Privacy Policy

1. Who we are

P2P ("the app", "we", "us") is a candidate registration tracker for CBE professions provided by Global Executive Consultants (Pty) Ltd, registration number 2018/065094/07, trading as GEC Group. This policy explains what personal information we collect from app users, why, and how we protect it. The app is an independent study-and-tracking tool. It is not affiliated with, endorsed by, or a substitute for ECSA, SACAP, SACQSP, SACPCMP, SACPVP, or SACPLAN.

2. Our Information Officer

Under POPIA, our Information Officer is responsible for compliance with this policy and for handling requests about your personal information. Contact: [email protected].

3. What we collect

• Account details: name, email address, and a password. On the hosted app at gec-group.co.za/p2p, accounts are created through Supabase Auth, which stores passwords as hashes. If the app is run without those keys (local demo mode), the same fields stay in this browser's localStorage only.
• Registration profile: your chosen ECSA category, start date, target timeline, and registration milestones you mark as complete.
• Evidence log entries you create: dated notes describing engineering work, the competency outcome, Degree of Responsibility, and CEP/CEA classification you assign each entry. You may attach an optional site or evidence photo to an entry.
• Optional profile photo: if you add one from the camera or gallery, it is stored on your account and shown in the app chrome.
• Mentor review requests: if you request a mentor review, the evidence/report content you submit is shared with the assigned mentor, along with your name and email so they can respond.
• Report drafts: Training & Experience Report narratives, Engineering Report text, and referee prep notes, stored in your account so they survive a lost phone or laptop.
• Organogram: names and job titles of people on your ECSA reporting line that you type in. Those are other people's personal information. You are responsible for only adding people who belong on that line and for having a lawful basis to record them.
• CPD progress: Category 1 activities you mark complete, and scores from the in-app quizzes.
• Access records: your account and evidence log. No payment is collected in the app, so no card details or payment processor is involved.
• Optional Google account data: if you connect Google Drive/Calendar sync, we request only the minimum scopes needed to save report backups and create calendar events - we do not read your existing Drive files or other calendar events.
• Android app: an optional fingerprint unlock that stays on this device (we never receive your fingerprint). If you allow notifications, we store a device push token and a last-active timestamp so we can remind you after a month of inactivity. Voice typing runs on the device; we do not upload the audio.
• Basic technical data: browser type and device information, for troubleshooting.

4. Why we collect it

• To create and secure your account, and save your progress across devices.
• To generate your Training & Experience Report, Summary, and Engineering Report from your logged evidence.
• To connect you with a mentor when you request a review or virtual interview.
• To confirm your access level.
• To respond to support requests.

We process personal information on the basis of consent, contract necessity, or legitimate business interest, as applicable, per POPIA section 11.

5. Sharing your information

When the hosted backend is configured, we share personal information only where necessary to run the app:

• Supabase (auth and database, hosted in the EU, Stockholm).
• Netlify (hosting and serverless functions, United States).
• Cloudflare (DNS and security proxy in front of gec-group.co.za).
• Mailgun (mentor review emails, when that is enabled, EU region).
• Google Fonts on public pages. Optional Google Identity if you sign in with Google. Optional Google Drive and Calendar if you connect them from Account.
• A mentor you choose, only when you request a review or interview.

Some of these providers process information outside South Africa; we rely on their data processing terms, which give protection comparable to POPIA (section 72). In local demo mode, nothing leaves this browser. We do not sell personal information, and we do not share it with any third party for advertising purposes.

6. How we protect it

On the hosted app, passwords are hashed by Supabase Auth and database access is protected by row-level security so you can only read your own records. In local demo mode, data never leaves this device; a hash of the password is stored in localStorage (or a weaker fallback on insecure file:// pages). This is in line with POPIA's Condition 7 (Security Safeguards).

7. How long we keep it

We retain your account and evidence log for as long as your account is active, so your registration history remains available to you across a multi-year candidacy. If you delete your account, we delete your personal data within 30 days.

8. Your rights

Under POPIA, you have the right to:

• Ask us to confirm what personal information we hold about you, and access it.
• Ask us to correct or delete inaccurate, outdated, or unlawfully held information.
• Object to how we process your information, on reasonable grounds.
• Withdraw consent at any time, where processing is based on consent (e.g. disconnecting Google sync).
• Lodge a complaint with the Information Regulator (South Africa) if you believe we have not complied with POPIA.

To delete your account, use the Delete your account path at the top of this page, or contact our Information Officer using the details in section 2.

9. Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the most recent revision. Related: Terms of Use, Cookie Policy, Refund Policy.