Privacy notice

1. Who is responsible

InnovCreations (Pty) Ltd is the responsible party for the personal information processed in MaturityPath. Our information officer can be reached at email@innovcreations.co.za. Our corporate details are published at innovcreations.co.za.

2. What we collect

• Account information: your name, email address and sign-in credentials.
• Assessment information: the organisation you assess, its industry and size, the scope you describe, the frameworks you select, the levels you record, target levels, notes and the roadmap activities you create.
• Collaboration information: the email addresses and roles of colleagues you invite to an assessment.
• Billing information: framework access requests, their reference, service fee and decision.
• Technical information needed to run and secure the service, such as session and error information.

We do not collect payment card details: invoicing happens outside the app.

3. Why we process it

• To create and secure your account and let you sign in.
• To run assessments, store scores, calculate gaps and generate roadmaps and reports.
• To share an assessment with the colleagues you invite, within the roles you set.
• To quote, invoice and switch on the framework assessments you request.
• To support you and to keep the service reliable and secure.

4. Lawful basis

We process account and assessment information to perform our agreement with you, and billing information to quote and invoice for it. We process technical and security information for our legitimate interest in operating a secure service. Where AI-drafted analysis is used, the content you have already recorded in the assessment — organisation name, industry, requirement wording and your scores — is sent to the AI service to draft the roadmap. You choose whether to run that analysis.

5. Who can see it

• You, the assessment owner, and the colleagues you invite to that assessment — limited to the domains and role you assign.
• InnovCreations (Pty) Ltd administrators, who maintain the service, the framework library and the licensing register.
• Service providers that host the application, database, email and AI features on our behalf, under contract and only for the purposes above.
• Authorities, where the law requires disclosure.

We do not sell personal information.

6. Cross-border processing

Some service providers may process information outside South Africa. Where that happens, we rely on providers that offer comparable protection for personal information, as POPIA requires.

7. How long we keep it

Account and assessment information is kept while your account is active. When you delete your account, the assessments you own and the records attached to them are deleted, and you are removed from assessments owned by others. Licensing records may be kept longer where tax or record-keeping law requires it.

8. Your rights

• Ask what personal information we hold about you, and request a copy.
• Ask us to correct information that is inaccurate or out of date.
• Ask us to delete information, or to close your account.
• Object to processing based on legitimate interest.
• Complain to the Information Regulator of South Africa if you believe your information has been handled unlawfully.

Send requests to email@innovcreations.co.za. We respond within the periods POPIA sets.

9. Security

Access to the service is authenticated per account. Assessment records are only visible to the people on that assessment and to InnovCreations (Pty) Ltd administrators. If a security compromise affects your personal information, we will notify you and the Information Regulator as required.