Privacy Policy

We care deeply about privacy and believe that the protection of personal information is a fundamental right of every individual. Educational institutions, organizations, and partners entrust us with sensitive personal data, including that of students, educators, and professionals, and we take this responsibility seriously.

Our platform, Workspace, is designed with privacy by design and privacy by default principles, ensuring that data protection is embedded into every layer of our technology, including our offline capabilities, monitoring systems, and AI-assisted tools. Unlike many technology platforms whose business models rely on the monetization of user data, our approach is fundamentally different. We collect and process personal information strictly for the purpose of delivering secure, reliable, and integrity-driven educational services.

In most cases, we process personal information under the instruction of institutions that use our platform. We do not sell, rent, or commercially exploit personal data. Any data sharing is strictly limited, controlled, and aligned with contractual and legal obligations. We are committed to aligning with leading global data protection standards, including the Protection of Personal Information Act and the General Data Protection Regulation, ensuring that our platform is trusted not only locally but internationally.

Ann-Connect (“we”, “our”, or “us”) is committed to protecting the privacy, confidentiality, and security of personal information processed through Workspace, which is an integrated ecosystem designed for learning, assessments, teaching and invigilation. Workspace includes:

• Learn: an assessment tool that enables students to write online exams even when there is no internet connectivity.
• Online Invigilator: an invigilation tool that prevents online exam cheating and continues to monitor students even when they lose connectivity during an online exam.
• Venue Invigilator: an invigilation app that monitors students writing exams in physical exam centres to prevent in-person exam cheating.
• Room: video conferencing tool for meetings, learning & teaching like MS Teams but monitors students who are focused or distracted during a live session and increases productivity including team collaboration.

This Privacy Policy explains how personal information is collected, used, processed, stored, and protected in accordance with applicable laws, including the Protection of Personal Information Act (POPIA), as well as internationally recognized data protection principles.

Institutional Responsibility (Data Controller / Responsible Party): Educational institutions, organizations, and entities that subscribe to or deploy Workspace are generally considered the primary Data Controllers or Responsible Parties in relation to the personal information processed through the platform. This means they determine the purpose for which personal information is collected, the categories of information required, the lawful basis for processing, the retention periods, and the manner in which personal information is used within their academic or operational environments. Institutions are responsible for ensuring that their users are appropriately informed about the processing activities carried out through Workspace and for ensuring that such processing complies with applicable privacy laws and institutional policies.

Ann-Connect Responsibility (Operator / Processor): Ann-Connect acts as a Data Processor or Operator on behalf of institutions and processes personal information strictly in accordance with contractual agreements, institutional instructions, and applicable legal frameworks. Our role is to provide secure technological infrastructure, process personal information only for authorized purposes, and implement appropriate technical and organizational measures to protect the confidentiality, integrity, and availability of personal data. In limited circumstances where Ann-Connect interacts directly with users or determines the purpose of processing independently, we may act as a Data Controller for those specific processing activities.

Identity and Account Information: We collect personal identification data such as full names, email addresses, student or employee identification numbers, phone numbers, login credentials, and profile images in order to create and manage user accounts, authenticate access to the platform, and ensure that each user can be uniquely identified within the system for academic and administrative purposes.

Academic and Assessment Information: We collect and process academic-related data including examination scripts, assignments, submitted coursework, responses to assessments, grading outcomes, and interaction logs during assessments, all of which are necessary to facilitate learning, evaluate performance, maintain academic records, and support institutional reporting requirements.

Monitoring and Invigilation Data: In order to uphold academic integrity, we collect monitoring data such as audio recordings, video recordings, screen activity, keystroke patterns, session logs, timestamps, device identifiers, and identity verification inputs including ID documents and facial captures, and this data is processed solely for the purpose of verifying identity, detecting irregular behaviour, and ensuring fairness and compliance during assessments.

Offline Data Collection: Due to Workspace offline capabilities, personal and monitoring data may be temporarily stored locally on a user’s device when internet connectivity is unavailable, and such data continues to be collected during the assessment session and is securely synchronized with our servers once connectivity is restored, ensuring continuity of assessments in low-connectivity environments without compromising data integrity.

Behavioural and Engagement Data: Within Room and other interactive environments, we may process behavioural indicators such as participation levels, engagement patterns, and attention signals during live sessions, which are used to provide educators with insights into learner engagement and to enhance the effectiveness of teaching and learning experiences.

Technical and Device Information: We automatically collect technical data such as IP addresses, browser types, operating systems, device types, and network information in order to ensure system functionality, maintain platform security, diagnose technical issues, and optimize user experience across different environments and devices.

Direct and Institutional Collection: Personal information may be collected directly from users when they register, authenticate, make submissions, participate in live sessions, complete assessments, upload supporting documentation, make payments, or interact with platform features. In addition, information may be collected indirectly through educational institutions, employers, partner organizations, or integrated systems such as student information systems, HR systems, payment platforms, and learning management integrations.

Automated System Collection: Certain categories of information, particularly monitoring, technical, payment validation, device intelligence, fraud prevention signals, and usage analytics, are collected automatically through embedded technologies, cookies, device-level services, session trackers, event logs, and security systems. These automated collection methods are used to ensure platform functionality, integrity monitoring, user authentication, fraud prevention, and service optimization.

Legal, Contractual, and Regulatory Basis: We process personal information where it is necessary to fulfil contractual obligations between Ann-Connect and institutions, to deliver our services, and to comply with applicable legal and regulatory requirements under the Protection of Personal Information Act and the General Data Protection Regulation. This includes processing required for academic administration, identity verification, and maintaining the integrity of assessments.

Consent, Legitimate Interests, and Additional GDPR Bases: Where required, we rely on user consent, particularly when processing sensitive personal data such as biometric or monitoring data. We also rely on legitimate interests, including ensuring academic integrity, preventing fraud, maintaining platform security, and improving service delivery, provided that such interests do not override the fundamental rights and freedoms of users. Where applicable under GDPR, we may also rely on additional lawful bases such as performance of a task carried out in the public interest (for educational institutions) or compliance with legal obligations.

Service Delivery and Academic Integrity: Personal information is processed to deliver the full functionality of Workspace, including assessments, examinations, invigilation, identity verification, real-time collaboration, payment processing, learning analytics, academic reporting, attendance monitoring, and fraud detection. This includes both online and offline learning environments and extends to examination continuity during connectivity disruptions.

Operational Improvement and Compliance: We also process information for platform administration, technical support, dispute resolution, product enhancement, service quality improvement, legal compliance, internal governance, auditing, and institutional reporting obligations. All processing activities are limited to legitimate and clearly defined operational purposes.

AI-Assisted Monitoring: Workspace may utilize artificial intelligence technologies to analyse behavioural patterns, detect anomalies, and flag potentially suspicious activities during assessments, thereby assisting institutions in maintaining academic integrity.

Human Oversight and Safeguards: All AI-generated flags or alerts are subject to human review and verification, and no final decisions affecting users are made solely by automated systems, ensuring fairness, accountability, and compliance with data protection principles.

Controlled and Limited Sharing: Personal information may be shared with institutions, authorized administrators, payment processors, cloud infrastructure providers, security vendors, legal advisors, and regulatory authorities where required. Such sharing is conducted strictly on a need-to-know basis and only where appropriate legal, technical, and contractual safeguards are in place.

Third-Party Service Providers: Where we engage third-party vendors for hosting, payments, support, identity verification, communication services, or analytics, such providers are contractually required to process personal information confidentially and only for the authorized purpose.

No Sale or Commercial Exploitation: Ann-Connect does not sell, trade, rent, or otherwise commercially exploit personal information. Personal data processed within Workspace remains protected from commercial misuse, and we do not use educational or assessment-related data for advertising, third-party marketing, or unrelated profiling activities.

Technical and Organizational Measures: We maintain a comprehensive information security program designed to protect personal information against unauthorized access, loss, misuse, disclosure, destruction, or alteration. This includes encryption protocols, access controls, authentication mechanisms, secure cloud infrastructure, audit logging, vulnerability monitoring, and environment segregation to ensure that personal information remains secure throughout its lifecycle.

Continuous Monitoring and Security Enhancement: Security measures are continuously monitored, tested, and improved to address evolving threats and technological risks. We regularly review our safeguards, assess potential vulnerabilities, and enhance our security controls to maintain resilience against unauthorized access and cybersecurity threats while supporting the confidentiality, integrity, and availability of our services.

Retention Principles: Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected, including academic, administrative, and legal requirements, and retention periods may be defined by institutional policies.

International Data Handling and Safeguards: As a global platform, Workspace may process and store personal information in multiple jurisdictions. Where personal data is transferred outside of South Africa, including to regions such as the European Economic Area (EEA) or other international locations, we ensure that such transfers are conducted in compliance with the Protection of Personal Information Act and the General Data Protection Regulation.

Protection Mechanisms for Cross-Border Transfers: We implement appropriate safeguards to protect personal data during international transfers, including but not limited to:

• Standard Contractual Clauses (SCCs) or equivalent legal mechanisms
• Data Processing Agreements with international partners
• Secure data transmission and storage protocols
• Limiting access to authorized personnel only

These measures ensure that personal information remains protected to a standard consistent with applicable data protection laws, regardless of where it is processed.

User Rights Across Jurisdictions: In accordance with the Protection of Personal Information Act and the General Data Protection Regulation, users have a range of rights regarding their personal information. These include the right to access their personal data, request correction of inaccurate or incomplete data, request deletion of personal information where legally permissible, object to or restrict certain types of processing, and request data portability where applicable.

Right to Lodge Complaints and Escalation: Users also have the right to lodge complaints with relevant regulatory authorities, including the Information Regulator in South Africa or supervisory authorities within the European Union where applicable. Requests relating to data rights should typically be directed to the relevant institution acting as the Data Controller, although Ann-Connect will assist where required in accordance with its role as a Data Processor.

Protection of Minors: Where Workspace is used by schools, training institutions, or educational environments involving minors, personal information relating to minors is processed strictly under the authority of the institution and, where required by law, subject to parental or guardian consent. We apply heightened safeguards to protect minors’ personal information, including stricter access controls, limited data exposure, and enhanced confidentiality obligations.

Strict Data Usage Boundary: Ann-Connect is committed to ensuring that personal information collected through Workspace is used solely for legitimate educational, administrative, operational, and integrity-related purposes. Under no circumstances is student or institutional data sold, monetized, or used for unrelated commercial gain. We do not engage in behavioural advertising, third-party profiling, or any commercial activity that would compromise the trust placed in us by institutions and users.

Offline and Continuous Monitoring: Workspace includes advanced offline functionality that enables assessments and monitoring activities to continue even during connectivity interruptions. During such periods, relevant assessment and monitoring data may be securely stored locally on the device and synchronized once connectivity is restored. These capabilities are implemented to preserve assessment continuity, maintain integrity, and support reliable service delivery in low-connectivity environments, while ensuring that security safeguards remain in place throughout the process.

Commitment to Breach Prevention and Response: We take data security incidents seriously and have implemented comprehensive measures to prevent, detect, and respond to data breaches. A data breach may include any unauthorized access, disclosure, alteration, or destruction of personal information.

Incident Detection and Response Framework: We maintain internal monitoring systems, logging mechanisms, and incident response protocols designed to rapidly identify and contain potential security incidents. Our response process includes investigation, risk assessment, mitigation, and remediation to minimize impact.

Notification Obligations: In the event of a data breach that poses a risk to users’ rights and freedoms, we will notify the relevant institution (Data Controller) without undue delay and, where required by law, notify affected users and regulatory authorities in accordance with POPIA and GDPR requirements.

Continuous Improvement: Following any incident, we conduct detailed reviews to strengthen our systems, improve controls, and prevent recurrence, ensuring that our security posture evolves alongside emerging threats.

In-App Payment Processing: Workspace may facilitate in-app payments for tuition fees, examination fees, certifications, subscriptions, event bookings, or other educational and administrative services. Where payments are made through the platform, financial information may include payer name, billing address, payment reference, transaction amount, payment timestamps, and limited card or bank-related verification details.

Third-Party Payment Providers: Payment card and banking information is processed through authorized third-party payment processors such as PayStack or other compliant providers. Ann-Connect does not store full card numbers, CVV codes, PINs, or other highly sensitive payment authentication data on its own systems unless expressly required under compliant financial processing standards.

Payment Security and Compliance: All payment transactions are processed using secure encrypted channels and industry-standard security controls, including PCI-DSS-aligned practices where applicable. Transaction data may be retained for accounting, legal, fraud prevention, reconciliation, and audit purposes. Financial data is processed only for legitimate billing and payment administration purposes.

Confidentiality of Personal and Assessment Data: All personal information processed through Workspace is treated as strictly confidential. Ann-Connect ensures that employees, contractors, and service providers who have access to personal data are bound by confidentiality obligations and are required to process such data only for authorized purposes.

Access Control and Limitation: Access to personal information is restricted to authorized individuals on a need-to-know basis, and all access is subject to appropriate authentication, authorization, and auditing mechanisms to prevent unauthorized disclosure or misuse.

Institutional Confidentiality Alignment: We also support institutions in maintaining confidentiality obligations, particularly in relation to examination content, student records, and monitoring data, ensuring that all data handled within Workspace is protected against unauthorized exposure.

Ongoing Updates: This Privacy Policy may be updated from time to time to reflect changes in our services, legal obligations, technological developments, or privacy practices. Where material changes are made, we will provide appropriate notice through the platform, email notifications, or institutional communication channels. Continued use of the platform after such updates constitutes acknowledgment of the revised Privacy Policy, subject to applicable legal requirements.

Regulatory Complaints and Oversight: Users who believe that their personal information has been processed unlawfully or in violation of applicable data protection laws may lodge a complaint with the relevant supervisory authority. In South Africa, this includes the Information Regulator established under the Protection of Personal Information Act. Where users are located in other jurisdictions, including the European Union, complaints may also be directed to the applicable data protection authority in that jurisdiction. Ann-Connect cooperates with lawful regulatory inquiries and takes complaints relating to privacy rights seriously.

Institution-Based Users (Students, Educators, and Staff): If you are using Workspace through an educational institution or organization, your institution acts as the primary Data Controller and determines how your personal information is used. For questions relating to your personal data, privacy rights, or how your information is processed within your institution, you are encouraged to contact your institution directly in the first instance. For technical issues, support requests, or access-related concerns, please contact your institution’s helpdesk or system administrator, as they are best positioned to assist you.

Direct Inquiries to Ann-Connect: If you have questions, concerns, or requests specifically related to this Privacy Policy or Ann-Connect data processing practices, you may contact us directly using the details below. We will respond in accordance with applicable data protection laws and within reasonable timeframes.

• Email: legal@ann-connect.com
• Tel: 012 006 5187
• Website: https://ann-connect.com
• Address: 1 Mark Shuttleworth Street, Lynwood, Pretoria, 0087, South Africa