Legal, privacy and compliance centre

1. Responsible Party Details

Untrapped Holdings 035 (Pty) Ltd (Registration: 2022/608502/07) operates the AK035 platform as a B-BBEE Level 1 Contributor and social research initiative.

2. Lawful Processing Conditions

We process personal information in accordance with POPIA's eight conditions:

• Accountability: We implement and maintain appropriate measures to ensure compliance across all our systems and third-party service providers.
• Processing Limitation: We collect only what is necessary for defined purposes, with your knowledge or consent.
• Purpose Specification: Clear, legitimate purposes are communicated upfront before or during collection.
• Further Processing Limitation: Any further processing is compatible with the original purpose of collection.
• Information Quality: We take reasonable steps to ensure accuracy, completeness, and currency of personal information.
• Openness: Processing activities are transparent as outlined in this document and through our notification register.
• Security Safeguards: We implement appropriate technical and organisational security measures proportionate to the sensitivity of the information.
• Data Subject Participation: You retain rights to access, correct, and request deletion of your personal information at any time.

3. Operator Relationships

Under POPIA, third-party service providers who process personal information on our behalf are classified as Operators. We have entered into, or are bound by the published data processing terms of, the following Operators:

• External hosting provider acting as Operator for website hosting (frontend and backend infrastructure, including PHP and phpMyAdmin database services).
• External LLM API provider acting as Operator for AI language model API routing services.

We have satisfied ourselves that each Operator provides sufficient guarantees regarding appropriate technical and organisational measures to implement POPIA requirements. We remain the Responsible Party for all personal information processed through these services.

4. Social Research and Anonymisation Protocol

As outlined in our Project Concept Document, we plan to transform user-submitted data from specific tools into anonymised research insights shared with institutional stakeholders such as SETAs, the NYDA, and municipal youth desks.

5. Information Officer and Contact Details

1. Information We Collect

We collect only necessary information for providing career guidance and conducting social research:

• Identity Information: Name and surname (for verification and personalisation)
• Contact Details: Email address, mobile number, WhatsApp contact
• Demographic Data: Age, gender, location, and education level for research purposes
• Career Information: CV or resume, skills, employment history submitted via our online tools
• Online Tool Inputs: Career guidance queries and business information submitted to AK035 Online Career Guidance and MzansiBiz 035 (stored for research purposes as disclosed)
• Platform Usage Data: Interactions with AI guidance tools and resource access patterns
• Technical Information: Device type, browser, and IP address (anonymised before storage)

2. How We Use Your Information

In line with our Human-Centred Design principles, we use your data to:

• Provide personalised online career guidance and business support
• Generate anonymised social research insights on youth employment and entrepreneurship barriers
• Improve platform functionality and user experience
• Send relevant career opportunities and resources (opt-in only)
• Conduct longitudinal research on South African youth outcomes with appropriate anonymisation
• Comply with legal obligations and prevent fraud

3. Infrastructure Providers

Our platform relies on the following infrastructure providers who may process your data as part of service delivery:

• External hosting provider: Provides our frontend and backend infrastructure, including PHP application hosting and phpMyAdmin database management. Data stored on our platform resides on their servers.
• External LLM API provider: Routes queries to AI language model APIs when you use our online tools. Queries you submit may pass through their systems to reach the underlying language model. Generation details are kept in system logs. Please review their Privacy Policy for details on how they handle data in transit.

4. Data Sharing and Third Parties

We share data only under the following conditions:

• Anonymised Research: Aggregated, non-identifiable data shared with SETAs, NYDA, and similar bodies
• Infrastructure Operators: External hosting provider and External LLM API provider as described above, under data processing terms
• Legal Requirements: When required by South African law or court order
• With Your Consent: For specific purposes you explicitly approve

5. Data Retention and Deletion

We retain personal information only as long as necessary:

• Active Users: Retained while you actively use our services
• Inactive Accounts: Anonymised after 24 months of inactivity
• Online Tool Input Data: Data from AK035 Online Career Guidance and MzansiBiz 035 is retained in our database for social research purposes. You may request deletion at any time by contacting our Information Officer.
• Research Data: Once anonymised, retained indefinitely for longitudinal studies
• Legal Requirements: As required by applicable South African law

6. CV Assessment Tool Data (in beta)

The CV Assessment Tool collects and processes information differently from AK035 Online Career Guidance and MzansiBiz 035:

• Email Address: Collected for rate limiting purposes only. Hashed immediately using SHA-256 encryption with a secure salt. The plain text email is never stored on our servers.
• CV Content: Uploaded files are parsed temporarily during your session. Text is extracted, processed for optimisation suggestions, and discarded after generation completes. No CV files are retained on our servers.
• Employment Data: Skills, experience, and education extracted from your CV are anonymised before inclusion in social research datasets. Direct identifiers (names, phone numbers, ID numbers, addresses) are stripped before storage.
• Device Information: IP address, user agent, and screen resolution are hashed and stored for 30 days solely for abuse prevention and rate limiting enforcement.
• Research Data: Anonymised employment barriers, location (province and municipality level), NQF level, and field of study may be retained indefinitely for longitudinal social research.

7. CV Tool Data Retention

• CV Tool Rate Limiting Data: In future updates, email hashes and device fingerprints are to be retained for 30 days to enforce the 5-generation daily limit. These records are automatically deleted via a scheduled task at midnight SAST.
• CV Processing Buffers: Temporary text buffers created during CV parsing are deleted immediately after the generation session ends (typically within 15 minutes).
• Anonymous Research Data: Once anonymised, employment barrier data is retained indefinitely for longitudinal studies. This data cannot be traced back to individuals.
• Ad Analytics: Ad impression and click data is retained for 12 months for revenue tracking and optimisation. This data is aggregated and does not identify individual users.
• OpenRouter API: Routes CV processing queries to AI language models. CV and input text pass through OpenRouter's infrastructure during processing. OpenRouter's privacy policy governs its handling of data in transit. Generation details and logs are kept for review for API submission to identify spending rates, data quality, and to keep track of usage.
• Google AdSense: Displays advertisements during CV generation. AdSense may set cookies and record impression data. Google's privacy policy governs AdSense data practices. Users can opt out of personalised advertising through Google Ad Settings.
• Browser Local Storage: Generated CVs are stored in the user's browser cache only. This data resides on the user's device, not our servers. Clearing browser data removes stored CVs.

8. International Data Transfers

As a South African-focused platform, we prioritise local data hosting through our hosting provider. When queries are processed via the External LLM API provider, data may transit through international infrastructure. We ensure:

• Adequate protection measures per POPIA Chapter 9
• Users are informed of such transfers through this policy
• Contractual obligations binding third parties to equivalent data protection standards

1. Infrastructure Providers

2. Hosting Provider

Our hosting provider supplies the technical infrastructure upon which the AK035 platform runs. This includes:

• Frontend web hosting serving the AK035 website and tools to end users
• Backend PHP server processing form submissions, online tool interactions, and user sessions
• phpMyAdmin-administered MySQL database storing structured data from our online tools and research inputs

As our primary hosting provider, they have access to all data stored on our servers. They operate subject to South African law and relevant data protection obligations. Our service agreement includes provisions for data confidentiality and security.

3. LLM API Provider

The External LLM API provider is used exclusively to route AI language model queries submitted through our online tools. When you use AK035 Online Career Guidance or MzansiBiz 035:

• Your text input is transmitted over an encrypted (HTTPS) connection
• The API provider forwards the query to the selected language model and returns the response
• No personally identifiable information such as your name, contact details, or account information is transmitted unless you include it in your query text
• The API provider's own data handling, including any logging, retention, or use of query data, is governed by their privacy policy and terms of service, which are independent of AK035

4. Other External Services

Note: Google Fonts were previously used for typography. These have been removed from the platform to eliminate unnecessary data exposure. Typography now uses system fonts only.

5. Our Liability for Third-Party Providers

Whilst we take reasonable care in selecting infrastructure providers and negotiating appropriate terms, AK035 and Untrapped Holdings 035 (Pty) Ltd cannot be held liable for the independent data practices, security incidents, or policy changes of our hosting provider, LLM API provider, or any other third-party service. Each provider is independently responsible for compliance with applicable laws in their own jurisdiction.

If you have concerns about how any of our third-party providers handle your data, you may contact our Information Officer. Where we receive a credible concern, we will investigate and take such steps as are reasonably available to us to protect your interests.

1. Tools That Store Input Data

The following online tools store the information you submit, in addition to returning an AI-generated response:

• AK035 Online Career Guidance: Stores career-related queries, CV-related inputs, skills assessments, and demographic information you provide during your interaction. This data is stored in our database hosted on our server provider.
• MzansiBiz 035: Stores business-related queries, entrepreneurship assessments, and business profile information you provide. This data is stored in our database hosted on our server provider.
• CV Assessment Tool: Does not store your CV file, email address, or contact details. CV content is parsed and discarded after your session ends. Only anonymised employment data may be retained for research. See the Privacy policy for full CV tool data handling details.

2. Purpose of Data Storage

Input data from these tools is retained for the following purposes:

• To enable longitudinal social research into youth unemployment, career development, and entrepreneurship barriers in South Africa
• To generate anonymised insights for sharing with SETAs, the NYDA, municipal youth desks, and academic institutions
• To improve the relevance and quality of our online tools over time
• To fulfil our social research mandate as outlined in our Project Concept Document

3. How AI Responses Are Generated

Responses from our online tools are generated by large language models accessed via the External LLM API provider. These models are not trained on your data in real time. Your queries are sent to the model, a response is generated, and both the query and response are stored in our database as described above. The language model itself does not retain or learn from your individual query after the session ends, subject to the API provider's own data policies.

4. Consent to Data Retention

By using AK035 Online Career Guidance or MzansiBiz 035, you acknowledge and consent to:

• Your text inputs and the AI's responses being stored in our database
• This data being used for social research purposes in anonymised form
• Your query passing through the API provider's infrastructure in order to obtain an AI-generated response

A clear notice to this effect will be displayed within each tool before you submit your first query.

5. CV Assessment Tool Specific Terms

The CV Assessment Tool operates under the following conditions:

• Free Access: The tool is provided at no cost to South African users. Revenue is generated through advertisements displayed during processing.
• Rate Limiting: Users are limited to 5 CV generations per 24-hour period. This limit is enforced using email hashing and device fingerprinting. Attempting to bypass this limit through fake emails, multiple devices, or automated scripts constitutes misuse.
• Email Requirement: A valid email address is required to access the CV tool. This email is hashed immediately and used solely for rate limiting. We do not send marketing emails to this address without separate opt-in consent.
• Processing Time: CV generation may take 30–60 seconds. Advertisements are displayed during this waiting period. Users may skip advertisements after 10 seconds.
• Output Format: Generated CVs are delivered as HTML documents opened in a new browser tab. Users must use the browser print function to save as PDF. We do not host or store generated CV files.
• Edit Before Generate: Users can review and edit parsed CV data before generation. This reduces errors and wasted API credits. Once generated, users must restart the process to make changes.
• No Employment Guarantee: CV optimisation does not guarantee employment outcomes. Success depends on individual effort, market conditions, and factors outside our control.

6. Your Rights Regarding Online Tool Data

You retain the following rights in relation to data stored from your online tool interactions:

• Access: You may request a copy of all data stored from your interactions with our online tools.
• Correction: You may request correction of inaccurate stored data.
• Deletion: You may request deletion of your interaction records from our database at any time. Once anonymised as part of a research dataset, individual records cannot be extracted and deleted without destroying the dataset integrity, and we will advise you accordingly.
• Objection: You may object to your data being used for research purposes. Where this is technically feasible without compromising the integrity of anonymised research data, we will accommodate your objection.

7. AI Output Disclaimer

AI-generated responses are produced by language models and may contain inaccuracies, outdated information, or responses that are not appropriate for your specific circumstances. AK035 and Untrapped Holdings 035 (Pty) Ltd accept no liability for decisions made on the basis of AI-generated output. Online tool responses are intended as general guidance only and do not constitute professional legal, financial, or career advice.

1. Nature of Our Curation

AK035 curates and recommends online resources for South Africans, including links to external websites, government portals, SETA platforms, learning resources, job boards, and other digital tools. These curated resources are selected by our team based on their perceived relevance and quality at the time of inclusion.

Curation does not constitute endorsement, partnership, or affiliation unless explicitly stated. The inclusion of any resource on our platform reflects our assessment of its potential usefulness to South African youth and does not imply any formal relationship with the resource provider.

2. No Liability for External Content

AK035 and Untrapped Holdings 035 (Pty) Ltd are not responsible for:

• The accuracy, completeness, or currency of content on any external website or resource we link to
• Any changes to external resources, including removal of content, changes in pricing, or changes in terms of service
• The availability or uptime of external platforms
• Any harm, financial loss, or damage arising from your use of an externally linked resource
• The data practices, privacy policies, or security measures of any external platform
• Any advertisements, sponsored content, or third-party offers you may encounter on externally linked websites

3. Data Practices of External Tools

When you click through to an external resource or tool recommended on AK035, you leave our platform and enter the environment of a third-party provider. That provider's own privacy policy, terms of service, and data protection practices will apply to your interaction. AK035 cannot control, monitor, or take responsibility for how those providers collect, use, or store your personal information.

4. Resource Review Process

We review our curated resources regularly to make sure they stay relevant, functional, and in line with our values. However, the web changes often and we cannot guarantee that every listed resource is checked at a set frequency. We encourage you to use your own judgement when visiting any external resource and to report concerns as outlined above.

5. Government and SETA Resources

Many resources we curate link to official South African government websites, SETA portals, and public institutions. Whilst these are generally trustworthy sources, AK035 cannot guarantee the accuracy of information on government websites, as policies, programmes, and eligibility criteria change frequently. Always verify critical information directly with the relevant government department or institution before acting on it.

6. Curated Resources Limitations

We are not liable for:

• WhatsApp group content or admin actions after users join (we curate but cannot monitor all activity)
• Recruitment agency conduct or hiring decisions
• Twitter/X job post accuracy or expiration
• External website content accessed through our curated links

We ask that users:

• Verify WhatsApp group legitimacy before joining
• Report scam recruitment agencies immediately via lungelo@ak035.co.za
• Understand that social media job posts are time-sensitive and may expire without notice
• Exercise caution when sharing personal information with external recruitment agencies

1. Our Legal Obligations Under POPIA

Section 22 of POPIA requires us, as Responsible Party, to notify both the Information Regulator and affected data subjects as soon as reasonably possible when we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

We take this obligation seriously. Our breach response is guided by the following principles: act swiftly, communicate honestly, and prioritise the protection of affected individuals.

2. What Constitutes a Data Breach

A data breach includes any incident where personal information in our custody is:

• Accessed by an unauthorised person or system
• Acquired, disclosed, or used without authorisation
• Lost, destroyed, or corrupted in a manner that compromises its confidentiality, integrity, or availability
• Subjected to an unlawful interception during transmission

3. Our Internal Breach Response Procedure

Upon detecting or being notified of a potential breach, we will:

• Contain: Take immediate steps to contain the breach, including isolating affected systems and revoking compromised access credentials.
• Assess: Determine the nature and scope of the breach, including which data was affected and how many data subjects are impacted.
• Notify the Information Regulator: Submit the required Form 3 notification to the Information Regulator within the timeframe prescribed by POPIA, which we target as no later than 72 hours of confirmation where reasonably achievable.
• Notify Affected Data Subjects: Inform affected individuals of the breach, the nature of the information compromised, and steps they can take to protect themselves, unless the Information Regulator determines otherwise.
• Remediate: Implement measures to prevent recurrence, including a technical review of our infrastructure with our hosting provider and, where relevant, our LLM API provider.
• Document: Maintain a full record of the breach, our response, and all notifications issued.

4. Notifying Affected Users

Where a breach affects your personal information, we will notify you by:

• Email to the address registered on your account
• WhatsApp message to your registered contact number where email delivery cannot be confirmed
• A prominent notice on the AK035 platform homepage and legal centre

Our notification will include: a description of the nature of the breach, the categories of information affected, the likely consequences, the measures we have taken or propose to take, and the contact details of our Information Officer.

5. How to Report a Suspected Breach

If you suspect that your personal information held by AK035 has been compromised, or if you observe suspicious activity related to our platform, you are encouraged to report this immediately. You may:

• Email our Information Officer at lungelo@ak035.co.za with the subject line URGENT: DATA BREACH REPORT
• Send a WhatsApp message to +27 84 821 9166

We commit to acknowledging all breach reports within 24 hours and providing a substantive update within 5 working days.

6. Third-Party Breach Notifications

If a breach occurs at the level of one of our infrastructure providers, we will notify affected users as soon as we are informed by that provider. We cannot guarantee the timelines of breach notifications from third-party providers, but we commit to relaying such information to you without undue delay once it reaches us.

Where a breach at a third-party provider involves your personal information and you wish to take independent action, we will provide you with the relevant contact details for that provider and for the Information Regulator.

7. Contacting the Information Regulator

1. Acceptance of Terms

These Terms, together with our Privacy Policy, POPIA Compliance Statement, Online Tools Policy, and Curated Resources Disclaimer, form a binding agreement between you and Untrapped Holdings 035 (Pty) Ltd. Continued use of the platform constitutes your acceptance.

2. Service Description

AK035 provides:

• Online career navigation and guidance tools, including the AK035 Online Career Guidance tool
• Business development and entrepreneurship support via MzansiBiz 035
• CV assessment and optimisation guidance
• Curated online resources relevant to South African youth
• Social research participation as an incidental outcome of platform use
• Connection to Digital Facilitator services

Disclaimer: We provide guidance tools and curated resources, not employment guarantees, business success guarantees, or professional advice. Success depends on individual effort, market conditions, and factors outside our control.

3. Third-Party Services and External Liability

AK035 makes use of third-party infrastructure and AI providers to deliver its services. By using our platform, you acknowledge that:

• Our hosting infrastructure is provided by our hosting provider, and all data stored on our platform resides on their servers.
• Online tool responses are generated via the External LLM API provider, which routes queries to external language model providers. Your queries pass through their systems.
• AK035 and Untrapped Holdings 035 (Pty) Ltd cannot be held liable for service interruptions, data incidents, or policy changes originating from our hosting provider, LLM API provider, or any other third-party provider.
• AK035 is not responsible for the content, data practices, or conduct of external websites and tools featured in our curated resources. Each external provider is independently responsible for its own legal compliance.

4. User Responsibilities

As a user, you agree to:

• Provide accurate, truthful information in all interactions with our platform and online tools
• Use the platform for legitimate career development, business development, and related purposes
• Not submit sensitive personal information (such as ID numbers, bank details, or medical records) into online tool query fields
• Respect other users and community guidelines
• Not attempt to reverse-engineer, copy, or misuse our AI systems or intellectual property
• Report suspicious activity, suspected data breaches, or concerns about external resources immediately

5. CV Tool Users

Users of the CV Assessment Tool additionally agree to:

• Provide a valid email address for rate limiting purposes
• Not submit CVs containing other people's personal information without their consent
• Not use automated scripts or bots to generate CVs at scale
• Not attempt to bypass the 5-generation daily limit through multiple emails or devices
• Not upload CVs containing sensitive information (ID numbers, bank details, medical records)
• Report suspicious activity or suspected abuse of the CV tool to our Information Officer

6. Intellectual Property

All platform content, online tool prompts, methodologies, research frameworks, and branding are the intellectual property of Untrapped Holdings 035 (Pty) Ltd. You receive a limited, non-transferable, non-exclusive licence to use our services for personal career and business development purposes only. You may not reproduce, distribute, or commercially exploit any part of our platform without prior written consent.

7. Limitation of Liability

To the fullest extent permitted by South African law, AK035 and Untrapped Holdings 035 (Pty) Ltd shall not be liable for:

• Employment outcomes, career progression, or business success
• The accuracy or suitability of AI-generated responses from our tools
• Third-party job opportunities, resources, or content linked from our platform
• Technical issues, outages, or data incidents at our hosting provider, LLM API provider, or any other third-party provider
• Indirect, consequential, incidental, or special damages arising from use of the platform
• Any harm arising from your voluntary disclosure of sensitive personal information in online tool queries
• Actions or omissions of external tools and resources you access via our curated resources

8. CV Tool Specific Limitations

In addition to the general limitations above:

• We are not liable for CV formatting issues arising from browser print variations
• We are not liable for employment outcomes resulting from CV optimisation
• We are not liable for data loss if users clear browser cache before saving CVs
• We are not liable for API service interruptions affecting CV generation
• We are not liable for advertisements displayed during processing (served by Google AdSense)

9. Termination and Suspension

We may suspend or terminate your access if you:

• Violate these Terms or applicable South African law
• Provide false or misleading information
• Attempt to harm the platform, other users, or third-party providers
• Engage in fraudulent activities

10. Governing Law and Dispute Resolution

These Terms are governed by the laws of the Republic of South Africa, including POPIA, the Electronic Communications and Transactions Act (ECTA) 25 of 2002, and the Consumer Protection Act (CPA) 68 of 2008. Disputes shall be resolved through:

1. Good faith negotiation between the parties
2. Mediation with an accredited South African mediator if negotiation fails
3. Litigation in the KwaZulu-Natal High Court as a last resort

1. Right to Access

You may request:

• Confirmation of whether we hold your personal information
• A copy of all personal information we hold about you, including data stored from online tool interactions
• Details about third parties with whom we have shared your information
• The source of your personal information where it was not collected directly from you

Process: Submit a written request to our Information Officer at lungelo@ak035.co.za. We respond within 30 days as required by POPIA.

2. Right to Correction

You may request correction of inaccurate, outdated, or incomplete personal information. We will:

• Correct the information without undue delay
• Notify relevant third parties if we have shared the incorrect information
• Provide written reasons if we are unable to comply

3. Right to Deletion

You may request deletion of your personal information when:

• It is no longer needed for the original purpose for which it was collected
• You withdraw consent, where processing was based on your consent
• It was unlawfully processed
• You object to processing and we have no overriding legitimate ground to continue

Note on online tool data: Where your input data has already been incorporated into anonymised research datasets, it may not be technically feasible to delete your specific records without compromising the integrity of the anonymised dataset. We will advise you of this and of any alternatives in our response to your deletion request.

4. Right to Object

You may object to processing of your personal information for:

• Direct marketing (this is an absolute right under POPIA)
• Social research purposes, unless processing is necessary for the public interest
• Automated decision-making or profiling that produces legal or similarly significant effects

5. Right to Complain

If you believe we have violated your data rights, you may:

1. Contact our Information Officer to seek resolution directly
2. If unsatisfied with our response, lodge a formal complaint with the Information Regulator

6. Exercising Your Rights

To exercise any of the above rights, contact our Information Officer in writing:

1. What Are Cookies?

Cookies are small text files stored on your device when you visit websites. We use them to:

• Remember your preferences and session details
• Personalise content and recommendations where applicable

2. Types of Cookies We Use

• Essential Cookies: Required for basic platform functionality, such as maintaining your session. These cannot be disabled without affecting platform operation.
• Functional Cookies: Remember your preferences and settings to improve your experience.
• Help us understand how users interact with our platform. All analytics data is anonymised before use.

3. Third-Party Cookies

Our platform loads resources from third-party content delivery networks, which may set their own cookies or record your IP address. These include:

• Cloudflare CDN (Font Awesome): Loaded on pages that use interface icons.
• Google AdSense: Used on the CV Assessment Tool page. AdSense may set cookies and record impression data for ad delivery and optimisation.

4. Managing Cookies

You can control cookies through:

• Your browser settings, which allow you to block or delete cookies
• Our cookie consent banner displayed on your first visit to the platform
• Opting out of non-essential cookies via the banner at any time

Note: Blocking essential cookies will affect platform functionality and may prevent you from using certain features.

5. Data-Lite Approach

In line with our commitment to data-conscious South African users on limited mobile data plans:

• We minimise cookie use to reduce data consumption
• Cookies are small and optimised to reduce bandwidth
• We respect Do Not Track browser signals where technically feasible
• We do not carry out cross-site tracking or invasive behavioural profiling