reached at unite@theron-group.co.za.
What we collect
- When you enquire, request an extract or book tutoring: your name, email address, the module code and sitting you name, your message, and — for corporate enquiries — your organisation.
- When you order: the same details, plus the product ordered and the invoice and payment reference.
- Consent record: whether you ticked the consent box, the exact wording shown to you, the date and time, and the page you submitted from.
We do not use advertising or tracking cookies. Visitor statistics come from Cloudflare Web Analytics, which does not set cookies or build profiles of individual visitors. The spam check on our forms (Cloudflare Turnstile) processes technical signals from your browser only to tell people from bots.
Why we use it
Only to do what you asked: answer your enquiry, send the extract or material for the module you named, arrange tutoring, and issue and reconcile invoices. We contact you about study material for the module you named only with your consent, recorded against this wording:
“I consent to TheronGroup contacting me about study material for the module I have named.”
We do not buy, rent or sell contact lists, and we do not send you marketing about anything you did not ask about. Every message we send carries a working way to stop further messages, as section 69 of POPIA requires.
Who else processes it
We use a small number of operators, each bound to process your information only on our instructions:
- Cloudflare — website hosting, form processing and the database in which submissions are stored.
- Resend — delivery of the emails we send you.
These services may store or process information outside South Africa. Where they do, we rely on their contractual data-protection commitments, in line with section 72 of POPIA.
How long we keep it
Enquiries are kept for as long as we are in contact about them, and deleted within 24 months of our last exchange unless you become a customer. Order and invoice records are kept for as long as tax law requires. Consent records are kept for as long as we rely on the consent, so that we can show what you agreed to.
Your rights
- To ask what personal information we hold about you, and to have it corrected.
- To withdraw consent at any time — using the link in any message we send, or by emailing us. Withdrawal does not affect anything we did before it.
- To ask us to delete your information. We will, except where the law requires us to keep a record.
- To object to processing, and to complain to the Information Regulator at inforegulator.org.za.
To exercise any of these, email unite@theron-group.co.za.
Security
Submissions are sent over an encrypted connection and stored in an access-controlled database. Banking details are never collected through this site.
Last updated 21 September 2026.