Last updated: 10 June 2026
Ground School is operated by Morz Group (Pty) Ltd., the Responsible Party for personal information that we determine the purpose and means of processing under the Protection of Personal Information Act 4 of 2013 (POPIA).
Morz Group (Pty) Ltd.
CIPC registration number: 2018/111266/07
VAT number: 4910320086
General contact: info@morzgroup.com
Privacy / PAIA: privacy@morzgroup.com
Place of registration: South Africa
When you register, we process your name, email address and authentication information. Passwords are stored in hashed form under the current system design.
Ground School orders may be paid through PayFast, FastSpring, or another payment method expressly offered at the time of purchase.
For purchases paid through PayFast, Morz Group remains the supplier of Ground School and PayFast provides payment-processing services. PayFast processes payment and transaction information, including information required for transaction processing, fraud prevention, security and its own legal or regulatory obligations, under its privacy notice. We receive transaction information needed to confirm payment, provision access, reconcile the order, provide support and maintain appropriate business records. We do not require or intentionally store full payment-card credentials from a normal PayFast transaction.
For orders routed through FastSpring, FastSpring acts as Merchant of Record and processes payment, tax and checkout information under its own terms and privacy practices. FastSpring provides us with limited order and subscription information, such as customer/account identifiers, product or subscription information, transaction status, amount, date and order reference, so that we can provision and administer Ground School access and maintain appropriate business records.
We process course and exam activity, mock-exam results, progress and time spent using the platform to provide progress tracking and performance information and to operate and improve the Service.
We may process IP address, device and browser information, operating-system information, session information, security information, performance data and error information.
If you contact us for support, we process the information you provide.
Where you submit a question through the Question Submission Programme, we process the submission and associated account information to review it, determine whether to use it and communicate with you about it.
Where an ATO, flight school or other business uses a School Account, we may process the organisation’s name, business and billing information, administrator contact details, order and invoice records, and information needed to allocate access to authorised users. A School Account administrator may provide user names, email addresses, course or entitlement allocations and related account-administration information.
The School Account customer is responsible for ensuring that it is lawfully entitled to provide personal information to us and has given affected individuals any notice or obtained any authorisation required for that disclosure. Morz Group processes the information it receives to administer the business relationship, provision and manage user access, provide support, maintain records and comply with legal obligations.
Account, support and question-submission information is supplied by you. Progress and technical information is generated through your use of the Service. Transaction and subscription information may be received from PayFast or FastSpring depending on the payment route. For School Accounts, business and user-allocation information may also be supplied by the relevant school, ATO, organisation or its authorised administrator.
Basic account information is required to create an account. A valid purchase or other entitlement is required for paid content. If required account or entitlement information is not provided, we cannot provide the relevant access. Support and question submissions are voluntary. Analytics that depend on consent or an equivalent user choice will not be activated unless the required choice has been made.
Under POPIA, we process personal information only where permitted. Depending on the activity, this may include your consent; processing necessary to take steps at your request or perform an agreement with you; compliance with a legal obligation; protection of your legitimate interests; or pursuit of our or a third party’s legitimate interests where permitted by law.
We may use cookies, SDKs and similar technologies for essential service operation, authentication, security, support, performance monitoring and analytics. Where consent is required by applicable South African law for a particular processing activity, we will obtain it before that processing begins.
Google Analytics may be used for analytics where enabled. Zoho CRM and Zoho Desk may be used for contact management and support.
We do not sell personal information. Depending on the relevant function, information may be processed by or disclosed to:
| Provider | Role | Typical processing location |
|---|---|---|
| PayFast | Payment service provider / payment processor for purchases paid through PayFast | South Africa; group or service-provider processing may occur in other locations as described in PayFast’s privacy notice |
| FastSpring | Merchant of Record for purchases routed through FastSpring; checkout, payment, tax and order administration | United States and/or other provider locations |
| Microsoft Azure | Cloud and application infrastructure | Depends on the current Azure configuration and may involve processing outside South Africa |
| Google Analytics | Usage analytics, where enabled | May include processing outside South Africa |
| New Relic | Performance and error monitoring | May include processing outside South Africa |
| Zoho | CRM and customer support | May include processing outside South Africa |
FastSpring acts independently for the purposes it determines as Merchant of Record. PayFast processes information in its role as a payment service provider and may also process information for purposes it determines itself, including security, fraud-prevention, legal and regulatory purposes. Their respective privacy notices govern their independent processing. Where PayFast or another provider acts as our operator under POPIA, we require appropriate confidentiality and security measures, including through a written agreement where required by section 21 of POPIA.
We may also disclose information where required or authorised by law, to establish or defend legal rights, to prevent fraud or misuse, or in connection with a lawful corporate transaction.
FastSpring and some other providers may process information outside South Africa. PayFast is a South African payment service provider, but its privacy notice defines its service within a wider group and contemplates processing by partners and service providers. Where Morz Group transfers personal information to a recipient outside South Africa, we do so in accordance with section 72 of POPIA. The relevant PayFast or FastSpring privacy terms also apply to processing they control independently.
We retain personal information only for as long as needed for the purpose for which it was processed, or for a longer period where required or permitted by law.
Account and progress information is retained while needed to provide the Service and for a limited period thereafter where necessary for backups, disputes, security or legal obligations. Transaction and accounting records are retained for the periods required by applicable South African law. Support, analytics and server-log records are retained only as long as reasonably necessary. When information is no longer required, we delete, destroy or de-identify it as appropriate.
Subject to POPIA and PAIA, you may request confirmation of whether we hold personal information about you and request access to it; request correction, deletion or destruction where permitted; object to processing in circumstances provided by law; withdraw consent where consent is the basis for processing; object to direct marketing; and lodge a complaint with the Information Regulator.
To exercise a right relating to information controlled by Morz Group, contact privacy@morzgroup.com. For payment information or processing controlled independently by PayFast or FastSpring, you may also need to exercise rights directly with the relevant provider. We will assist where reasonably possible.
Electronic direct marketing will be sent only in accordance with POPIA.
We use reasonable technical and organisational measures designed to protect personal information against loss, damage and unauthorised access, acquisition, destruction or processing. Measures include encrypted transmission, access controls and hashed password storage where applicable.
If there are reasonable grounds to believe that personal information under our control has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful delay required by law enforcement.
POPIA generally restricts the processing of personal information of children. If a person under 18 is not legally competent to consent independently, a competent person, usually a parent or guardian, must authorise the processing unless another statutory authorisation applies. Ground School should not be used by a child in circumstances where the required authorisation has not been obtained.
The Service may link to independent third-party services. We are responsible for our own processing of personal information, but not for the privacy practices of unrelated third parties.
Requests for access to records under PAIA may be submitted to our Information Officer at privacy@morzgroup.com.
Our PAIA Manual is available at: https://morzgroup.com/paia-manual/.
You may lodge a POPIA complaint with the Information Regulator:
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
Toll free: 0800 017 160
Email: POPIAComplaints@inforegulator.org.za
We may update this Privacy Policy from time to time. The current version will be posted with its revision date. Where applicable law requires additional notice or consent for a material change, we will provide it.
Privacy, POPIA and PAIA enquiries: privacy@morzgroup.com
General enquiries: info@morzgroup.com