Privacy Notice
We collect the minimum we need to run the competition. We never sell your data. Parents control consent for anyone under 18. Voters' phone numbers are scrambled (hashed) and the readable copy is deleted 30 days after voting closes. You can ask us what we hold about you, fix it, or have it deleted at any time.
The full notice follows. It is written to be read, not skimmed past.
1.Who we are
The Zaio National Build Challenge is run by Zaio Technology (PTY) LTD (registration number 2017 / 490284 / 07), trading as Zaio Institute of Technology, of Floor 2, Block B, 66 Albert Rd, Woodstock, Cape Town, 7915 ("Zaio", "we", "us").
Our designated Information Officer under the Protection of Personal Information Act, 2013 (POPIA) is:
[INFO OFFICER NAME]
Email: hello@zaio.io
Phone: 021 300 6808
Any question, request, or complaint about your personal information goes there first.
2.Whose information we process
Four groups of people use this platform. We collect different things from each.
a) Interest registrants (the pre-launch "keep me posted" form)
Name, email address, mobile number (verified by OTP), grade, school, province, preferred language, and one optional free-text answer about a problem in your community.
b) Registered participants (full competition entry)
Everything above, plus: date of birth, parent or guardian's mobile number (for the consent step), your competition submission (website URL, pitch video, theme, title), and your activity on the platform (prompts generated, dashboard visits).
c) Parents and guardians
Mobile number and, if provided, email address (both supplied by the participant so we can send you the consent link), your consent record (what you agreed to, when, which version of the consent text you saw, and the channel you arrived through), and, only if you choose it, a separate marketing opt-in with your contact details.
d) Voters
Mobile number (verified by OTP) and basic technical information about your device and connection (IP address, browser type, screen size, timezone). We use this technical information for one purpose only: detecting voting fraud.
3.Why we process it
| What | Why | Legal basis under POPIA |
|---|---|---|
| Contact and identity details | Running the competition: registration, communication, eligibility | Performance of the competition you entered; consent |
| Date of birth | Confirming you are a Grade 10 to 12 learner and identifying who needs parental consent | Legal obligation (POPIA s35) |
| Parent's mobile and consent record | POPIA requires a competent person's consent before we process a child's personal information | Legal obligation (POPIA s35) |
| Submissions (site, video) | Judging, the public gallery, and the public vote | Performance of the competition; consent for public display |
| Voter mobile numbers | One person, one vote | Legitimate interest (competition integrity) |
| Device and connection data (voters) | Fraud detection only | Legitimate interest (competition integrity) |
| Marketing opt-in (optional, separate) | Telling you about Zaio courses and future programmes | Consent, freely given, withdrawable at any time |
What we never do: sell your information, make entry conditional on marketing consent, or use a child's data for marketing without a parent's separate, explicit opt-in.
4.Children's information
Most participants are under 18. POPIA treats children's personal information as requiring special protection, and we treat it that way:
- A participant under 18 cannot submit an entry until a parent or guardian has consented via the SMS consent link. The consent is timestamped and stored with the exact version of the text the parent saw.
- Participation consent and marketing consent are completely separate. The marketing checkbox is optional, unticked by default, and saying no has zero effect on the child's entry.
- The public gallery offers safeguarding controls: first-name-only display, school name suppression, no public comments anywhere on the platform, and a report button on every submission.
- Winner and finalist publicity is opt-in. A winner can decline all media coverage and still receive their full prize.
Our full approach is on the Child Safeguarding Statement page.
5.Who we share information with
We use service providers to run the platform. They process data on our instructions and cannot use it for their own purposes:
- An SMS gateway (OTP delivery and the parental consent link)
- Email service providers (transactional and competition emails)
- Cloud hosting and storage (the platform and pitch video storage), hosted in [HOSTING REGION]
- Anthropic (AI-assisted first-round judging; submissions are scored, not used to train models)
- [AI TOOL PARTNER] (the building tool; participants receive a credit code, and the partner's own privacy policy governs what participants do inside that tool)
- The independent competition auditor, [AUDITOR NAME AND DESIGNATION], who has access to judging and voting records for verification, as required by the Consumer Protection Act
We disclose information to public authorities only where the law requires it.
6.How long we keep it
| Data | Retention |
|---|---|
| Interest registrants who never enter | Deleted 24 months after collection |
| Participant personal data | Deleted 24 months after the competition ends. Competition results (winner names, as published) remain public. |
| Parental consent records | Kept for the duration required to evidence lawful processing, then deleted with the participant record |
| Voter mobile numbers (readable form) | Deleted 30 days after voting closes (15 March 2027). Only the hashed, non-reversible form is kept for the audit record. |
| Competition records (entries, judging, votes, auditor pack) | 3 years, as required by the Consumer Protection Act |
| Marketing opt-in contacts | Until you unsubscribe. Every message includes an unsubscribe link. |
7.How we protect it
Encryption in transit and at rest, access restricted by role, encrypted backups, rate-limited and OTP-protected authentication (no passwords to leak), and independent security testing before launch. If a breach occurs that risks your rights, we will notify the Information Regulator and affected people as POPIA requires.
8.Your rights
You (or a parent acting for a child) can at any time:
- Access what we hold about you
- Correct anything inaccurate
- Delete your information (note: deleting a participant's data before the competition ends withdraws the entry)
- Object to processing, including withdrawing marketing consent
- Complain to the Information Regulator of South Africa: complaints.IR@inforegulator.org.za, inforegulator.org.za
Send requests to hello@zaio.io. We respond within 30 days.
9.Cookies and analytics
The site uses:
- Essential cookies for login sessions and security. These cannot be switched off; the platform does not work without them.
- Analytics (PostHog) to understand how the site is used, configured without cross-site tracking.
- Advertising pixels (Meta, TikTok) on the public marketing pages only, never inside the logged-in student platform, and only with consent via the cookie banner. We do not run advertising pixels against pages used by logged-in participants.
You can decline non-essential cookies in the banner and the site works fully.
10.Changes
If this notice changes materially, we will post the new version here with a new date and version number, and notify registered participants by email.
Questions about your information? Email hello@zaio.io.