PassPath
Free mock exam

Privacy Policy

Last updated: 16 October 2026

This policy explains what personal information PassPath collects, why we collect it, and the rights you have over it under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA). We have kept it short and in plain language; if anything is unclear, email us and we will explain.

1. Who we are

The “responsible party” under POPIA is PASSPATH (PTY) LTD (Registration No. 2026/517551/07), the company that operates PassPath, an online exam-preparation platform for South Africa’s RE5 and RE1 regulatory exams. Our registered address is available on written request to support@passpath.co.za.

Reach our Information Officer at support@passpath.co.za for anything in this policy: questions, access requests, corrections, deletions, or complaints.

2. What we collect and where it comes from

We collect personal information directly from you, and we only collect what we need to run the service:

  • Full name and email address: required to create your account.
  • Password: required. It is hashed and managed by our authentication provider; PassPath never sees or stores your password in plain text.
  • Course and study progress: quiz results, readiness scores, and practice history, generated as you use the platform. This is what makes the product work.
  • Purchase confirmation records: which course you bought, when, and for how much. We never see or store your card number (see section 6).
  • Marketing preference: voluntary. You choose whether to receive marketing emails; saying no has no effect on your access.
  • Booking-deadline reminders: voluntary, and only if you ask for one on our RE5 or RE1 exam-dates page. We store your email address, the exam and the sitting date you picked, the registration deadline we worked out, and, if you choose one, your province. If you also tick the box for the study series, we store the date and time you ticked it as the record of your consent.
  • Basic technical logs: IP address and browser type, kept for security and to diagnose problems.
  • Website usage data: which pages you visit and what you click on our website, collected through Google Analytics cookies (see section 8). It does not include your name or email address.

That is the full list. We do not ask for your ID number, physical address, or any special personal information, and we do not collect information about you from other companies.

3. Why we process it

We use your information to:

  • create and manage your account;
  • deliver the courses: track your progress, score your practice, and measure your readiness;
  • process and confirm payments;
  • provide support when you contact us;
  • send service emails, such as purchase confirmations and access reminders;
  • send marketing emails, only if you have opted in;
  • send the booking-deadline reminders you asked for and, only if you ticked the box for it, our 3-email study series and a notice when new sittings are added in your province. One unsubscribe link stops both the reminders and the series;
  • email you the result of a free practice test, and the study emails you agreed to at the same time, if you asked us to. We store the address, the counts from that attempt, and the exact sentence you agreed to. We never store your answers: free tests are marked in your browser and what you chose is never sent to us;
  • keep the platform secure.

We do not use your information for anything else. Where we look at how the platform is used overall (for example, which questions people find hardest), we work with aggregated, de-identified data that cannot be traced back to you.

4. Lawful basis

We process your information because it is necessary to perform our contract with you (delivering the course you bought), because you have consented (marketing emails, including the exam-dates study series, and the booking-deadline reminders you ask for), or because we have a legitimate interest in keeping the service secure (technical logs) and in understanding how our website is used so we can improve it (website analytics). Where we rely on your consent, you can withdraw it at any time.

5. Direct marketing

In line with section 69 of POPIA, we only send marketing emails if you have opted in. Every marketing email contains a working unsubscribe link, and unsubscribing never affects your course access or the service emails you need to use your account.

6. Who we share it with

We never sell your personal information. We share it only with the service providers (POPIA calls them “operators”) who help us run PassPath, and only so they can provide the service:

  • Our authentication and database provider : securely stores your account and study data.
  • PayFast: payment processing. Your card details go directly to PayFast; PassPath never collects or stores card numbers.
  • Our content management provider: hosts our article content (it does not hold your account data).
  • Our web hosting provider: serves the website and processes technical logs.
  • Our email delivery provider: sends the reminders and study emails you asked for. It receives your email address and the message, nothing else.
  • Google (Google Analytics): measures how our website is used, so we can see which pages and tools help people. Google receives the website usage data described in section 8 and processes it on servers outside South Africa.

Each operator may only use your information to provide its service to us. We may also disclose information if the law requires it, for example, to a regulator or a court.

7. Cross-border transfers

Some of our providers store data on servers outside South Africa. In line with section 72 of POPIA, we only use providers who are subject to laws, contracts, or binding rules that protect your information in a way substantially similar to POPIA.

8. Cookies and website analytics

A cookie is a small file a website saves in your browser. We use two kinds:

  • Essential cookies keep you logged in to your account in the app. Without them you cannot stay logged in.
  • Analytics cookies come from Google Analytics. We use it on this website to count visits and to see which pages and tools people use, for example how many people start or finish a free practice test. Google Analytics sets cookies named _ga and _ga_ followed by an ID. They hold a random number that lets it recognise your browser when you come back, and they last up to two years unless you clear them.

Through these cookies Google Analytics receives the pages you visit, the site that sent you to us, your browser and device type, and your approximate location (country and city, worked out from your IP address). It also receives what you do on our pages, such as clicking a button, or finishing a free practice test and the score you got. It does not receive your name, your email address, or the answers you chose. Google says Google Analytics does not log or store IP addresses. We only look at the results as totals and trends. We do not use them to identify you, and we do not combine them with your account. We have not linked Google Analytics to any advertising service.

You can object at any time. Block or delete cookies in your browser settings, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout. The website works fully without analytics cookies.

9. How long we keep it

We keep your account information for as long as your account is active, plus a reasonable period afterwards in case you come back or a question arises. Transaction records are kept for five years, as South African tax and company law requires. Technical logs are kept only as long as needed for security. Booking-deadline reminder records, including the record of any study-series consent and of when you unsubscribed, are kept so we can show we honoured your choice, and are deleted on request. You can ask us to delete your information earlier (see section 11); we will delete everything we are not legally required to keep and tell you what, if anything, must be retained and why.

10. How we protect it

We take reasonable, appropriate measures to secure your information: all traffic to PassPath is encrypted in transit (HTTPS), passwords are hashed and never stored in plain text, access to personal data within the company is restricted, and we use reputable providers with strong security practices of their own.

If a data breach ever occurs that is likely to cause you harm, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

11. Your rights

Under POPIA you have the right to:

  • ask what personal information we hold about you and get a copy;
  • have inaccurate information corrected;
  • request deletion of your information;
  • object to processing;
  • withdraw consent you have given (for example, for marketing).

To exercise any of these, email our Information Officer at support@passpath.co.za. We may ask you to verify your identity first (this protects your information from being handed to someone pretending to be you) and we respond within a reasonable time, usually a few business days. Access to your own information is free. You can also see and correct most of your details yourself in your account settings.

12. Complaints

If you believe we have mishandled your personal information, please contact us first; we take this seriously and will try to put it right. You also have the right to lodge a complaint with the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za or via inforegulator.org.za.

13. Children

PassPath is intended for people preparing for professional regulatory exams and is only for users 18 or older. We do not knowingly collect personal information from children. If you believe a child has created an account, tell us and we will delete it.

14. Changes to this policy

We may update this policy from time to time, for example, if we add a service provider or the law changes. Each version is dated at the top of this page. If we make a material change, we will notify registered users by email before it takes effect.

This policy forms part of our Terms & Conditions.