Privacy statement for the South African NREN Login Proxy

Why we process personal information

The South African NREN Login Proxy allows you to use your existing login credentials issued by your home institution or by a social provider such as Google, Microsoft, or Facebook to log into services operated by the South African national research and education network (comprising both TENET & SANReN).

To personalise your experience with these services, some basic personal information, such as your name, is required. We use information about your affiliation to facilitate authorisation decisions (i.e. whether you are allowed to access a service).

The service also allows you to augment the information we get from your login provider with a validated institutional email address. This may facilitate additional access to restricted services.

What information do we collect about you?

The Login Proxy gets information from the provider you use to log in. How much information we get depends on which login provider you use and what you or your home organisation chooses to release from that provider. However, we never ask for more than:

Given name(s)
Surname or family name
Preferred display name
Email address
Your affiliation to your organisation (e.g student or staff)
Your login provider’s personal identifier (username) for you

We also get information you specifically provide to us, for instance, through the email address linking process. This includes additional email address(es) that you have validated using a token we provide you.

What information do we store about you?

We generally store as little personal information as possible within this login proxy. None of the attributes provided by your login provider is retained beyond an ordinary login session (about eight hours) except as described below.

If you use the email address linking option, we store your login provider’s personal identifier together with the email address(es) you have asked us to link to that identity. This linking information is retained for a calendar year, and is automatically deleted in mid-January each year to coincide with the South African academic year. However, you may delete this information yourself at any time by simply removing the linking.

We also collect normal web server logs, i.e. timestamp of access, IP address which requested the page, the page being requested, the HTML result code, etc. The data collected is for the purpose of troubleshooting and debugging potential problems with the SA NREN Login Proxy’s web servers. These are retained for up-to six months, except anonymised statistical information which may be retained indefinitely.

Who do we share information with?

A core purpose of this proxy is to share the personal information we’ve collected with one or more services that you’re trying to log into. This information is limited to only those attributes the service requires, which may be a subset of those we collect from your login provider.

The proxy exclusively serves the South African national research and education network, comprising services operated by both TENET and SANReN. We do not share the personal information we collect with services operated by any other third party, except as described below.

We may use a third-party analytics service (Google Analytics) to provide insight into how users interact with various websites. This information is used to improve the user interfaces for these sites. The analytics service may set cookies within an end user’s web browser, and these cookies may contain an opaque identifier to uniquely identify the browser. In addition, the analytics service may collect anonymous information about an end user’s browser (such as display size, version, capabilities, etc). You may opt out of this tracking.

The login provider you use to authenticate with this proxy may set cookies and other information as described in their own privacy statements. That may also indirectly include information about how you use this service.

Corrections, objections, and deletion

You have the right to ensure the data we process is accurate. However, except in very limited circumstances, if there are errors in your personal information, you’d need to contact your home organisation’s help desk and/or make those corrections in your account with your login provider.

If you have any objection to the way we process your personal information, or wish to request specific information be deleted, you should cease use of the SA NREN Login Proxy and contact TENET's information officers.

Information officers

TENET’s information officers (data protection officers) can be reached via email at dpo@tenet.ac.za.