Privacy Policy

Last updated: August 2026

In compliance with POPIA (Act 4 of 2013) & General Data Protection Regulation (GDPR)

1. Introduction, Data Controller & Responsible Party

Graduates Hub (“we”, “us”, or “our”) operates the website at graduateshub.org. We are committed to respecting user privacy and protecting personal information in full compliance with South Africa's Protection of Personal Information Act, Act 4 of 2013 (POPIA) and the European Union's General Data Protection Regulation (GDPR) (EU Regulation 2016/679).

For the purposes of POPIA, Graduates Hub is the Responsible Party. Under the GDPR, Graduates Hub serves as the Data Controller: the entity determining the purposes and means of processing personal data.

All privacy inquiries, data access requests, or regulatory queries may be directed to our Information Officer and Data Protection Lead at info@graduateshub.org.

2. Personal Information We Collect

Under POPIA and GDPR, “personal data” or “personal information” refers to any information relating to an identified or identifiable natural person. We collect the following:

Information provided directly by you:

  • Contact communications: When you reach out via our contact form or direct email, we collect your name, email address, and message contents.
  • Newsletter subscriptions: When you subscribe to updates, we collect your email address.
  • Interactive AI tools & CV Builder inputs: Text snippets, job descriptions, or resume bullet points uploaded into our interactive AI utilities (CV Reviewer, JD Decoder, Skills Gap Analyzer, AI Interview Simulator) or CV Builder are processed via secure server-side API calls to Google Gemini API for transient analysis. We do not store your uploaded documents permanently in public databases.

Information collected automatically:

  • Log data: Browser type, IP address, device identifiers, language preference, referring pages, and timestamp data.
  • Usage analytics: Aggregated, anonymized browsing activity collected via Google Analytics 4 (GA4) to analyze content engagement.
  • Cookie data: Technical and performance cookies (detailed in Section 9).

3. Legal Bases for Processing (GDPR Article 6 & POPIA Section 11)

We process your personal information only when authorized by applicable data protection laws. Our lawful processing bases include:

  • Consent (GDPR Art. 6(1)(a) / POPIA Sec. 11(1)(a)): You have given explicit consent for newsletter subscriptions, contact inquiries, or cookie preferences.
  • Contract Performance & Service Provision (GDPR Art. 6(1)(b) / POPIA Sec. 11(1)(b)): Processing is necessary to deliver user-requested features, such as generating real-time AI feedback in our CV Reviewer or CV Builder.
  • Legitimate Interests (GDPR Art. 6(1)(f) / POPIA Sec. 11(1)(f)): Processing is necessary for our legitimate interests in maintaining site security, preventing fraudulent activity, analyzing aggregated traffic patterns, and improving educational guides.

4. The Eight Conditions for Lawful Processing (POPIA Section 4)

POPIA requires that all processing of personal information satisfy eight statutory conditions. We comply with all eight:

  1. Accountability: We ensure all statutory data protection principles are enforced throughout the processing lifecycle.
  2. Processing Limitation: Data is collected lawfully, minimally, and transparently without infringing privacy.
  3. Purpose Specification: Data is collected for explicit, defined educational and communication purposes.
  4. Further Processing Limitation: Secondary processing is strictly restricted to compatible purposes.
  5. Information Quality: Reasonable measures are taken to ensure accuracy and freshness of retained data.
  6. Openness: Detailed disclosures are published regarding our data collection practices.
  7. Security Safeguards: Technical safeguards prevent unauthorized access, data loss, or disclosure.
  8. Data Subject Participation: Rights of access, correction, and erasure are facilitated promptly.

5. Your Rights as a Data Subject (POPIA & GDPR)

Whether located in South Africa, the European Economic Area (EEA), the United Kingdom, or globally, you hold extensive rights over your personal data:

  • Right of Access (POPIA Sec. 23 / GDPR Art. 15): Request confirmation of whether we hold your personal data and obtain a copy.
  • Right to Rectification (POPIA Sec. 24 / GDPR Art. 16): Request correction of inaccurate, incomplete, or outdated personal information.
  • Right to Erasure / "Right to be Forgotten" (POPIA Sec. 24 / GDPR Art. 17): Request deletion of your personal data when it is no longer required for lawful processing.
  • Right to Restrict Processing (GDPR Art. 18): Request temporary restriction of data processing under specific dispute circumstances.
  • Right to Data Portability (GDPR Art. 20): Request your personal data in a structured, commonly used, machine-readable format.
  • Right to Object (POPIA Sec. 11(3) / GDPR Art. 21): Object to data processing based on legitimate interests or direct marketing at any time.

To exercise any of these rights, email our Data Protection Lead at info@graduateshub.org. We respond to all verified access and erasure requests within 30 days.

6. Google Analytics 4 (GA4)

We use Google Analytics 4 to evaluate aggregated site performance. GA4 gathers information using anonymized IP addresses. Google's privacy policies are available at policies.google.com/privacy. You may opt out of GA4 tracking via the Google Analytics Opt-out Add-on.

7. Google AdSense & Advertising

We display third-party advertisements via Google AdSense. Google uses cookies to serve contextual ads based on previous website visits. Users may opt out of personalized advertising by visiting Google Ads Settings or the Network Advertising Initiative opt-out page.

8. Direct Marketing & Email Communications

We send electronic newsletters only to users who have explicitly opted in. Every marketing message contains a clear, one-click unsubscribe link. You may also object to marketing by emailing info@graduateshub.org.

9. Cookie Policy

Our site utilizes functional and analytical cookies to maintain session states and measure site performance. You may configure your web browser to decline cookies, though certain interactive features may experience reduced functionality.

10. Third-Party Educational Links & Affiliate Disclosure

Our pages link to external learning platforms (e.g., Alison.com, Coursera, Google, Microsoft Learn). Some course links include affiliate tracking codes. External sites maintain independent privacy policies. Please review our Affiliate Disclosure for complete details.

11. International Data Transfers (GDPR Chapter V & POPIA Section 72)

Because our infrastructure utilizes global cloud networks (including Vercel Edge hosting, Google Cloud API endpoints, and Google Analytics), personal data may be processed in servers located outside South Africa or the EEA. Where cross-border data transfers occur, we ensure robust data protection through Standard Contractual Clauses (SCCs) and adequacy frameworks providing protection equivalent to POPIA and GDPR standards.

12. Security Safeguards & Breach Notification

We enforce appropriate administrative, technical, and physical safeguards to prevent data loss, corruption, or unauthorized disclosure. In the event of a security compromise affecting personal data, we will notify relevant supervisory authorities and affected users as required by POPIA Section 22 and GDPR Article 33.

13. Data Retention Limits

Personal information is retained only as long as necessary to fulfill the purpose for which it was collected. Newsletter records are maintained until unsubscription. Contact form communications are retained for historical recordkeeping, while AI tool inputs are processed transiently without permanent storage.

14. Supervisory Authorities & Complaints

If you believe your privacy rights have been infringed, you have the right to lodge a complaint with supervisory regulators:

  • South Africa (POPIA): The Information Regulator (South Africa) at inforegulator.org.za or email POPIAComplaints@inforegulator.org.za.
  • European Union (GDPR): You have the right to lodge a complaint with your local EU Data Protection Authority (DPA) in the member state of your habitual residence or work place.

15. Contact Our Privacy Team

For any questions regarding this Privacy Policy or to submit data subject access requests, please contact us: