Campus Plug — Privacy Policy

Effective date: ⟨INSERT DATE⟩ Last updated: ⟨INSERT DATE⟩ Applies to: the Campus Plug mobile application (Android), the Campus Plug website, and related services (together, the "Service").

⚠️ BEFORE YOU PUBLISH — items marked ⟨…⟩ must be completed, and every factual claim about data collection must be checked against what the app actually does. Google Play enforces against mismatches between this policy, your Data safety form, and your app's real behaviour. See SUBMISSION_CHECKLIST.md.

1. Who we are

Campus Plug is operated by QCONNEC (Pty) Ltd (trading as Campus Plug), a private company registered in the Republic of South Africa.

For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), QCONNEC (Pty) Ltd is the responsible party for personal information processed through the Service. Where the UK or EU GDPR applies, we act as the data controller.

We are registered with the Information Regulator (South Africa) under registration reference ⟨INSERT, OR DELETE THIS LINE IF NOT YET REGISTERED⟩.

2. Summary — the short version

• Campus Plug is a student network for users 16 and older. To use it you create an account and, in most cases, verify that you are a registered student. If you are 16 or 17, we need a parent or guardian's consent first.
• We collect the information you give us (profile, posts, listings, messages), information generated as you use the app (Plug Points, CampusCash, streaks, study sessions, referrals), and standard technical information from your device.
• We use it to run the Service, verify students, keep the community safe, pay out rewards, and improve the product.
• We do not sell your personal information.
• We do not show ads and we do not use advertising identifiers. Institutional and brand partners receive aggregated, de-identified reporting only.
• We ask for location permission to show nearby campus activity. You can decline; the app still works.
• You can delete your account and associated data at any time, in the app or at https://qconnec.co.za/delete-account.

3. Minimum age and users under 18

The Service is intended for users 16 years of age and older. You must be at least 16 to create a Campus Plug account.

3.1 Users aged 16 and 17

Under the Protection of Personal Information Act ("POPIA"), a child is any natural person under the age of 18. Section 34 of POPIA prohibits the processing of a child's personal information unless one of the grounds in section 35 applies.

Accordingly, if you are 16 or 17 years old, we process your personal information on the basis of the prior consent of a competent person — your parent or legal guardian.

During sign-up we ask for your date of birth. If you indicate that you are under 18:

• we ask for a parent or guardian's name and contact details;
• we contact them directly to obtain verifiable consent before your account is activated;
• until that consent is received, your account remains limited and you cannot post content, use the marketplace, or exchange messages.

A parent or guardian may at any time contact privacy@qconnec.co.za to review the personal information we hold about their child, request its correction or deletion, refuse further processing, or manage which social features are available to that child.

We do not encourage or persuade any user under 18 to disclose more personal information than is reasonably necessary, as required by POPIA section 35(1).

3.2 Users under 16

We do not knowingly process the personal information of anyone under 16. If we learn that we hold such information, we will delete the account and its associated personal information without undue delay. Report a suspected under-16 account to privacy@qconnec.co.za.

3.3 Safety safeguards for users under 18

Because our target audience includes users under 18, we apply additional safeguards to social features:

• an in-app safety reminder about the real-world risks of online interaction, shown before a user under 18 can share freeform content or message another user;
• a parent/guardian mechanism to enable, disable, or restrict social features for that user;
• no personalised advertising, and no use of advertising identifiers (see section 14);
• heightened moderation thresholds on content visible to users under 18.

4. What personal information we collect

4.1 Information you give us

4.2 Information generated by your use of the Service

4.3 Information collected automatically

We do not sell or share location data with advertisers or data brokers.

4.4 Permissions we ask for

5. Why we process your information, and our legal basis

You can withdraw consent at any time in the app under Profile → Settings → Privacy, or by emailing privacy@qconnec.co.za. Withdrawing consent does not affect processing that already took place.

6. The Anonymous Feed — important disclosure

The Anonymous Feed lets you post without your name or handle being shown to other users.

"Anonymous" means anonymous to other users — not anonymous to us.

• Posts to the Anonymous Feed are stored with a link to the account that created them.
• We retain that link so that we can investigate abuse reports, enforce our Community Guidelines, and respond to lawful requests from South African authorities.
• Access to the link between an account and an anonymous post is restricted to authorised trust-and-safety personnel and is logged.
• We will not disclose your identity to other users.

Do not post anything to the Anonymous Feed that you would not want associated with you in a safety investigation or a lawful request.

7. Automated processing, including AI

We use automated systems, including third-party large language models, to help operate the Service. Specifically:

• Content moderation. Posts, images, listings, comments and messages may be automatically screened for content that breaches our Community Guidelines. Content may be automatically hidden, queued for human review, or removed.
• Support. Automated assistants may draft responses to your support queries.
• Lifecycle and content operations. Automated systems may generate notifications, recommendations and campaign content.

Where an automated decision materially affects you — for example suspension of your account or forfeiture of rewards — you have the right to request human review. Email privacy@qconnec.co.za and a person will re-examine the decision.

User content processed by these systems may be transmitted to our AI processor ⟨CONFIRM PROVIDER — e.g. Anthropic (Claude API)⟩ under a data-processing agreement. It is not used by that provider to train models ⟨CONFIRM AGAINST YOUR COMMERCIAL TERMS BEFORE PUBLISHING⟩.

8. Who we share information with

We do not sell personal information. We share it only as follows.

8.1 Service providers (operators under POPIA / processors under GDPR)

Each provider is bound by contract to process personal information only on our instructions and to apply appropriate security safeguards.

8.2 Other users

Your handle, profile photo, posts, stories, comments, marketplace listings and Study Zone presence are visible to other users according to your settings. Ambassador leaderboards display your name or handle, institution and referral count.

8.3 Institutions, brands and partners

Universities, TVET colleges, brand partners, advertisers and funders receive aggregated and de-identified reporting — for example weekly verified active students by campus. This does not identify you individually.

Where a partner requires individual-level data (for example to award a bursary or verify eligibility for a specific programme), we will ask for your explicit consent first and tell you exactly what will be shared.

8.4 Legal and safety disclosures

We may disclose personal information where we reasonably believe it is necessary to comply with a law, regulation, subpoena or court order; to enforce our Terms of Use and Community Guidelines; to detect or prevent fraud or security issues; or to protect the rights, property or safety of Campus Plug, our users or the public.

8.5 Business transfers

If QCONNEC (Pty) Ltd is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

9. Cross-border transfers

Our primary infrastructure is hosted in AWS af-south-1 (Cape Town, South Africa). Some providers listed in section 8.1 process information outside South Africa.

Where personal information is transferred outside South Africa, we do so in accordance with section 72 of POPIA — relying on binding contractual terms that provide an adequate level of protection, or your consent. For transfers subject to the GDPR, we rely on Standard Contractual Clauses or an adequacy decision.

10. How long we keep information

After account deletion we retain only what we are legally required to retain, or what is irreversibly de-identified.

11. Your rights

Under POPIA (and, where applicable, the GDPR) you have the right to:

• Access — request confirmation of what personal information we hold about you, and a copy of it;
• Correct — have inaccurate or incomplete information corrected;
• Delete — request deletion of your personal information (see section 12);
• Object — object to processing based on legitimate interests, and to direct marketing at any time;
• Restrict — request that we limit processing while a dispute is resolved;
• Portability — receive your information in a structured, commonly used, machine-readable format (GDPR);
• Withdraw consent — where processing is based on consent;
• Human review — of automated decisions that materially affect you (section 7);
• Complain — to a supervisory authority.

To exercise any of these rights, email privacy@qconnec.co.za. We respond within 30 days. We may ask you to verify your identity first.

Complaints — Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 General enquiries: enquiries@inforegulator.org.za Complaints: POPIAComplaints@inforegulator.org.za Website: https://inforegulator.org.za ⟨VERIFY THESE CONTACT DETAILS ON THE REGULATOR'S WEBSITE IMMEDIATELY BEFORE PUBLISHING — they have changed before.⟩

12. Deleting your account and data

You can delete your Campus Plug account and associated personal information at any time:

In the app: Profile → Settings → Account → Delete account

On the web: https://qconnec.co.za/delete-account

By email: privacy@qconnec.co.za with the subject "Delete my account"

What is deleted: your profile, posts, stories, comments, anonymous posts, marketplace listings, direct messages, study session history, referral records, profile and verification images, and your unspent CampusCash and Plug Points balances.

What is retained, and why:

• Transaction records required for financial and tax record-keeping (5 years, as required by South African law);
• Records of safety enforcement (bans, confirmed abuse reports) needed to keep banned users off the platform;
• Aggregated, de-identified statistics that can no longer be linked to you.

Timing: deletion begins immediately and completes across live systems within 30 days, and across backups within ⟨INSERT⟩ days.

⚠️ Unspent balances. Deleting your account forfeits any unredeemed CampusCash, Plug Points and unclaimed milestone rewards. Redeem before you delete. ⟨CONFIRM THIS MATCHES YOUR ACTUAL REWARD TERMS.⟩

13. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2+) and at rest;
• Passwords stored using industry-standard one-way hashing — we never store them in plain text;
• Role-based access control, with access to student verification documents and anonymous-post attribution restricted to authorised personnel and logged;
• Data residency in AWS af-south-1 for primary systems;
• Regular backups, monitoring and vulnerability management.

No system is perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

14. Advertising

Campus Plug does not display third-party advertising.

We do not use the Google Advertising ID, we do not run advertising SDKs, and we do not share personal information with advertising networks or data brokers. No personalised advertising is served to any user, and none is served to users under 18 in any form.

If this changes in future, we will update this policy and the app's Data safety section, and obtain consent where the law requires it, before any advertising is enabled.

15. Changes to this policy

We may update this policy. If a change is material, we will notify you in the app and by email at least 14 days before it takes effect, and where the law requires it, ask for your consent. The "Last updated" date at the top always reflects the current version. Previous versions are available on request.

16. Contact

QCONNEC (Pty) Ltd t/a Campus Plug Privacy and data protection: privacy@qconnec.co.za General: mbutho@qconnec.co.za Post: ⟨INSERT FULL POSTAL ADDRESS⟩, Durban, KwaZulu-Natal, South Africa