Privacy Policy
Version 2026-08-31. Operated by Operational Support Services Africa CC, trading as Contractor Academy.
This policy describes what Contractor Academy collects, why, and what you control. It describes the system as actually implemented. Where an integration is prepared but not switched on, that is stated plainly rather than implied.
What we collect
- Account information — first name, last name and email address. Required to create an account.
- Password — stored only as a one-way hash. We never store or see your password.
- Mobile / WhatsApp number — optional. You can use Contractor Academy fully without providing one.
- Verification records — that your email or number was verified, and when. Verification codes are stored only as a hash and are never logged.
- Purchases and entitlements — what you bought and what access it grants.
- Practice activity — which practice tests you started and completed, and your scores. This is what makes your free allowance and your progress work.
- Lead attribution — the page you arrived on, the referring website's host name, and campaign labels where present. Values taken from a URL are sanitised before storage, and anything resembling a credential is discarded rather than stored.
- Marketing preferences — which channels you have consented to, when, from where, and whether you later withdrew.
- Company profile — the company name, trading name, registration number, responsible person and approving authority you enter for documents you generate. This is business information you supply and it remains yours.
- Company logo — optional. If you upload one we resize and re-encode it, which removes camera and authoring metadata, and store the optimised image in protected storage outside the public website. The original upload is discarded. It is used only to brand documents you generate.
- Documents and assessments you create — the generated documents and risk assessments in your workspace, and a record of when each was generated.
What we do not do
- We do not sell your personal information.
- We do not set advertising or third-party tracking cookies.
- We do not build behavioural profiles beyond the activity counts above.
- We do not store card data. Payment is handled by the payment provider.
- We do not treat promotional messages as service messages to avoid asking consent.
Service messages and marketing are different
Service messages relate to your account and are sent because you have an account: email verification, WhatsApp number verification, password resets, security notices, purchase confirmation, access and entitlement information, and certificate availability. These are not marketing and do not depend on marketing consent.
Marketing messages are training tips, product updates and offers. These are sent only where you have given consent for that specific channel. Consent is never a condition of creating a free account or of using Contractor Academy.
Your choices
- Email marketing and WhatsApp marketing are separate consents. Granting one does not grant the other.
- Both default to off. An existing account that never gave consent has none.
- You can change either at any time under Communication preferences in your account.
- Withdrawing consent does not close your account, does not remove anything you have bought, and does not stop service messages.
- Verifying your number is not consent to marketing. They are recorded separately.
Third parties
WhatsApp (Meta). Contractor Academy has a WhatsApp Business integration in the codebase. It is currently disabled and no production credentials are configured, so no message is sent to WhatsApp and no number is shared with Meta at present. If it is enabled, verification messages will be sent from the official Contractor Academy WhatsApp Business identity and your number will be processed by Meta to deliver them.
Google. A downstream lead export to a Contractor Academy business Google Sheet is prepared but currently disabled, and no data is sent to Google. If enabled, only a restricted set of customer-safe fields would be exported. Passwords, password hashes, session identifiers, verification tokens, verification codes, payment credentials and API secrets can never be exported.
Analytics. Contractor Academy uses Google Analytics 4 to understand how the site is used and which content brings people here. Google sets its own cookies for this. We send page paths, page titles, campaign labels and product-event names.
We do not send Google your name, email address, phone or WhatsApp number, company registration number, identity number, address, password, verification code, or the contents of any document. Every analytics event passes through a filter that drops parameters named after personal fields, and drops any value matching an email address, a South African mobile number or an identity number, whatever it is called. IP anonymisation is enabled.
Retention
Account, purchase and entitlement records are kept while your account exists and for as long as needed for legal, tax and dispute purposes. Verification codes expire within minutes and are single-use. Consent records are kept while your account exists so we can show what you agreed to and when, including withdrawal.
If a subscription ends, your workspace is retained rather than deleted, so you can resume where you left off if you return. Retention is currently configured at 90 days after termination, after which the workspace is marked for review. Nothing is deleted automatically.
Security
Passwords are hashed. Verification codes are stored only as hashes. Sessions are regenerated on login. Forms are protected against cross-site request forgery. Database access uses prepared statements. Configuration and credentials are held outside the public web root.
Your rights
Under the Protection of Personal Information Act you may request access to the personal information we hold about you, ask for it to be corrected, object to processing, and withdraw consent to marketing. Marketing withdrawal is immediate and self-service under Communication preferences. For anything else, contact Support.
This policy describes our practices. It is not legal advice, and Contractor Academy does not claim certification or accreditation under any privacy standard.
Cookies
Strictly necessary. One session cookie is set when you log in. It keeps you signed in while you use your account and is removed when you log out or the session ends. It is marked Secure, HttpOnly and SameSite=Lax, so it is sent only over HTTPS and is not readable by scripts in your browser.
Analytics. Google Analytics 4 sets cookies to measure site usage, as described above. These are not strictly necessary. No advertising or cross-site advertising cookies are set, and we do not sell or share your information for advertising.
If you prefer not to be measured, most browsers let you block or clear cookies for this site, and browser or extension level opt-outs for Google Analytics are honoured.