Privacy Policy || School Connect

PRIVACY POLICY – SCHOOL CONNECT (PTY) LTD
Last updated: 01 November 2025

1. Who we are and scope of this Policy

This Privacy Policy explains how School Connect (Pty) Ltd (“School Connect”, “we”, “us”, “our”) collects, uses, discloses and protects personal information when you:

visit or use our website at school-connect.co.za
use the School Connect web portal and mobile applications;
interact with our customer support or sales teams; or
use our communication and payment platform as a school, learner, parent/guardian or staff member.

This Policy is designed to comply with South African privacy law, in particular:

the Protection of Personal Information Act 4 of 2013 (“POPIA”);
applicable provisions of the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”), especially for online services and electronic communications.

By using our website, platform or apps, or by providing us with your personal information, you acknowledge that you have read this Policy and agree to its terms.

If you do not agree with this Policy, please do not use our Services and contact us with your concerns.

2. Our role under POPIA

Under POPIA, the following roles are important:

“Responsible Party” – the person or organisation that determines why and how personal information is processed (similar to a “data controller”).
“Operator” – a person or organisation that processes personal information on behalf of a Responsible Party.
“Data Subject” – the natural or juristic person to whom the personal information relates.

Because School Connect is a SaaS platform used by schools, our role changes depending on context:

For our own business operations
When we collect information about schools, their representatives, visitors to our website, and prospective customers (e.g. for billing, support and marketing), School Connect is the Responsible Party.
For learner, parent/guardian and staff data captured by schools in the platform

- The school using School Connect is usually the Responsible Party.
- School Connect acts as an Operator, processing personal information on the school’s instructions and in terms of our agreement with the school.

Schools must ensure they have the necessary authority, consent and notices in place for uploading and managing personal information in School Connect. We support them in meeting their POPIA obligations, but they remain primarily responsible for their own compliance.

3. The information we collect

Because School Connect is a school management, communication and payment platform, we process several categories of personal information.

3.1 Website visitors and general enquiries

When you browse the website or contact us via online forms or email, we may collect:

Identification and contact details: name, email address, mobile number, school name and role, and any details you include in your message.
Usage and technical data: IP address, browser type, device type, operating system, pages viewed, time spent, referring URLs, and similar analytics information.
Cookie and tracking data: information collected via cookies and similar technologies (see section 7 below).

3.2 Schools and school representatives (customers / prospects)

For people who register a school or manage a school account:

Name and contact details (e.g. name, mobile number, email address);
School details (school name, address, tagline, rules, regulations, policies, billing details);
Subscription and package details, invoices and payment records;
Communications with us (support requests, meeting notes, feedback).

3.3 Learners (students)

Depending on how the school uses the platform, we may process:

Basic identity details: name, learner ID, date of birth, gender;
Contact details (where applicable): email, mobile number;
Academic and administrative data: grade, class, timetable, attendance, assignments, exam results, certificates, ID cards;(staging.school-connect.co.za)
Behavioural / disciplinary records, if captured by the school;
Media: photographs or images used in IDs, certificates or the school gallery.

3.4 Parents / guardians

For parents and guardians, the platform may process:

Identity and contact details: name, relationship to the learner, mobile numbers, email address, residential address;
Communication records: messages, announcements, responses and read-status via the School Connect app or portal;(staging.school-connect.co.za)
Payment and billing details: fee invoices, payment history, wallet balances and transaction references (see 3.6 below).

3.5 Teachers, staff and administrators

For school staff, including teachers and non-teaching staff:

Identity and contact details;
Employment-related information maintained in the system (e.g. role, department, payroll records where configured, leave details);
System usage information (such as logins, actions taken within the admin panel).

3.6 Payments and digital wallet

School Connect supports a digital wallet and fee payments. In this context we may process:

Payment details supplied by parents or schools (e.g. limited card details, tokenised card references, payment method, transaction dates and amounts);
Wallet information: balances, top-ups, transfers, and transaction history;
Billing and invoicing information for schools.

We typically rely on third-party payment processors who handle the full card or banking details in compliance with their own security standards. School Connect does not generally store full card numbers or CVV codes.

3.7 Special personal information and children’s information

Under POPIA, some categories of information are “special personal information” (such as health information, religious beliefs, race, biometric data) and receive heightened protection.(Carbide)

Because School Connect is a school platform, some schools may record limited information about:

learner health (e.g. allergies, medical alerts);
religious or language preferences relevant to school activities;
other sensitive information necessary for the proper management of the learner’s education.

Schools must ensure they have a lawful basis and appropriate safeguards for capturing special personal information and children’s information. We process this as an Operator, following their instructions and securing it appropriately.

4. How we collect personal information

We collect personal information in the following ways:

Directly from you

When you complete the “Create School” or contact forms on our website;
When you sign up or log in to the School Connect portal or app;
When you communicate with us by phone, email, support ticket or in-app chat.

Through schools using our platform

- Schools upload or capture learner, parent, staff and fee data directly into School Connect;
- We process that information on their behalf.

Automatically through our systems

- When you access the platform, we log usage and technical information (see 3.1 above);
- We use cookies and similar technologies (see section 7).

From third parties

- Payment processors and banks may send us payment confirmations;
- Service providers (e.g. SMS, email and push notification providers) may send delivery reports or error logs;
- In some cases, a school may provide information about you (e.g. a parent’s details).

5. Legal basis for processing under POPIA

POPIA allows personal information to be processed where one or more of the following grounds apply: consent, contractual necessity, legal obligation, protection of legitimate interests, public law duty, or legitimate interest of the Responsible Party or a third party (subject to data subject rights).(POPIA)

We rely on these grounds as appropriate, including:

Consent – for example, where a parent or guardian consents to the school or School Connect sending direct marketing communications, or where cookies are not strictly necessary.
Contractual necessity – where processing is needed to create and manage your account, deliver the platform functionality and process payments.
Legal obligations – where we must retain certain information for tax, accounting, regulatory or education-related legal requirements.
Legitimate interests – such as improving our services, preventing fraud, supporting schools’ educational and administrative functions, or defending legal claims, provided these do not override your privacy rights.

When we act as Operator for a school, we process information strictly in line with the school’s documented instructions and the contract between us.

6. How we use personal information

We use personal information for the following purposes:

6.1 To provide and operate the platform

Registering schools and creating school profiles;
Creating and managing user accounts for school admins, teachers, staff, parents/guardians and learners (where applicable);
Managing academic and administrative features (students, teachers, timetable, exams, assignments, fees, announcements, attendance, certificates, gallery, payroll, staff leave, etc.);
Enabling chat, notifications and other forms of communication between the school and parents;
Facilitating payments and digital wallet transactions.

6.2 To communicate with you

Responding to enquiries and support tickets;
Sending platform alerts, system notifications, password resets and transactional emails;
Communicating with schools about product updates, maintenance windows and security notices.

6.3 To secure and maintain our Services

Monitoring, logging and analysing usage to detect and prevent unauthorised access, fraud and misuse;
Troubleshooting, testing and improving the platform performance and reliability;
Implementing technical and organisational security measures as required under POPIA (e.g. access controls, encryption, backups, audits).

6.4 To comply with legal and regulatory obligations

Keeping records required by tax, corporate and financial regulations;
Responding to lawful requests from regulators, law enforcement and courts, where permitted or required by law (including POPIA, ECTA and other applicable laws).

6.5 To conduct analytics, product development and marketing (within the law)

Analysing aggregated or de-identified usage data to improve features and user experience;
Conducting surveys or feedback initiatives with schools and parents;
Sending information to schools about new features or offerings, subject to consent and POPIA’s rules on direct marketing (including opt-out options).

We do not sell your personal information.

7. Cookies and similar technologies

Our website and platform use cookies and similar technologies to:

remember your preferences and logged-in sessions;
keep the site secure;
perform analytics to understand how visitors use the site;
support marketing and product improvement (where consented).

Some cookies are “strictly necessary” for the site to function and are set without consent. Others (such as analytics or marketing cookies) are only used where required and, where applicable, based on your browser settings or consent.

You can manage cookies by:

adjusting your browser settings to block or delete cookies; or
using any cookie management tools or banners we provide.

Please note that disabling certain cookies may affect website or app functionality.

8. Sharing of personal information

We may share personal information with:

Schools using the platform

- Parents, learners and staff interact primarily with their own school through School Connect;
- The school can view and manage the personal information of learners, parents and staff that it has captured within its instance.

Our service providers (Operators under POPIA)
We use carefully selected third-party service providers to deliver parts of our Services, for example:
- hosting and infrastructure providers;
- payment processors;
- SMS, email, push notification and chat providers;
- analytics and error-logging tools;
- security, backup and maintenance providers.
These service providers are contractually required to:

- only process personal information for our documented purposes;
- implement appropriate security measures; and
- comply with POPIA or equivalent data protection standards.

Professional advisers and group entities

- Legal advisers, auditors, accountants and insurers, where necessary and subject to confidentiality;
- Related companies or affiliates involved in providing or supporting School Connect.

Authorities and legal recipients

We may disclose information where required by law or where we reasonably believe it is necessary to:

- comply with a legal obligation or court order;
- respond to requests from law enforcement or regulators;
- protect our rights, property or safety, or that of users or others;
- investigate and prevent fraud or security incidents.

Business transfers

If we are involved in a merger, acquisition, restructuring or sale of some or all of our assets, personal information may be transferred as part of that transaction. We will ensure any recipient honours this Policy or a policy that is substantially similar.

We do not share personal information with third parties for their own independent direct marketing, without your explicit consent.

9. Cross-border transfers of personal information

School Connect’s infrastructure and service providers may be located inside or outside South Africa. Where personal information is transferred across borders, we will comply with section 72 of POPIA, which permits such transfers only if certain safeguards are in place (for example, an adequate level of protection in the recipient country, contractual protections, or the data subject’s consent).

This may include:

using data centres or cloud services in other jurisdictions;
using international payment gateways or messaging providers.

Where we act as an Operator for a school, we will follow the school’s instructions and ensure that any cross-border transfers for which we are responsible meet POPIA’s requirements.

10. Security safeguards

We take reasonable and appropriate technical and organisational measures to secure personal information against loss, unauthorised access, disclosure, alteration or destruction, as required by POPIA’s Security Safeguards condition.

Measures include, for example:

encryption of data in transit (e.g. HTTPS);
role-based access control and authentication;
logging and monitoring of access to key systems;
secure development and change management practices;
regular backups and recovery procedures;
contractual and confidentiality obligations for staff and service providers;
periodic security reviews and improvements.

No system can be guaranteed 100% secure. However, we are committed to responding promptly to security issues and to complying with POPIA’s requirements for notification of security compromises where applicable.

11. Data retention

We retain personal information only for as long as reasonably necessary:

for the purposes set out in this Policy;
to comply with legal, regulatory, tax or accounting requirements;
to enforce or defend legal rights; or
as agreed with the school (where we act as Operator).

In practice, this means:

School accounts and related data are kept while the school’s subscription is active and for a reasonable period thereafter (e.g. to allow export, to resolve disputes or to comply with record-keeping laws).
Learner, parent and staff data may be archived or deleted according to the school’s own retention policies and instructions, and subject to legal requirements in the education sector.
Where POPIA or other laws require us to destroy or de-identify records no longer needed, we will do so in a manner that prevents reconstruction in an intelligible form.(inforegulator.org.za)

12. Children’s information

School Connect is mainly used by schools and parents/guardians, but it involves the processing of children’s personal information (learners). POPIA places special restrictions on processing the personal information of children and on certain categories of “special” personal information.

To address this:

We expect schools to obtain any required consent from parents or competent persons, and to provide appropriate privacy notices to learners and parents.
We process learner data strictly for educational, administrative and safety-related purposes as configured by the school.
We do not knowingly allow children to create independent accounts on the platform without the involvement of their school and/or parent/guardian.

If you believe that we have collected personal information directly from a child without proper authorisation, please contact us so that we can investigate and take appropriate action.

13. Your rights as a Data Subject

Under POPIA, you have various rights in relation to your personal information, including rights of:(POPIA)

Access – to request confirmation of whether we hold personal information about you and, if so, to obtain a copy.
Correction – to request that we correct or update personal information that is inaccurate, incomplete, misleading or out of date.
Deletion / destruction – in certain circumstances, to request deletion or destruction of personal information that we are no longer authorised to retain.
Objection – to object, on reasonable grounds relating to your particular situation, to our processing of your personal information, including for direct marketing.
Withdrawal of consent – where processing is based on consent, to withdraw that consent (which will not affect prior lawful processing).
Lodging a complaint – to complain to the Information Regulator if you believe your rights under POPIA have been infringed.

Because we often process your information on behalf of a school, some requests may need to be handled through the school as the Responsible Party. In such cases, we will direct you to the school and support them in responding to your request.

How to exercise your rights

To exercise any of your rights, please contact us using the details in section 15 below. We may need to verify your identity and may charge a reasonable fee for providing copies of records, as permitted by law.

14. Direct marketing

We may send direct marketing communications (such as email newsletters, product updates or promotions):

to schools and their representatives, based on our legitimate interests and the relationship with our customers; or
to individuals where we have obtained the necessary consent or where permitted by POPIA (for example, existing customers offered similar services with an opt-out).(Wikipedia)

You may:

opt out of electronic marketing at any time by using the “unsubscribe” or “opt-out” options in the message; or
contact us directly to update your marketing preferences.

We do not send direct marketing messages to learners.

15. Third-party websites, apps and content

Our website and platform may contain links to third-party websites, apps or services (for example, app stores, payment providers, or social media pages). These third parties have their own privacy policies and practices.

We are not responsible for the privacy practices of third-party sites or services. We encourage you to review their policies before providing them with personal information.

16. Changes to this Policy

We may update this Privacy Policy from time to time to reflect:

changes in our Services;
changes in law, guidance or regulatory expectations (for example, updates from the Information Regulator or new POPIA regulations);(inforegulator.org.za)
improvements to our privacy and security practices.

When we make material changes, we will:

post the updated Policy on our website; and
update the “Last updated” date at the top of the document.

We encourage you to review this Policy regularly. Continued use of the Services after changes are published will be taken as acceptance of the updated Policy.

17. Contact us (Responsible Party / Information Officer)

School Connect (Pty) Ltd
Registered in South Africa
Physical address: 14 Church Street, Durbanville, 7550, South Africa (as published on our website)

General enquiries & privacy requests

Email: info@school-connect.co.za
Telephone: as published on our website contact page.

If you have any questions about this Policy, or if you would like to exercise your data-subject rights, please contact us. Where appropriate we will also work with your school as the Responsible Party.

18. Contacting the Information Regulator

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator (South Africa).(inforegulator.org.za)

As at the date of this Policy, the Regulator can be contacted using the contact details published on its official website:

Website: inforegulator.org.za
Tel: +27 (0)10 023 5200
Email (general enquiries): enquiries@inforegulator.org.za

You can also find POPIA complaint forms and guidance on the Regulator’s website.

19. Legal notice and disclaimer

This Privacy Policy is intended to provide information about how School Connect (Pty) Ltd handles personal information in line with POPIA, ECTA and other applicable South African laws. It does not constitute legal advice, and we recommend that schools and other users obtain their own independent legal advice on their POPIA and PAIA obligations.