Introduction.
iXperience (Pty) Ltd (“iXperience,” “we,” “us,” or “our”) is a private limited liability company incorporated in
the Republic of South Africa (Registration No. 2013/159509/07), with its principal place of business at
Darter Studios, Longkloof Precinct, Darters Rd, Gardens, Cape Town, 8001.
We are committed to protecting your personal data in compliance with:
- EU General Data Protection Regulation (GDPR).
- UK GDPR (Data Protection Act 2018).
- South African Protection of Personal Information Act (POPIA), including the amended POPIA
Regulations. - California Consumer Privacy Act (CCPA) as amended by the CPRA.
- Equivalent comprehensive privacy laws in other US states where our Participants reside — including
Connecticut, New Jersey, Rhode Island, New Hampshire, Colorado, and Virginia, among others —
which generally give you similar rights to access, correct, delete, and port your data, and to opt out
of its sale or use in targeted advertising.
This Privacy Policy explains: what personal data we collect, how we use and protect it, your legal rights, and how to contact us.
By accessing our website, participating in our programs, or using our services, you agree to this Privacy Policy.
Nothing in this Privacy Policy limits or excludes any right you have under POPIA, GDPR, the CCPA/CPRA, an applicable US state privacy law, or any other data protection law that applies to you. If any part of this Policy conflicts with such a right, the relevant law prevails.
Who We Are and Contact Details.
- Role: Data Controller (and, in some cases, Data Processor for third-party partners).
- Data Protection Contact: Legal Associate.
- Email: hello@ixperience.co.
- Postal Address: Darter Studios, Longkloof Precinct, Darters Rd, Gardens, Cape Town, 8001.
You may lodge a complaint with your local data protection authority, such as:
- The Information Regulator (South Africa).
- The Information Commissioner’s Office (UK).
- Your relevant EU Member State authority.
- The California Privacy Protection Agency (CPPA), for California residents.
- The Attorney General's office of your US state of residence, if that state has its own comprehensive privacy law (e.g., Connecticut, New Jersey, Rhode Island, New Hampshire).
How We Obtain Personal Data.
We collect personal data from:
- Direct interactions such as applications, enrolment forms, and surveys.
- Automated means such as cookies, analytics, and server logs.
- Third parties such as partner universities, internship hosts, payment processors, and marketing platforms.
Personal Data We Process.
We may process:
- Identity Data – name, preferred name, date of birth, gender.
- Contact Data – address, phone number, email, social media handles.
- Financial Data – bank account details, payment card data, billing history.
- Transaction Data – enrolment details, contracts, purchases.
- Technical Data – IP address, browser type, device identifiers, location data.
- Profile Data – usernames, passwords, preferences, survey responses.
- Identity Documents and Images – passport scans, photographs, physical characteristics.
- Special Category Data – health, race/ethnicity (where legally required). Health-related data is processed in accordance with the Information Regulator’s regulations on the processing of health-related personal information (finalised March 2026), including heightened security and access controls specific to that data.
- Usage Data – website activity, learning platform usage.
- Marketing Data – event participation, communication preferences.
We do not knowingly collect personal data from children under 13 without verified parental consent. In any event, our Programs are only open to Participants aged 18 and over.
Lawful Bases for Processing.
We process your personal data when:
- It is necessary for the performance of a contract with you.
- You have given consent (e.g., for marketing or special category data).
- We have a legitimate business interest that does not override your rights.
- We are complying with a legal obligation.
- It is necessary to protect someone’s vital interests.
Special Category & Sensitive Data.
- We only collect sensitive data where necessary and permitted by law.
- This data is safeguarded with encryption, access controls, and need-to-know restrictions.
- Health-related personal information is processed in line with the Information Regulator’s dedicated health-data regulations (March 2026), which set additional conditions for its collection, storage, and disclosure beyond POPIA’s general provisions.
- For minors, parental consent will be verified through signed consent forms, proof of identity, and confirmation calls. (This applies to any exceptional circumstance in which we process data of a person under 18 — for example, an emergency contact who is a sibling — and not to participants themselves, who must be 18 or older).
Your Right to Object.
Under the amended POPIA Regulations (effective April 2025), you have a strengthened right to object to our processing of your personal data, including for direct marketing. You may exercise this right free of charge, through any of the following channels: email, post, hand delivery, or, where practicable, SMS or WhatsApp to our contact details below. We will inform you of this right at the point we first collect your personal data, and will act on a valid objection without undue delay.
Cookies and Tracking Technologies.
We use:
- Strictly necessary cookies for website functionality.
- Performance cookies are used to analyse site usage.
- Functionality cookies are used to remember preferences.
- Targeting cookies for personalised advertising.
We present a cookie consent banner on first visit, allowing you to manage preferences in line with GDPR and POPIA.
- Where you are located in a US state that requires it, we honour recognised Universal Opt-Out Mechanisms such as Global Privacy Control (GPC) as a valid request to opt out of targeted advertising and the sale of your data.
Media & Public Profile Discretion.
We recognise that many of our Participants attend high-profile universities and may hold, or go on to hold, a public or newsworthy profile. We will not disclose your identity, university, or participation in a Program to media or press without your consent, other than in iXperience's own marketing under the media licence in the Program Terms, except where required by law. If you are featured in our marketing (e.g., a testimonial, photo, or alumni story) and later wish for that material to be taken down or updated — including after you graduate or if your circumstances change — you can request this at hello@ixperience.co, and we will act on reasonable requests promptly.
Participants Who Are Nationals of Other Countries.
Many of our Participants attend university in the United States (or another Program location) but are citizens or permanent residents of another country. If you are a national of, or ordinarily resident in, a country with its own data protection law — for example, China's Personal Information Protection Law (PIPL), India's Digital Personal Data Protection Act 2023 (operational since its Rules were notified in November 2025), Brazil's LGPD, Canada's PIPEDA, or another country's equivalent — we will honour rights under that law that are equivalent to those set out in this Policy, to the extent it applies to our processing of your data. This is in addition to, and does not replace, any rights you have based on where you are physically located while participating in a Program (e.g., as a student in the United States).
Automated Decision-Making.
iXperience's admissions process is manually reviewed by our admissions team, not automated. We do not currently use automated decision-making technology to make significant decisions about applicants (e.g., admission, financial assistance) without human review. If this changes, we will update this section and, where applicable law requires it, give you notice and an opt-out right before any such technology is used.
International Data Transfers.
Given our Cape Town, New York, Lisbon, and Online Programs, we regularly transfer personal data between South Africa, the United States, Portugal/the EU, and your home country. Safeguards include, in order of priority:
- Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum, as our primary safeguard for cross-border transfers — including transfers from Lisbon-based systems to South Africa, and from South Africa to our US-based service providers.
- Transfers to countries with an adequacy decision from the European Commission or the UK authorities.
- Participation in the EU-US Data Privacy Framework, for transfers to certified US organisations, where applicable. We note that the Data Privacy Framework remains valid but is currently subject to a pending legal challenge before the Court of Justice of the European Union, and we monitor this position on an ongoing basis. We do not rely on the Framework as our sole transfer safeguard.
Internship Hosts and Accommodation Partners.
As part of the Program, we share a limited set of your personal data with our internship host companies (for placement, onboarding, and supervision) and accommodation and travel providers (for booking, safety, and duty-of-care purposes). This typically includes your name, contact details, and, where relevant to the placement or booking, your resume, dietary requirements, or accessibility needs. Internship host companies act as independent data controllers for the data they receive in connection with your placement, and their own privacy practices apply to how they handle it; we require all such partners to handle your data securely and only for the purpose of your Program.
Academic Partners.
We share your name, email address, university, Program, location and dates with the Gordon Institute of Business Science (GIBS) to issue your co-branded certificate of attendance and so GIBS can keep a record of iXperience participants. If you have opted in, GIBS may also contact you about its programmes. GIBS's own privacy policy applies to this information. You can object, or withdraw your opt-in, at any time at hello@ixperience.co.
Contacting Parents, Guardians, or Emergency Contacts.
Although Participants must be 18 or older, we may, at a Participant's request or in a genuine safety or medical emergency, contact a parent, guardian, or emergency contact the Participant has provided. Where you provide us with a parent's, guardian's, or emergency contact's details, you confirm that you are authorised to share that information with us for this purpose, and that person's data will only be used to communicate about your safety, wellbeing, or enrolment in the Program.
Data Retention.
We keep personal data only as long as necessary for its purpose or to comply with legal obligations:
- Identity and contact data – retained for the duration of your relationship plus three years.
- Financial and transaction data – retained for five years for legal compliance, and for as long as needed to respond to a payment dispute or chargeback relating to your Program Fee, whichever is longer.
- Special category data – deleted within 30 days of program completion unless required by law.
- Marketing preferences – retained until you opt out.
Anonymised data may be kept indefinitely.
Data Security.
We implement:
- Encryption in transit and at rest.
- Strict access controls.
- Regular security audits.
- Confidentiality agreements for all staff and contractors.
In case of a data breach:
- Regulators will be notified within the time required by applicable law, including, for South African notifications, via the Information Regulator’s eServices portal in accordance with its current procedural requirements.
- Affected individuals will be informed without undue delay if the breach poses a high risk.
Your Legal Rights.
You have the right to:
- Access your personal data.
- Correct or delete it.
- Restrict or object to processing (see ‘Your Right to Object’ above for the strengthened POPIA process).
- Withdraw consent at any time.
- Request a copy of your data in portable format.
- Opt out of marketing.
- Request that we clarify how any automated tool was involved in a decision about you, if applicable (see ‘Automated Decision-Making’ above).
Requests can be sent to hello@ixperience.co. We aim to respond within one month.
Third-Party Processing.
Beyond the internship hosts, accommodation, and travel partners described above, we share personal data with trusted service providers for:
- IT hosting and support.
- Payment processing.
- Marketing and analytics.
- Partner universities, where relevant to your academic credit.
- Academic partners, as described above.
All third parties are bound by written agreements requiring them to protect your data.
Dispute Resolution & Governing Law.
- We encourage you to contact us first to resolve any concerns.
- This Privacy Policy is governed by South African law, without prejudice to mandatory protections under other applicable laws depending on your location.
Relationship to Other iXperience Policies.
This Privacy Policy is incorporated into, and forms part of, the iXperience Summer Terms and Conditions (Section 8) and works alongside the iX Website & Student LMS Policy. Where this Policy addresses the processing of your personal data specifically, it prevails over any general privacy statement in those documents.
Changes to This Policy.
We may update this Privacy Policy from time to time. Updates will be posted on our website with the revised effective date. Where changes are significant, we will notify you directly by email or platform notice.
