Privacy

Who is responsible

strax.pro is run by Exousia Software Development (Pty) Ltd, a South African company, which is the responsible party for the personal information described here under the Protection of Personal Information Act (POPIA).

Questions, requests and complaints about your personal information go to our Information Officer at privacy@strax.pro.

What we store

Demo and quote requests: what you type into the form (name, email address, organisation, phone and message), used only to reply to you.
Order details when you buy inside STRAX: the company, contact name, email address, billing country and VAT number an administrator enters, with the order reference, package, amounts and payment channel, kept as the tax and licence record of the sale. Card details are entered on the payment processor's own page (Paystack) and never reach us.
Requests for training access: your name, email address, country, the tracks you ask for, and your organisation, role and note if you give them, with our decision and who made it. We use them only to decide on the request and set up your account.
Learner accounts: your name as it appears on certificates, your email address, country and optional region, a one-way hash of your password (never the password itself), whether you asked for occasional news, when you accepted the learner terms and when you last signed in. If you switch on two-factor sign-in we keep the authenticator key in encrypted form.
Exams and certificates: for each exam attempt: the questions you were given, your answers, your score, the time taken and a small number of technical signals (whether the network or browser changed during the attempt) used only to review unusual attempts. For each certificate: its number, the certification, your name and its dates.
Consultant profiles: what a consultant enters for the directory (name, company, website, phone if they choose to show it, regions, languages, services and a short description), and our review notes.
Messages to consultants: your name, email address, organisation and message when you contact a consultant through the directory.
Anonymous page counts: page views per day, page and campaign, keeping only the referring site's hostname. No IP addresses or personal identifiers are stored with these counts, and the learner area is never counted.

What is public

Two things are deliberately public. Anyone who has a certificate number can see, on the verification page, the holder's name, the certification, when it was issued, when it expires and whether it is still valid. A consultant's approved profile is public and can appear in search engines; the consultant chooses what it contains. If a consultant adds a profile photo, it is public once we approve it, with location and camera details removed from the file. A consultant's email address is never published.

When you contact a consultant, we send your message to that consultant with your email address set as the reply address, so they can answer you directly, and we send a copy to the STRAX team. Consultants are independent of Exousia Software and handle your details under their own responsibility once they reply.

Our email is delivered through an email service provider that handles each message only to deliver it. We sell nothing and share nothing with advertisers.

Where your information is kept

strax.pro and its database run on a server we rent from a hosting provider. Only Exousia Software staff can sign in to it, always over encrypted connections, and the database is backed up every night on the same server.

Cookies

The site sets no advertising or analytics cookies and loads nothing from third-party servers. It uses only these cookies, all strictly necessary:

strax_learner keeps a learner signed in. It is sent only to the learner area and ends after at most 24 hours.
strax_console keeps our staff signed in to the operator console. Ordinary visitors never receive it.
A security cookie protects forms from being submitted by other websites, and a short-lived sign-in cookie carries you from the password step to the code step when you use two-factor sign-in.

How long we keep it

An account whose email address is never confirmed is deleted after 7 days. An account we set up for you after a training request waits for you to activate it, and we delete it whenever you ask.
A training request is deleted 12 months after we decide on it, or straight away when you delete your learner account.
Messages to consultants are deleted 12 months after they were sent.
A learner account unused for 3 years is deleted, after an email warning 30 days before.
The text of every email we send is erased from our outbox once it has been delivered.
When a learner account is deleted, its details are erased, its certificates are marked as withdrawn without a name, and any consultant profile is removed.

The product is not this website

STRAX itself runs self-hosted on your own servers. Your business data lives on your infrastructure and is never transmitted to us through this website or otherwise as part of using the product.

Your rights (POPIA and GDPR)

You may ask what we hold about you, ask us to correct it, object to its use, or ask us to delete it. Learners can download everything we hold and delete their account themselves from the account page. For anything else, contact Exousia Software Development (Pty) Ltd through the contact form or our Information Officer at privacy@strax.pro. You may also complain to the Information Regulator of South Africa.