Privacy notice
This explains what personal information the Humanitas Independent Counselling Society collects, why, what we do with it, and what rights you have. It applies to members, applicants, people who raise concerns, training providers, and visitors to this site.
[TO CONFIRM: review of this notice by counsel competent in POPIA, before publication]
The Humanitas Independent Counselling Society is the responsible party for the personal information described in this notice, as that term is used in the Protection of Personal Information Act 4 of 2013 ("POPIA").
It is a non-profit company registered under the Companies Act 71 of 2008 (registration number 2026/694642/08), with its registered office at 547 Frelon Street, Elarduspark, Pretoria, Gauteng, 0047.
Information Officer: Anri van den Berg, founder and chief executive. Under POPIA the head of a private body is its Information Officer by operation of law; registration with the Information Regulator follows incorporation.
Contact:info@hics.co.za
If you want to ask about anything on this page, exercise any of the rights in section 13, or raise a concern about how we have handled your information, that address is the place to start.
Confirmation of your training from the provider, and confirmation of your supervised hours from your supervisor. Where a document you have supplied is unclear, confirmation of your qualification from the awarding institution. See section 5.
Their name and contact details, the member concerned, an account of what happened, and any supporting documents. These often contain information about a third party, most commonly a client.
Organisational details, programme curricula and versions, assessment methods, and the qualifications and experience of the people delivering and assessing the programme.
See section 15.
We do not receive bulk records from any training provider, including Humanitas Training, which is a separate legal entity from HICS. Every enquiry we make about an individual is made on that individual's own authorisation.
This section describes the single most significant thing HICS does with your information, so it is set out separately.
What an applicant tells us opens an enquiry. It does not close it. A certificate on its own is evidence that a claim is worth checking, not evidence that it is true. So when you apply, we contact the provider that ran your training and the supervisor who signed off your hours, and we ask them to confirm what you have told us. Your qualification is confirmed from the certified copy of your degree certificate and the academic transcript you supply, and where a document is unclear we may contact the institution that awarded it.
We do this only on your written authorisation, given when you submit your application. That authorisation states what will be verified, with whom, and for what purpose. It is recorded with your application, and it is the only basis on which we enquire. We do not approach anyone you have not named.
What we ask them is limited to confirming the specific facts you have given us: that you completed a named programme, in a named year, under a named curriculum; that a named qualification was awarded; that a stated number of supervised hours were completed and signed off. We do not ask for your academic record, your assessment results, your conduct, or any opinion about you.
What we record is the answer, its source, and the date, so that any decision about your membership can later be shown to rest on something checkable.
If a source cannot confirm something, your application does not fail quietly. We tell you what could not be confirmed and by whom, so that you can offer another route to the same fact.
The HICS directory will be public. No member has been admitted yet, so nothing is published in it today. When it goes live, anyone will be able to search it without an account, and its pages will be found by search engines. This is deliberate: a professional standard that cannot be checked by the person relying on it is not worth much.
What is published because you are a member: your name; your designation; your academic qualification, by discipline and NQF level; the fields of practice recorded against you; any advanced practice you hold; whether your supervision is current; and whether you are in good standing.
What is published only if you choose: the area you practise in, and the contact details you elect to provide, which may include a phone number, a website, or social media. You may publish all of these, some, or none. If you publish none, your standing can still be confirmed by anyone who has your name, but you will not appear when someone searches by area.
What we never publish: your identity or passport number, your date of birth, your home address, your payment details, your fitness-to-practise declaration, or the contents of your supervision records.
Your standing changes immediately. If your membership lapses, is suspended, downgraded or revoked, the directory reflects that at once: there is no notice period and no delay. Historical standing is retained, because HICS may be asked what a member's standing was on a past date.
Disciplinary outcomes. Routine matters are not published. In serious cases, a revocation or a termination, HICS may publish the fact and the outcome of a finding, where that is proportionate and protects the public. Nothing is published until the time for appealing has passed or an appeal has been finally decided, unless the Board determines that public safety requires otherwise.
| What we do | Why we may lawfully do it |
|---|---|
| Assess an application and verify its evidence | To take steps to enter into and perform the membership agreement, and your consent for the verification enquiries |
| Maintain the member record, CPD, supervision and renewal | Performance of the membership agreement |
| Publish the public directory | Performance of the membership agreement, and, for area and contact details, your consent |
| Receive and decide complaints | Our legitimate interests in upholding a published professional standard and protecting the public, and, where applicable, to establish, exercise or defend a right in law |
| Meet a legal obligation, including mandatory reporting | Compliance with an obligation imposed by law |
| Recognise training programmes and accredit CPD | Performance of the agreement with the provider, and our legitimate interests |
| Communicate with members about HICS | Performance of the membership agreement, and your consent for anything optional |
Where we rely on your consent, you may withdraw it. Withdrawing consent for the verification enquiries means we cannot assess your application. Withdrawing consent for the publication of your contact details means you will not be findable by area, but does not affect your membership.
Some of what we hold is special personal information under section 26 of POPIA, and we treat it accordingly.
Health and fitness to practise. A fitness-to-practise declaration may involve information about your health. We collect only what bears on fitness to hold a designation, and we do not use it for anything else.
Information about clients, in complaints. A concern raised about a member usually describes what happened between that member and a client, and that account is often health information about a person who has not contacted us themselves. We hold it only for the purpose of deciding the matter; we keep it separate from ordinary membership administration; access is restricted by role to the Registrar and the Ethics Committee; and every access is logged.
If you are named in a complaint you did not make, you have the rights in section 13 in the same way as anyone else, and you may contact the Information Officer.
Information about criminal or disciplinary matters, where disclosed on application or arising in a complaint, is held only in connection with the decision it bears on.
People deciding your matter. Members of the Standards and Admissions Committee, the Ethics Committee, an investigator, a Disciplinary Panel or an Appeal Panel, each of whom sees only what is necessary, and none of whom may act where they have a conflict of interest.
Institutions, providers and supervisors, for verification, and only as described in section 5.
Service providers who process information on our behalf: hosting, email, payment processing and document storage. Each is bound by a written agreement requiring them to process information only on our instructions and to keep it secure.
Where the law requires it. Some conduct must be reported to the authorities regardless of any other duty of confidence, including under the Children's Act 38 of 2005, the Criminal Law (Sexual Offences and Related Matters) Amendment Act 32 of 2007, and the Domestic Violence Act 116 of 1998. A statutory duty overrides confidentiality, and it is not subject to anyone's agreement.
Another professional or statutory body, where there is a lawful basis and a legitimate protective purpose.
Anyone, through the public directory, as described in section 6.
We do not sell personal information, share it for advertising, or provide it to anyone for marketing.
The member system is hosted on Amazon Web Services in its Ireland region (eu-west-1), in the European Union, and its data is processed there. This website is served from the same region.
Where personal information is processed outside South Africa, we satisfy ourselves that section 72 of POPIA is met before it goes.
Complaint and disciplinary records: at least five years from the conclusion of the matter, and longer where a sanction has continuing effect or where a child was involved. They are then securely destroyed.
Member records, including applications, CPD and supervision records: for the duration of your membership and for five years after your membership ends. They are then deleted or de-identified.
Applications that are refused or withdrawn: we keep the application and its supporting documents for 12 months after the decision or withdrawal, so we can deal with any query or challenge about it, and then delete them. Where an application was refused, we keep a minimal record of the decision: that you applied, when, and the outcome. We keep this so that any later application can be fairly considered.
Some records are kept for as long as they may be needed to show that a decision was properly made: an admission, a refusal, a sanction or an appeal outcome is never overwritten, and is amended only by a later record that supersedes it.
Information is encrypted in transit and at rest. Access is granted by role, on a least-privilege basis, and complaint records are restricted to the Registrar and the Ethics Committee. Every change to a member record, decision or standing value is logged with who made it, when, and what it was before.
If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 requires.
Under POPIA you may:
On that last point, one thing is worth saying plainly. Some applications are decided automatically where every criterion has been confirmed: the training with the provider, the hours with the supervisor, and the qualification from certified documents. That decision is an admission, taken against criteria the Board has published; a sample is reviewed by the Registrar; written reasons are given in every case; and every applicant has a right of appeal to three people, none of whom took the original decision. No application is refused automatically: anything that needs judgement goes to a person. If you would prefer your application to be considered by a person rather than automatically, tell us when you apply.
To exercise any of these rights, contact the Information Officer at the address in section 2. We may need to confirm your identity first. There are some limits: for example, we may not be able to delete a record we are required to keep, or to give you information that would reveal someone else's personal information or compromise the fairness of a live process.
Tell us first, at the address in section 2. We would rather hear it and fix it.
You may also complain to the Information Regulator (South Africa), which supervises compliance with POPIA.
Information Regulator (South Africa) · Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · telephone 010 023 5200, toll-free 0800 017 160 · general enquiries enquiries@inforegulator.org.za · POPIA complaints POPIAComplaints@inforegulator.org.za.
This is different from raising a concern about a member's professional conduct, which is dealt with under the Complaints and Disciplinary Procedure.Raise a concern about a member
This site collects little, and that is deliberate. The fonts and every other asset are served from this site itself, and it sets no cookies of its own. It carriestwo forms, on the membership application page and on the training providers page, described below.
Since 3 September 2026 the site uses Google Analytics to count visits and see which pages are read. That is a material change from the earlier version of this notice, which said the site ran no analytics, so we say so plainly. Google Analytics sets cookies in your browser and sends the pages you view, together with technical details such as your IP address and browser, to Google, which processes them outside South Africa under its own privacy policy. HICS uses the resulting figures in aggregate only, to understand how the site is used, and never to identify a visitor. You can prevent it by blocking cookies or scripts for this site in your browser, or with Google's own opt-out browser add-on; the site works fully without it.
On the application page you can ask to be told the day membership applications open. That form collects yourname, surname and email address, and, only if you choose to answer, whether you hold a qualification at NQF 7 or above. When you submit it, those details are sent to and held by the HICS member portal, which is part of HICS and not a third party, for one purpose: a single notification that applications are open. It is not an application and creates no standing with HICS, the details are used for nothing else, and they are removed on request. Where they are stored is covered in section 10.
On the training providers page a training or CPD provider can ask to be told when the recognition and accreditation route opens. That form collects the organisation's name, a contact name and email address, and which of the two routes the provider is interested in. When it is submitted, those details are sent to and held by the HICS member portal, which is part of HICS and not a third party, for one purpose: a single notification that the route is open. Knowing how many providers are waiting also helps HICS plan the opening. It is not an application and creates no standing with HICS, the details are used for nothing else, and they are removed on request. Where they are stored is covered in section 10.
Like every web server, the server this site runs on keeps standard access logs: the requesting IP address, the page requested and the time. They are used to keep the site secure and running, and for nothing else. The site is served from a server in Ireland, in the European Union. Access logs are kept for 14 days and then deleted.
If this changes again, or another form is introduced, this section will be updated at the same time, and where the change is material we will say so rather than relying on you noticing.
We will update this notice when what we do changes. The version and date appear at the foot of the page, and where a change materially affects members we will tell them rather than relying on them noticing.
Version 1 ·[TO CONFIRM: the date this notice takes effect, on adoption after counsel review]