Privacy Policy
How Cortex IQ handles personal data
This policy explains what information Cortex IQ collects, why it is processed, how it is protected, and what rights users have in relation to that information.
1. Introduction and scope
LinkThis Privacy Policy explains how Cortex IQ, operated for Reify Maxim Group, processes personal information when users access the platform for provider operations, learner onboarding, staff onboarding, resource access, training delivery, assessment workflows, audit readiness, and certification support. It applies to invited users, public signups, authenticated workspace users, and organisations using the platform.
2. Information collected
LinkWe collect only the information reasonably required to operate the platform, maintain traceability, and support training delivery and compliance obligations.
Personal data
This may include names, email addresses, phone numbers, profile details, role assignments, organisation linkage, learner identity information, staff records, enrolment data, attendance records, assessment records, evidence uploads, consent records, and account credentials stored in secured or hashed form where applicable.
Usage data
We may record login timestamps, navigation activity, dashboard interactions, assessment actions, notifications, communication history, audit events, device information, and operational records needed to maintain a reliable training and compliance audit trail.
Cookies and tracking
We use essential browser storage and session mechanisms to keep users signed in, preserve workspace state, remember theme preferences, maintain security controls, and support a stable application experience. We do not use those tools to sell personal data.
3. How data is used
LinkWe use personal information to authenticate users, manage role-based access, process invitations, create and maintain learner or staff profiles, support dashboards, deliver resources, track attendance and assessments, manage communications, monitor compliance readiness, investigate issues, and maintain platform integrity.
4. Legal basis for processing
LinkWhere applicable, we process personal information under lawful bases that include consent, the performance of a contract or service arrangement, compliance with legal or regulatory obligations, and legitimate interests in operating a secure, auditable, and effective training management platform. In the South African context, this policy is intended to align with POPIA. Where relevant, the processing principles also reflect GDPR-aligned expectations around lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and accountability.
5. Data sharing
LinkWe do not sell personal information. We may share data only where required to operate the platform or support legitimate delivery and compliance functions.
Third parties and service providers
This may include hosting providers, authentication providers, infrastructure partners, email delivery providers, analytics or monitoring services, and other vendors acting on our behalf under appropriate safeguards.
Operational sharing
Within the platform, data is made available only to authorised roles such as learners, training providers, assessors, moderators, facilitators, invigilators, employer-side users, or administrators according to actual permissions and provider context.
6. International transfers
LinkWhere technology providers or infrastructure services process data outside South Africa, we take reasonable steps to ensure an appropriate level of protection through contractual controls, provider safeguards, or other recognised security and privacy measures.
7. Data retention
LinkWe retain information only for as long as necessary to provide the platform, preserve delivery and audit records, meet legal or contractual obligations, resolve disputes, and support system security. Retention periods may differ according to record type, including learner records, staff records, assessment evidence, communications, and audit logs.
8. User rights
LinkDepending on applicable law and the relationship between the user, the provider, and the platform, data subjects may request access to their personal information, correction of inaccurate information, deletion where appropriate, restriction of processing, objection to certain processing, and information about how their data is being used. Users may also request a copy of relevant information where legally applicable. We may need to retain certain records where required for legal, contractual, audit, or compliance reasons.
9. Security measures
LinkWe use reasonable technical and organisational safeguards to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. These safeguards may include access controls, password hashing, role-based permissions, audit logging, environment-based configuration, and controlled operational visibility.
11. Children’s data
LinkCortex IQ is intended for managed training operations and is not designed as an open consumer service for children. Where learner data involves minors, the responsible organisation or provider must ensure that appropriate lawful authority, consent, and operational controls are in place before that information is processed through the platform.
12. Changes to this policy
LinkWe may update this Privacy Policy when platform capabilities, legal obligations, data flows, or operating practices change. Updated versions will be published on this page with the latest effective date, last updated date, and version reference.
13. Contact information
LinkQuestions, access requests, correction requests, or privacy concerns can be directed to frederick@reifymaximgroup.co.za.