Privacy Policy

TrainLink respects your privacy. This policy explains what personal information we collect through train-link.co.za, train-link.com and the TrainLink platform (the "Platform"), why we collect it, who we share it with, and your rights under the Protection of Personal Information Act, 2013 ("POPIA"). It applies to visitors, Clients (and the people who use the Platform on their behalf), Facilitators and anyone whose information is shared with us through the Platform.

1. Who we are

The responsible party for your personal information is TrainLink (Pty) Ltd (registration number 2025/467687/07), trading as TrainLink ("we", "us"), of 128 Leslie Avenue, Design Quarter Building 2, Fourways, Johannesburg, 2191, South Africa. Our Information Officer is Johan Botha, who can be contacted at support@train-link.co.za.

2. Information we collect

Information you give us

• Account details: email address, password (stored only as a one-way encrypted hash), and whether you are a Client or Facilitator.
• Facilitator profiles: full name, photo, country and city, headline, biography, experience summary, qualifications and certifications, areas of expertise, languages, daily and hourly rates, availability, training formats and preferred locations. In later releases this will also include CVs, certificates, sample training materials and payout (bank) details.
• Client profiles: company name, logo, website, industry, size, headquarters, description, and the name and email address of the person managing the account.
• Jobs and applications: job details and supporting documents, cover notes, proposed rates, availability and attachments.
• Communications: connection requests, messages, dispute details, and anything you send to our support team.
• Early-access sign-ups: your email address and whether you are interested as a Client or Facilitator.

Information collected automatically

• Technical information such as your IP address, browser type, device, pages visited and the date and time of access, recorded in our server logs for security and troubleshooting.
• Strictly necessary cookies (see section 8).

Information from others

• Clients may share delegates' names and contact details with Facilitators for an Engagement. Facilitators may give us details of referees. The person sharing that information must have a lawful basis to do so and must tell the people concerned.
• Once payments are introduced, our payment provider will tell us whether a payment succeeded. We do not receive or store full card numbers.

We do not ask for special personal information (such as race, health, religion or biometric data) or for information about children. Please do not include it in your profile or uploads.

3. Why we use your information

We process personal information only for specific, lawful purposes, and only as much as we need:

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Profile and Job verification is done by people.

4. Who can see your information

• Facilitator profiles (name, photo, headline, location, bio, experience, qualifications, expertise, rates, formats) are visible to signed-in Users once verified. Guests see only limited search results. Your email address is not shown on your profile.
• Client profiles and open Jobs are visible to signed-in Users once verified or approved.
• Applications (cover note, rate, availability, attachments) are visible only to the Client who posted the Job and to TrainLink.
• Introductions: when a Client asks to be connected with a Facilitator, or shortlists them, we share each party's name and email address with the other so they can agree the Engagement.
• TrainLink staff can see Account and profile information to operate, verify and support the Platform, and are bound by confidentiality.

We do not sell your personal information.

5. Service providers (operators)

We use trusted service providers who process information on our behalf under written agreements that require them to keep it secure and confidential (POPIA ss20–21):

• Cloud hosting and storage: our application, database and uploaded files are hosted with a cloud provider. We intend to use Amazon Web Services' Cape Town (af-south-1) region, so that data stays in South Africa where practical.
• Email delivery: transactional and service emails are sent through Resend (Resend, Inc.), which processes recipient email addresses and message content to deliver them.
• Payments (when introduced): a regulated South African payment provider, such as Paystack or Peach Payments, will process card and bank details and hold funds. That provider is responsible for its own compliance (including PCI-DSS). We will name the provider here before payments go live.
• Professional advisers (lawyers, accountants, auditors), where needed.

We may also disclose information where the law requires it, to protect the rights or safety of any person, or to a buyer as part of a sale or restructuring of our business, subject to the same protections.

6. Cross-border transfers

Some service providers may process information outside South Africa. For example, our email delivery provider, Resend, processes email addresses and message content in the United States. We only transfer personal information across borders where POPIA section 72 allows it, for example where the recipient is subject to laws or binding agreements that give adequate protection, or where the transfer is necessary to perform our contract with you.

7. Direct marketing

We will only send you electronic marketing if you have consented, such as through our early-access form, or if you are a User and the marketing is about similar TrainLink services. Every marketing message will include a way to opt out. Service emails about your Account and Engagements are not marketing and cannot be switched off while you have an Account.

8. Cookies

We use only strictly necessary cookies:

• sessionid: keeps you signed in;
• csrftoken: protects forms against cross-site request forgery;
• messages: shows one-time notifications after an action.

We do not currently use advertising or third-party analytics cookies, and our fonts are served from our own servers. If that changes, we will update this policy and ask for your consent where required.

9. How long we keep information

• Account and profile information: while your Account is open. When you close your Account, we delete or de-identify it within 90 days, except as described below.
• Jobs, applications, Engagement, payment and invoice records: 5 years after the end of the financial year they relate to, as required by tax and company laws. These records may be kept longer if needed for an ongoing dispute or legal claim.
• Early-access sign-ups: until you unsubscribe, or 24 months after sign-up, whichever comes first.
• Server and security logs: up to 12 months.
• Backups: overwritten in the normal backup cycle, generally within 35 days.

10. Security

We take appropriate, reasonable technical and organisational measures to protect personal information (POPIA s19). These include:

• encrypted connections (HTTPS);
• passwords stored as salted one-way hashes;
• role-based access, so users only see what they are entitled to;
• access to admin tools limited to authorised staff;
• regular backups;
• keeping software up to date.

No system is perfectly secure. If we have reasonable grounds to believe your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as required by POPIA section 22.

11. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you and request a copy, and a record of who it has been disclosed to;
• ask us to correct, update or delete inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information;
• object to processing based on our legitimate interests, and object to direct marketing at any time;
• withdraw consent where we rely on it (this does not affect processing that took place before);
• complain to the Information Regulator (see section 14).

You can update most profile information yourself under Edit profile. For other requests, email support@train-link.co.za. We may need to verify your identity first. We will respond within a reasonable time, normally 30 days. Access requests are free of charge for the information about you that we hold on the Platform. Formal requests for records may also be made under the Promotion of Access to Information Act, 2000 (PAIA), in line with our PAIA manual, which is available on request.

12. Children

The Platform is for adults and businesses. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices change, for example when payments, chat and document uploads are introduced. We will post the new version here with a new effective date and notify Users by email of material changes.

14. Contact and complaints

Information Officer

Johan Botha

Email

support@train-link.co.za

Address

128 Leslie Avenue, Design Quarter Building 2, Fourways, Johannesburg, 2191, South Africa

If you are not satisfied with how we handle your information, you may lodge a complaint with the Information Regulator (South Africa):

Complaints

POPIAComplaints@inforegulator.org.za

General enquiries

enquiries@inforegulator.org.za

Phone

010 023 5200 · Toll-free 0800 017 160

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Website

inforegulator.org.za