Privacy Notice

EDINOVA (PTY) LTD

1. Who We Are

Edinova (Pty) Ltd (Registration No. 2014/188994/07) is the responsible party for the personal information processed through MyEdinova and NovaX, except where we act as an operator on behalf of a subscribing organisation.

Our information:

For purposes of this Notice:

• “MyEdinova and NovaX platforms (together, the “Platforms”).
• “MyEdinova” (platform) refers to our learning product designed for learners aged 13 and older.
• “NovaX” refers to our adult learner product, designed for learners aged 18 and older.
• “Coach Nova” refers to the AI-supported educational companion integrated into the Platforms.
• “you” or “your” refers to any data subject whose personal information is processed through the Platforms, including learners (adult and minor), parents or guardians, teachers and administrators of subscribing organisations, and website visitors.

2. Scope of This Notice

This Notice applies to:

• Individual learners who register directly (adults, and minors registering with parent/guardian consent);
• Parents or guardians who register or manage a child’s account, or who receive notifications relating to a child’s use of the Platforms;
• Subscribing organisations (schools, training providers or other institutions) (“organisations”) and their administrators and teachers who use the Platforms to manage learners; and
• Visitors to our website and prospective clients who engage with us regarding MyEdinova or NovaX;
• Staff whose work accounts connect to our sales CRM.

3. Personal Information We Collect

3.1 Identity and contact information

• Email address, password (stored securely by our authentication provider, never in plain text), first and last name;
• Gender, where collected for organisation or demographic reporting;
• Phone number, used for account recovery, support, billing verification, multi-factor authentication;
• Date of birth, used for age verification and to determine minor vs adult registration flows;
• Organisation access code, where a learner is invited by a subscribing organisation.

3.2 Children’s and parent/guardian information

Where a learner is under 18, or a parent registers a child, we additionally collect:

• Parent/guardian email address and consent records;
• Child’s name and email address, where a parent creates or links a child’s account.

3.3 Educational and learning data

• Module and unit progress, used to track the learning journey, unlock content and show completion to the learner;
• Learner answers and project work, used to assess understanding, provide Coach Nova with context, and generate reports.

3.4 Artificial intelligence and Coach Nova data

• Learner prompts and messages submitted to Coach Nova, and Coach Nova’s responses;
• Admin-configured system prompt templates that govern Coach Nova’s behaviour;
• Analytics excerpts of learner questions, used for skill scoring and product improvement.

3.5 Payment and billing data

Collected when a learner or parent subscribes individually, or when an organisation purchases licences:

• Billing name and address, used for invoices and tax/VAT context;
• Transaction references, subscription plan and organisation licence tokens, used for entitlement, billing communications and finance reconciliation.

4. How We Collect Personal Information

• Directly from you when you register as an individual learner or parent, or when your organisation onboards you onto the Platforms;
• Directly from you as you use the Platforms — for example, submitting an answer, chatting with Coach Nova, or completing your profile;
• From your organisation, where it invites, manages or reports on you as one of its learners or staff;
• From our payment processor, in connection with a subscription purchase;
• From a linked parent/guardian, where they register or manage a child’s account;

5. Why We Process Your Personal Information

We process personal information through MyEdinova and NovaX for the following purposes:

• To provide, maintain and support the Platforms and their individual features in terms of our subscription agreement or terms of use;
• To track learning progress;
• To manage subscriptions, licences, billing and payment processing;
• To send transactional communications (for example, welcome emails, verification codes, password resets, report-ready notifications, and payment or subscription notices);
• To maintain the security, integrity and proper functioning of the Platforms, including fraud and abuse detection;
• To respond to support queries.

Our lawful basis for this processing is, depending on the specific activity: performance of our agreement with you or your organisation, our legitimate interests in operating, securing and improving the Platforms, compliance with a legal obligation, and, where applicable, your consent (in particular for parental consent).

6. Artificial Intelligence Systems and Automated Processing

We use artificial intelligence, including AI-powered features such as Coach Nova, to support and enhance the services provided through the Platforms. Personal information may be processed through AI technologies where necessary for the functionality of these features. Any such processing will be carried out in accordance with POPIA.

7. Children’s Personal Information

Protecting children’s personal information is central to how we operate the Platforms. MyEdinova is designed for learners aged 13 and older; NovaX is designed for adult learners aged 18 and older. Our systems enforce an absolute minimum registration age of 13, and anyone under the age of 18 who registers individually must provide, or have provided on their behalf, parent or guardian consent before they can use the Platforms.

7.1 How we obtain and record parental consent

• A parent or guardian may register and create a child’s account directly, providing their own email address and the child’s name and email, and giving consent as part of that flow;
• Where a minor registers themselves, our sign-up flow routes them through parental consent capture before the account becomes active;

8. How We Share Your Personal Information

We may share personal information with service providers who process it on our behalf. Such processing will be carried out in accordance with POPIA.

9. Sales CRM and Google and Microsoft account data

9.1 What we collect.

Employees and contractors who need our sales CRM (sales.myedinova.com) connect their Edinova Google Workspace or Microsoft account. We then access:

• Google Meet and Microsoft Teams meeting information and transcripts. The CRM’s meeting assistant (Carmen.ai) joins virtual meetings as a visible guest with its microphone and camera off. The host can refuse it. Where the host has turned transcription on, we store the transcript text, a short summary and suggested actions. We do not store the video or the audio.
• calendar events. The CRM can create and change events.
• email in the connected mailbox. The CRM can read email, compose and send it, and keeps its own copy of the email.
• audio of in-person meetings that a staff member records on a laptop, stored with the meeting record and transcribed. There is no video.

This can include personal information of clients, schools, companies and other meeting attendees.

9.2 Why we use it.

To show staff their meetings, produce summaries and follow-up actions, file email against sales records, and let staff send email and manage meetings from the CRM. We do not use it for advertising or to score staff performance, and we do not sell it.

9.3 Who we share it with.

Summaries and suggested actions are produced by OpenAI through its API, and audio from laptop recordings of in-person meetings is transcribed by OpenAI’s Whisper service. This means transcripts and that audio are sent to OpenAI in the United States, subject to section 10. We do not use information from Google or Microsoft accounts to train AI models, and our AI provider’s current terms do not permit it to do so. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9.4 Who can access it.

Only staff who have been given a CRM login can open meeting records and synced email.

9.5 How long we keep it.

Information is kept until it is deleted or we no longer need it to run the CRM. Disconnecting an account does not automatically delete data already synced. To have information deleted, email support@myedinova.com. We will delete it from the CRM unless we are required to keep it by law.

9.6 Security measures.

We protect personal information with access controls, encryption in transit and at rest, and storage on access-controlled systems. CRM records are kept in Google Cloud. Access to the CRM requires a signed-in account.

9.7 Your rights.

To ask for access, correction or deletion, email support@myedinova.com (see section 11). To reach the Information Officer or the Information Regulator, see section 12.

10. Transborder flow of information

Where personal information is processed outside South Africa, we take reasonable steps to ensure the recipient is subject to a law, binding corporate rules, or contractual terms that provide an adequate level of protection substantially similar to POPIA, in accordance with section 72 of POPIA. We use AI and infrastructure providers whose current terms do not permit them to use your personal information to train their own models. Providers set their own terms and may change them at any time.

11. Your Rights

Subject to POPIA, you have the right to:

• Request confirmation of, and access to, the personal information we hold about you;
• Request correction of inaccurate or incomplete personal information (available via self-service profile update for most fields);
• Request deletion or destruction of personal information that we are no longer authorised to retain (available via self-service permanent account deletion);
• Object to the processing of your personal information on reasonable grounds, including for direct marketing purposes;
• Request that a decision based solely on automated processing not be taken, or request the reasons for such a decision;
• Withdraw consent previously given (including parental consent for a minor), without affecting the lawfulness of processing carried out before withdrawal; and
• Lodge a complaint with the Information Regulator.

12. Information Officer and the Information Regulator

If you are not satisfied with our response to a query or complaint, you have the right to lodge a complaint with the Information Regulator of South Africa:

Last updated: 12 November 2026