Privacy Policy

Repose Centre of Human Transformation (Registration No. 2024/228806/07), referred to as "Repose", "we", "us", or "our", is committed to protecting your privacy and handling your personal information responsibly. This policy is designed to comply with the Protection of Personal Information Act, 2013 (POPIA) of South Africa and, for individuals in the European Union and United Kingdom, the General Data Protection Regulation (GDPR).

This Privacy Policy explains what information we collect, how we use it, how we protect it, and the rights you have regarding your personal information when you use our website and services at repose.co.za.

1. Who We Are (Data Controller)

Repose Centre of Human Transformation is the data controller responsible for your personal information. For any privacy-related matters, including requests to exercise your rights, contact us at support@repose.co.za.

2. Information We Collect

Information you provide directly

• Full name (first and last name)
• Email address
• Mobile number
• Country and province
• Password (stored in encrypted form)
• Background and intake information you provide when enrolling in the Academy
• Organisation details when submitting a Wellness enquiry

Payment information

Payments are processed securely by Paystack, our third-party payment provider. We do not store your full card details on our systems. Paystack processes and stores your payment information in accordance with their own security standards and privacy policy.

Information collected automatically

• Usage data such as pages visited and features used
• Progress data within the Academy (modules completed, activity logs)
• Technical data such as browser type and device information

3. How We Use Your Information

We use your personal information to:

• Create and manage your membership account
• Provide access to the Academy, resources, and services you have enrolled in
• Process payments and manage your subscription
• Send you transactional emails (account confirmation, payment receipts, enrollment confirmation, certificates)
• Personalise your experience based on your track and background
• Respond to enquiries and provide customer support
• Improve our platform and services
• Comply with legal and regulatory obligations

4. Legal Basis for Processing

Under both POPIA and GDPR, we process your personal information on one or more of the following legal bases:

• Consent — where you have given us clear consent to process your information for a specific purpose
• Contract — where processing is necessary to provide the services you have signed up for
• Legitimate interests — where processing is necessary for our legitimate business interests, provided these do not override your rights
• Legal obligation — where we are required to process your information to comply with the law

5. How We Store and Protect Your Information

Your information is stored securely using Supabase, our database and authentication provider, with industry-standard encryption and access controls. We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse, including secure authentication, role-based access control, and session-based security.

6. International Data Transfers

Our service providers may store or process data in countries outside South Africa or the European Economic Area (EEA). Where personal information is transferred internationally, we take reasonable steps to ensure that appropriate safeguards are in place and that your information continues to be protected to the standards required by POPIA and GDPR. Our providers include Supabase, Paystack, Resend, and Vercel, each of which maintains its own data protection commitments.

7. Sharing Your Information

We do not sell your personal information. We share your information only with trusted third-party service providers who help us operate our platform, including:

• Paystack — payment processing
• Supabase — data storage and authentication
• Resend — transactional email delivery
• Vercel — website hosting

These providers are bound by their own privacy and security obligations. We may also disclose information where required by law.

8. Your Rights

Under POPIA and GDPR, you have the following rights regarding your personal information:

• Right of access — to obtain a copy of the personal information we hold about you
• Right to rectification — to request correction of inaccurate or incomplete information
• Right to erasure — to request deletion of your personal information (the "right to be forgotten"), subject to legal and contractual obligations
• Right to restrict processing — to request that we limit how we use your information
• Right to data portability — to receive your information in a structured, commonly used format and to have it transferred to another provider where technically feasible
• Right to object — to object to the processing of your personal information in certain circumstances
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
• Right to lodge a complaint — with the Information Regulator of South Africa, or with your local data protection authority in the EU/UK

To exercise any of these rights, contact us at support@repose.co.za. We will respond within the timeframes required by applicable law.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we are committed to notifying the relevant supervisory authority and affected individuals without undue delay, and where required, within 72 hours, in accordance with GDPR and POPIA obligations.

10. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you cancel your membership, we may retain certain information as required by law or for legitimate business purposes such as record-keeping and dispute resolution. When information is no longer needed, we securely delete or anonymise it.

11. Cookies

Our website uses essential cookies and session storage to keep you logged in and to enable core functionality. If you arrive through an affiliate link, we store a referral cookie for 30 days so the correct affiliate is credited. We do not use advertising cookies and do not track you across other websites. You can choose “Essential only” on our cookie notice to decline the referral cookie. See our Cookie Policy for full detail.

12. Children's Privacy

Our services are intended for adults and, where applicable, students enrolled with appropriate consent. We do not knowingly collect information from children without the consent of a parent or guardian. Where a student under the age of 18 is enrolled, we require that a parent or guardian provides consent.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us: