Privacy Policy

1. Who we are

P2P ("the app", "we", "us") is a candidate-engineer registration tracker built by GEC Group. This policy explains what personal information we collect from app users, why, and how we protect it. The app is an independent study-and-tracking tool - it is not affiliated with, endorsed by, or a substitute for the Engineering Council of South Africa (ECSA).

2. Our Information Officer

Under POPIA, our Information Officer is responsible for compliance with this policy and for handling requests about your personal information. Contact: info@gec-group.co.za.

3. What we collect

• Account details: name, email address, and a password (stored as a salted hash, never in plain text).
• Registration profile: your chosen ECSA category, start date, target timeline, and registration milestones you mark as complete.
• Evidence log entries you create: dated notes describing engineering work, the competency outcome, Degree of Responsibility, and CEP/CEA classification you assign each entry.
• Mentor review requests: if you request a mentor review, the evidence/report content you submit is shared with the assigned mentor, along with your name and email so they can respond.
• Access records: which plan you're on and its status. No payment gateway is currently wired in, so no card details or payment processor is involved yet.
• Optional Google account data: if you connect Google Drive/Calendar sync, we request only the minimum scopes needed to save report backups and create calendar events - we do not read your existing Drive files or other calendar events.
• Basic technical data: browser type and device information, for troubleshooting.

4. Why we collect it

• To create and secure your account, and save your progress across devices.
• To generate your Training & Experience Report, Summary, and Engineering Report from your logged evidence.
• To connect you with a mentor when you request a review or virtual interview.
• To confirm your access level.
• To respond to support requests.

We process personal information on the basis of consent, contract necessity, or legitimate business interest, as applicable, per POPIA section 11.

5. Sharing your information

We share personal information only where necessary to run the app: our database host (Supabase), our hosting/functions provider (Netlify), our email provider (Mailgun, for mentor review notifications), and - only if you request one - the mentor who reviews your evidence. We do not sell personal information, and we do not share it with any third party for advertising purposes.

6. How we protect it

We use reasonable technical and organizational measures to keep personal information secure: passwords are salted and hashed, and database access is protected by row-level security so you can only read your own records. This is in line with POPIA's Condition 7 (Security Safeguards).

7. How long we keep it

We retain your account and evidence log for as long as your account is active, so your registration history remains available to you across a multi-year candidacy. If you delete your account, we delete your personal data within 30 days.

8. Your rights

Under POPIA, you have the right to:

• Ask us to confirm what personal information we hold about you, and access it.
• Ask us to correct or delete inaccurate, outdated, or unlawfully held information.
• Object to how we process your information, on reasonable grounds.
• Withdraw consent at any time, where processing is based on consent (e.g. disconnecting Google sync).
• Lodge a complaint with the Information Regulator (South Africa) if you believe we have not complied with POPIA.

To exercise any of these rights, including deleting your account, contact our Information Officer using the details in section 2.

9. Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the most recent revision.