1. Scope
We may collect personal information from you when you visit our website, register for an account, or interact with our services. This information may include your name, email address, contact details, and any other information you voluntarily provide to us.
It does not govern how customers independently process personal data within their own WebbLMS environments.
2. Our Role (Controller vs Processor)
For website visitors, prospects, and account holders, WebbLMS acts as a data controller.
For learner, instructor, and end-user data stored within customer LMS instances, WebbLMS acts solely as a data processor on behalf of the customer.
Customers determine the purposes and means of processing learner and user data within their LMS. Under POPIA, these roles are referred to as the responsible party and operator respectively.
3. Personal Information We Collect
3.1 Information You Provide
We may collect:
Name, email address, and contact details
Organisation name and role
Account and administrator credentials
Support communications
Website enquiries are sent to [email protected] through SendGrid, with an automatic acknowledgement to your email address. Enquiry content is not stored in a website database or on the website’s disk; it remains in the emails processed by our mail providers. SendGrid email open and click tracking are disabled. Local preview submissions are validated but are not saved or emailed. We use short-lived in-memory hashes to help prevent duplicate submissions and abuse; these expire within one hour and are cleared when the server restarts. Do not include passwords, learner records or other sensitive information in this form.
3.2 Automatically Collected Information
We may collect limited technical data such as:
IP address, browser type, and device information
Log and usage data for security and reliability
Cookie and analytics data (see Section 12)
3.3 Billing Information
For services invoiced directly by WebbWorx, we process customer billing contact details, invoice records and payment references for administration and accounting. Please do not send full payment-card details to us. If an earlier transaction was processed by Paddle, records relating to that transaction remain subject to the applicable payment arrangements.
4. How We Use Personal Information
We use personal information to:
Provide, operate, and support the Services
Provision and manage LMS instances
Administer proposals, invoices, payments and agreed service renewals
Communicate service notices and support responses
Maintain platform security and prevent misuse
Comply with legal obligations
We do not sell personal data or use it for targeted advertising.
5. Legal Bases for Processing (GDPR)
Where GDPR applies, we process personal data based on:
Performance of a contract
Legitimate interests (platform security, support, service improvement)
Legal obligations
Consent, where required
6. Customer LMS Data
Personal data stored within a customer’s WebbLMS instance (including learner records, assessments, logs, and content):
Is controlled and owned by the customer
Is processed by WebbLMS solely to provide the Services
Is logically isolated per customer environment
Customers are responsible for:
Providing notices and obtaining consent from users
Defining retention and deletion policies
Responding to data subject requests related to LMS data
7. Data Storage and Security
WebbLMS uses industry-standard technical and organisational measures to protect personal data, including:
Dedicated or isolated infrastructure per customer
Encrypted data in transit
Access controls and audit logging
Regular patching and monitoring
No system can be guaranteed to be completely secure.
8. Data Retention
We retain personal information only for as long as necessary to:
Provide the Services
Meet legal, accounting, or compliance requirements
Resolve disputes and enforce agreements
Customer LMS data may be deleted after account termination, subject to reasonable retention periods unless otherwise agreed.
9. Sharing and Disclosure
We may share personal information with:
Service providers (hosting, monitoring, support) under contractual confidentiality obligations
Providers supporting invoicing, accounting and payments where necessary; Paddle only where relevant to a transaction processed by Paddle
AI service providers where an agreed AI feature is used, to process the content needed for that feature. Applicable providers and data-handling requirements should be addressed during configuration and in the customer’s agreement.
Authorities, where required by law
We do not share personal data for advertising purposes.
10. International Data Transfers
WebbLMS operates globally and may process data in multiple jurisdictions, including the United States and European Union.
Where required, international transfers are safeguarded through appropriate mechanisms such as standard contractual clauses or equivalent protections.
11. Your Rights
South Africa (POPIA)
Subject to applicable conditions and exceptions, you may request access to your personal information, request correction or deletion, and object to certain processing. Contact us using the details below. You may also lodge a complaint with South Africa’s Information Regulator.
11.1 EU / UK (GDPR)
You may have the right to:
Access your personal data
Correct or delete your data
Restrict or object to processing
Request data portability
Lodge a complaint with a supervisory authority
11.2 United States
Depending on your state of residence, you may have rights to:
Know what personal data we collect
Request deletion or correction
Opt out of certain processing activities
Requests can be made using the contact details below.
12. Website Measurement and Privacy Choices
We use a small page counter to understand which pages and traffic sources are useful. It sends a page path and a broad source category, such as LinkedIn, Google or direct/unknown, to a WebbLMS-controlled service hosted by Google. It does not send URL queries, full referrer addresses, visitor identifiers, IP addresses or browser details in its measurement payload, and does not set analytics cookies or fingerprint your device. Google necessarily processes network information to deliver the service. Counts are combined by day, page and source; they cannot identify unique visitors or connect a person’s visits.
You can turn off this counter using “Reject all” in “Privacy settings” in the footer. Choose “Basics only” to allow the page counter without analytics cookies. We also respect browser Global Privacy Control and Do Not Track signals. A previous decline of analytics remains a decline unless you change your preference. Daily totals are kept for up to 13 months; the collector’s working buffer is kept for up to 31 days. We exclude recognised bots and test requests where possible, but counts may still include undetected automated visits or miss blocked requests.
Separately, with your permission, Google Analytics measures visits, traffic sources and interactions, including contact-email link clicks and successful enquiry submissions. Google receives website usage and device information and uses analytics cookies to distinguish visits. Google Analytics stays off until you select “Accept all”. A contact-link click does not confirm an enquiry. A successful enquiry event means the email provider accepted the notification for delivery; it does not confirm a completed booking or qualified lead. Form contents are excluded from analytics. Advertising storage, advertising user data and ad personalisation are disabled in this implementation.
You can withdraw Google Analytics consent using “Privacy settings” in the footer. We remember your analytics consent for up to 180 days and your page-counter preference in this browser until you change it or clear browser storage. Withdrawing consent stops future collection and removes this site’s Google Analytics cookies; it does not erase information already collected.
Google may process information outside South Africa. See Google’s Privacy Policy for details. We do not send enquiry messages or learner conversations through either measurement service. Fonts and site assets are served with the website. Technical request logs may be processed to operate and secure the service.
Customer Moodle environments and external services have their own cookie and data-processing arrangements.
13. Children’s Data
WebbLMS does not knowingly collect personal data directly from children through its website.
Within customer LMS environments, customers are responsible for ensuring compliance with applicable child data protection laws (including COPPA, GDPR-K, or equivalent).
14. Changes to This Policy
We may update this Privacy Policy periodically. Updates will be posted on our website with a revised effective date.
Where a change requires notice or consent under applicable law, we will follow those requirements.
15. Contact Us
WebbWorx (Pty) Ltd
Cape Town, South Africa