DigitalCredentials

Privacy notice (POPIA)

Last updated: 14 October 2026

DigitalCredentials (“we”) is a product of, and owned and operated by, EduCafé. We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). For credentials, the issuer (for example a college or training provider) is the responsible party, and we process personal information on the issuer's behalf as an operator. For DigitalCredentials accounts and this website, we are the responsible party.

What we process

  • Students: name, email address, the credentials issued to you (course, dates, issuer) and your privacy choices. We do not collect ID numbers, and CSV columns that look like ID numbers are ignored.
  • Issuer staff: name, email address, and the actions you take (audit log).
  • Security data: hashed IP addresses and browser fingerprints, used for rate limiting and fraud prevention.

Why

We process this information to issue, deliver and verify credentials, to sign you in with email codes, to protect the service and to meet legal obligations. The lawful basis is performance of the issuer's contract with you, legitimate interests in preventing fraud, and your consent where you give it.

Your choices as a student

  • Newsletters are opt-in only (POPIA section 69). You only receive news from an issuer if you tick the box when claiming, or switch it on under Account. Every newsletter has a one-click unsubscribe link.
  • You can add a personal email address to your account so you keep your credentials after you leave an institution. If you lose access, the issuer can move your credentials to a new address after checking your identity. Every move is logged, and you are notified.
  • Verification pages show your full name by default, because employers need it to confirm that a credential is yours.
  • Sign in to your dashboard to switch any credential to initials only (for example “S. S.”) or private. A private page confirms only that a valid credential exists, without your name or the certificate image.
  • Your email address and any ID numbers are never shown on verification pages or in shared links, and are never placed in the signed credential.

Sharing

We do not sell personal information. We share it only with the issuer of your credential, our hosting provider in South Africa, and our email provider for sending codes and notifications. Social sharing happens only when you click a share button.

Retention

Credentials are kept for as long as the issuer's account exists, so that they stay verifiable. Sign-in codes expire after 10 minutes. Security logs are kept for 12 months. You may ask for deletion, but deleting a credential means it can no longer be verified.

Your rights

You may ask for access to your personal information, have it corrected or deleted, and object to processing. You may also complain to the Information Regulator (inforegulator.org.za). Contact our Information Officer at privacy@digitalcredentials.co.za.