Resolute Education

Privacy Policy

INTRODUCTION:
1. This Privacy Policy describes how RESOLUTE EDUCATION (PROPRIETARY) LIMITED trading as Resolute Education, including its subsidiaries, affiliates and associates, its holding companies and the subsidiaries, affiliates and/or associates of such holding companies (collectively referred to as “the Company”, “we”, “our” or “us”), processes personal information (as defined by the Protection of Personal Information Act No. 4 of 2013 (“POPIA”)) and personal data (as defined by the General Data Protection Regulation (EU) 2016/679 (“GDPR”)).
2. In accordance with POPIA, we act as the “Responsible Party” where we determine the purpose of and means for processing personal information. For the purposes of the GDPR, we act as the “Data Controller” where we determine the purpose of and means for processing personal data.
3. This Privacy Policy applies to all interactions where you entrust us with information relating to an identifiable, living natural person or, where applicable, an identifiable existing juristic person, including when you interact with us in person, virtually, electronically or otherwise, or when you make use of our products, services, learning platforms, websites, social media pages or any other online platforms that we own, operate or manage (collectively, “Sites”).
4. We understand that privacy is a significant responsibility, especially in an educational environment. We are committed to transparency, accountability, security, and the protection of children’s rights in all of our data processing activities.
5. This Privacy Policy is meant to help you understand what information we collect, why we collect it, the lawful bases upon which we rely, and how you can take control of your personal information and/or personal data and the way in which we process, update, manage, delete, store, share or otherwise use same.
INTERPRETATION AND DEFINITIONS
1. Words that are defined in POPIA and used in this Privacy Policy will bear the same meaning as in POPIA, unless the context requires otherwise.
2. Reference to “consent” shall, where consent is the applicable lawful basis, include any freely given, specific, informed and unambiguous indication of your wishes by which you, by a statement or clear affirmative action, signify agreement to the processing of your personal information and/or personal data. Consent may be given in writing, electronically, by clicking an “I Agree” button, by subscribing, submitting or sending a message, updating a profile, or by any other lawful means that clearly conveys your acceptance.
3. Reference to “written” or “in writing” shall include writing as defined in section 12 of the Electronic Communications and Transactions Act No. 25 of 2002, as amended from time to time, and any equivalent electronic record recognised by applicable law.
4. Any reference to the singular shall include the plural, and any reference to a certain gender shall include any other gender.
5. “Personal Data” shall be understood to have the same meaning as “Personal Information” as defined in section 1 of POPIA, referring to any information relating to an identified or identifiable natural person (“Data Subject”).
6. “Data Subject” refers to the person to whom personal information or personal data relates, including natural persons and, under POPIA, existing juristic persons.
7. “Data Controller” or “Responsible Party” refers to the entity which, alone or jointly with others, determines the purposes and means of processing personal information and/or personal data.
8. “Data Processor” or “Operator” refers to an entity processing personal information and/or personal data on behalf of the Data Controller or Responsible Party.
9. “Special Categories of Personal Data” or “Special Personal Information” refers to information regarding a person’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour, and any other category that receives special protection under applicable law.
10. “Child” means a natural person under the age of 18 years for the purposes of POPIA. For GDPR purposes, child-related consent requirements are applied in accordance with the relevant EU or EEA Member State age threshold.
11. “Processing” includes any operation or activity concerning personal information and/or personal data, including collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, use, dissemination, merging, linking, restriction, erasure, destruction, or any other operation contemplated by POPIA or the GDPR.
SECURING YOUR PERSONAL INFORMATION
1. In adopting this Privacy Policy, we wish to balance our legitimate business interests, our educational purpose, our legal obligations, and your reasonable expectation of privacy.
2. We will take appropriate and reasonable technical and organisational measures to prevent loss, damage, unauthorised access to, unauthorised disclosure of, unlawful processing of, or unlawful destruction of your personal information and/or personal data. However, no method of transmission over the internet, or method of electronic or physical storage, can be guaranteed to be 100% secure.
3. Where there are reasonable grounds to believe that your personal information has been accessed or acquired by any unauthorised person, we will notify you and, where required, the Information Regulator appointed in terms of POPIA. Where the GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
4. We may delay notifying you of unauthorised access to, or acquisition of, your personal information if a public body responsible for the prevention, detection or investigation of offences, or the Information Regulator, determines that notification will impede a criminal investigation, or if such notification would constitute a breach of any applicable law.
5. When we notify you of a compromise to the security of your personal information, we will, to the best of our capabilities and as required by applicable law, provide sufficient information to allow you to take protective measures against the potential consequences of the compromise.
6. We require our Operators, Data Processors and service providers who process personal information on our behalf to process such information only on our instructions, to keep it confidential, and to implement appropriate security measures through written agreements or other legally binding arrangements.
CONSENT
1. We do not rely on consent for all processing activities. We may process your personal information and/or personal data on any lawful basis permitted by POPIA and/or the GDPR, including consent, contract, legal obligation, legitimate interests, vital interests, public interest, or the performance of a public law duty, as set out in clause 5 below.
2. Where we rely on your consent, such consent must be clear, affirmative, voluntary, specific and informed. You may withdraw consent at any time, provided that withdrawal shall not affect the lawfulness of processing that occurred before the withdrawal, nor any processing that we are required or permitted to continue under applicable law.
3. If you do not agree with this Privacy Policy, or if you withhold or withdraw consent where consent is required, we might not be able to interact with you or provide you with all our products, services, Sites or support.
4. Where the processing relates to a child, consent must be obtained from a parent, legal guardian or other competent person where required by applicable law, and we will take reasonable steps to verify that such person has authority to provide consent.

LAWFUL BASES FOR PROCESSING PERSONAL INFORMATION

We process your personal information and/or personal data only where we have a valid legal basis under GDPR Article 6 and POPIA Condition 2. These bases include, without limitation, the following:
1. Contractual Necessity: Processing is necessary to fulfil our obligations under a contract with you or to take pre-contractual steps at your request, including providing access to our learning platforms, products, services, support and account functionality.
2. Consent: You have given us clear, affirmative and voluntary consent for a specific purpose, including receiving promotional updates, newsletters, optional communications, or the use of non-essential cookies where applicable.
3. Legal Obligation: Processing is necessary for us to comply with the law, including keeping tax records, accounting records, statutory records, child-safety records or other records required by law.
4. Legitimate Interests: Processing is necessary for our legitimate business, educational, security, administrative or operational interests, provided that these interests are not overridden by your privacy rights, fundamental rights or freedoms. This includes analysing site usage to improve our curriculum, maintaining the security of our IT systems, preventing fraud, and improving our services.
5. Vital Interests: Processing is necessary to protect the life or safety of a Data Subject or another person.
6. Public Law Duty or Public Interest: Processing is necessary for the performance of a public law duty by a public body, or for a task carried out in the public interest, where applicable.

The following table summarises typical processing activities, categories of data and lawful bases. The table is not exhaustive and the actual lawful basis may vary depending on the specific context.

Processing Activity	Category of Data	GDPR Lawful Basis	POPIA Lawful Basis
Account Registration	Name, email address, username, password and account identifiers	Contractual necessity and/or consent	Performance of contract and/or consent
Curriculum Delivery	Grades, learner progress, course activity, assessments and platform usage	Contractual necessity, legitimate interests and/or consent where required	Performance of contract, legitimate interest and/or consent where required
Site and Platform Security	IP address, device identifiers, browser information, log data and access records	Legitimate interests and legal obligation	Legitimate interest, security safeguards and compliance with law
Email Marketing	Contact details and communication preferences	Consent and/or legitimate interests where permitted by law	Consent and direct marketing rules under POPIA
Financial Transactions	Billing details, banking details, tax information and payment records	Legal obligation and contractual necessity	Compliance with law and performance of contract
Child Learning Support	Learner profile, progress, assessment results and support requests	Contractual necessity, consent and/or legitimate interests with child-specific safeguards	Parental/competent person consent and other authorisations permitted by POPIA

VARIATION OF PRIVACY POLICY
1. We reserve the right to vary the terms of this Privacy Policy from time to time in order to reflect changes in our operations, legal obligations, technologies, services or regulatory requirements.
2. We will duly notify you of any material revisions to this Privacy Policy. We will not change this Privacy Policy in a manner that materially reduces your rights without your explicit consent where such consent is required by law.
3. If changes are significant, we will provide a more prominent notice, which may include email notification, website notification, platform notification or other reasonable notice, where necessary to enable you to choose whether or not to continue to interact with us or use our products, services or Sites.
4. It remains your responsibility to familiarise yourself with the most recent version of this Privacy Policy as we update same from time to time.
WHAT TYPE OF PERSONAL INFORMATION DO WE PROCESS
1. If you are an individual:
  1. The personal information that we may process includes information necessary for us to interact with you, provide products and/or services, provide access to our Sites, fulfil our legal and contractual obligations, and protect our legitimate business, educational and security interests.
  2. This may include, inter alia, name, surname, identification number, username, password, e-mail address, physical address, postal address, telephone number, online identifier, location information, device information, communication preferences, education information, assessment information, financial information, tax information, banking details, employment information, opinions, views, preferences, and other information that you choose to provide to us.
  3. Where strictly necessary and permitted by applicable law, we may process special personal information, including information relating to race, gender, sex, age, health, disability, language, culture, biometric information, criminal history or other protected categories. We will process such information only with the appropriate lawful basis and safeguards.
2. THE PROCESSING OF CHILDREN’S PERSONAL INFORMATION
  1. As an educational organisation, we place the highest priority on the protection of children’s personal information and/or personal data.
  2. The Best Interests Principle: In accordance with international law and regulatory guidance, the best interests of the child shall be the primary consideration in all decisions concerning the processing of their personal information. We do not process children’s data for commercial profiling or targeted advertising.
  3. Parental Consent and Age Thresholds: We do not knowingly collect personal information from children without the prior consent of a parent, legal guardian or other competent person where such consent is required by applicable law.
    1. In South Africa, parental or competent-person consent is required for the processing of personal information of children under the age of 18, unless another authorisation permitted by POPIA applies.
    2. In the EU/EEA, the age of digital consent varies by Member State, typically between 13 and 16. For children below the applicable threshold, we obtain verifiable parental consent using reasonable efforts and available technology where consent is the lawful basis relied upon.
  4. Verifiable Consent: We implement procedures to verify that the person granting consent actually holds parental responsibility or lawful authority for the child, which may include email confirmation, digital signature, school confirmation, account verification or other reasonable verification measures.
  5. Child-Friendly Transparency: Where appropriate, we provide summary notices written in clear, plain language that children can reasonably understand, helping them develop privacy literacy from an early age.
  6. Educational Use: Children’s personal information may be processed to provide learning materials, track progress, support educators, provide learner feedback, issue certificates, enable platform access, troubleshoot technical issues and improve educational outcomes, subject always to applicable safeguards.
3. If you are a company, trust, close corporation, school, public body, non-profit organisation or other legal entity:
  1. We may process information relating to the entity, including name, registration number, tax information, banking details, e-mail address, physical address, postal address, telephone number, contact persons, billing information, school information, procurement information, opinions, views or preferences.
4. If you make use of any of our products and/or services:
  1. We collect consent records, communications and other information you provide when you interact with us or make use of our products and/or services, whether in person, electronically, through a formal written agreement, purchase order, quotation, invoice, online platform, support request, training session or otherwise.
  2. We track interactions with our products and/or services for operational, educational, support, analytics, billing and legitimate business purposes. This may include the number of times you make use of our products and/or services, the types of products and services you view or engage with, the features you use, the actions you take, the employees or representatives you interact with, and the time, frequency and duration of your activities.
5. If you make use of our Sites:
  1. Passwords and Login Information. For use of our Sites, we may require you to register personal information with us via e-mail, via our Sites, or as otherwise communicated to you. If you register your personal information, you may create a username and password. You must not provide your username or password to anyone and you are responsible for keeping your username and password confidential.
  2. Communications and content. We collect consent records, communications and other information you provide when you interact with us, sign up for an account, create or share content, message us, submit support requests, complete assessments, complete forms, use platform functions or communicate with us via our Sites.
  3. Usage information. We collect information about how you interact with us or make use of our products, services and/or Sites, including pages viewed, content accessed, lessons completed, quizzes attempted, scores, IDE projects, training progress, certificates, clicks, actions taken, features used, frequency and duration of activities, and other usage data necessary to provide and improve our services.
  4. Device information. We may collect information from and about computers, phones, tablets and other devices used to access our Sites, including operating system, browser type, hardware and software versions, device identifiers, IP address, language, time zone, connection speed, crash data, log data, cookie data and other technical information reasonably necessary for security, troubleshooting, analytics and service delivery.
  5. Data from device settings. We may receive information that you allow us to receive through device settings that you turn on, such as access to location, camera, microphone, photos or files, only where such access is necessary for a specific function and permitted by applicable law.
  6. Information from partners and third-party services. We may receive information from service providers, payment processors, schools, implementation partners, analytics providers, hosting providers, support providers, content providers or other lawful third parties, provided that such parties have lawful grounds to collect, use and share such information with us.
6. We will limit the types and volume of personal information processed to what is adequate, relevant and not excessive for the purpose for which it is processed, or as otherwise allowed by law.
WHEN WILL WE PROCESS YOUR PERSONAL INFORMATION
1. Personal information and/or personal data may be processed by us when:
  1. you interact with us in any way or manner;
  2. you contract with us or do business with us in any way or manner;
  3. you visit, browse, register, subscribe, apply for, purchase, use or access our products, services and/or Sites;
  4. you register to receive notifications, marketing communications, support communications, authentication services or other communications from us;
  5. we provide educational content, training, assessments, certificates, support, implementation services, platform access or account administration;
  6. we carry out research, analytics, product development, quality assurance, troubleshooting, security testing or service improvement;
  7. processing is required or authorised by law, a regulator, a competent authority, a contract, a court order, or a lawful instruction;
  8. processing is in your best interest, in the best interests of a child, or necessary to protect vital interests; and
  9. processing is otherwise permitted under POPIA, GDPR or any other applicable law.
2. You acknowledge that personal information processed by us may be stored by us and used, inter alia, for any of the purposes listed in clause 9 below, subject to the lawful bases set out in clause 5 above.
HOW DO WE USE YOUR PERSONAL INFORMATION
1. We may use your personal information and/or personal data:
  1. to deliver, manage, support, improve and secure our products, services, Sites, courses, learning platforms, assessments, certificates and educational content;
  2. to interact and communicate with you in any way or manner, including responding to enquiries, support requests, complaints, rights requests and service communications;
  3. to enter into, administer, perform or enforce any contract, purchase order, quotation, invoice, service arrangement or other business relationship with you;
  4. to create, maintain, authenticate and secure user accounts, including login functionality, password management, access control and account recovery;
  5. to personalise educational features and content, make curriculum or learning suggestions, provide learner feedback, support educators and improve the relevance of our services, provided that we do not use children’s information for commercial profiling or targeted advertising;
  6. to develop, test, troubleshoot, quality assure and improve our products, services and/or Sites, including through surveys, analytics, research, user experience testing and product development;
  7. to provide measurement, analytics and operational reporting for schools, administrators, educators, parents, guardians and internal teams, where permitted by law and subject to applicable access controls;
  8. to process payments, invoices, refunds, credits, orders, procurement documentation, financial records, tax records and related administrative records;
  9. to promote safety, integrity and security, including preventing unauthorised access, spam, fraud, harmful conduct, misuse of our Sites, security incidents, unlawful activities or breaches of our terms and policies;
  10. to conduct credit, fraud, anti-corruption, sanctions or background checks where necessary, lawful and proportionate to the relevant relationship, transaction or legal obligation;
  11. to communicate with you about our policies, terms, products, services, training, updates, service changes, security notices and other administrative matters;
  12. to send marketing communications only where we have a lawful basis to do so and subject to your right to unsubscribe or object at any time;
  13. to comply with applicable laws, regulations, lawful requests, regulatory obligations, court orders, tax obligations, accounting obligations, child-protection obligations or other legal requirements;
  14. to conduct research and innovation for educational, technological and social good purposes, using de-identified, anonymised or aggregated information wherever reasonably possible and appropriate; and
  15. for any other purpose that is legally authorised, compatible with the purpose for which the information was collected, or permitted by applicable law.
WHERE WE STORE YOUR PERSONAL INFORMATION
1. All of the information you provide to us may be stored manually and/or electronically, including on secure cloud-based platforms, servers, databases, storage systems and business systems operated, maintained or protected in the Republic of South Africa (“RSA”) and/or other jurisdictions where our authorised service providers operate.
2. Where we have given you, or where you have chosen, a password that enables you to access certain parts of our Sites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Should you share your password with anyone, you indemnify us against any damages or third-party claims resulting from such sharing, to the extent permitted by law.
3. Data Retention and Storage Limitation: We do not retain personal information and/or personal data for longer than is necessary to achieve the purpose for which it was collected, unless:
  1. retention is required or authorised by law, including where financial, accounting or tax records must be retained for 7 years or another legally prescribed period;
  2. retention is required by a contract between the parties;
  3. the Data Subject, parent, guardian or competent person has consented to longer retention where such consent is valid and appropriate;
  4. retention is required for historical, statistical, educational, evidentiary, audit or research purposes, provided appropriate safeguards such as restriction, access control, aggregation, anonymisation or de-identification are in place; or
  5. retention is reasonably necessary for the establishment, exercise or defence of legal claims, dispute resolution, compliance, security investigations, audit purposes, or protection of the rights, property or safety of the Company, Data Subjects or third parties.
4. Retention periods are determined based on the nature of the data, the reason it was collected, legal and contractual obligations, operational requirements, the sensitivity of the information, and the potential risk of harm from unauthorised use or disclosure. Upon expiry of the applicable retention period, data is securely destroyed, deleted, anonymised or permanently de-identified.
5. Unfortunately, the transmission of information via the internet is not completely secure. We will use appropriate and reasonable technical and organisational measures to protect the information, but we cannot guarantee the security of information transmitted to our Sites or any other location by electronic means. Any transmission is at your own risk, subject to applicable law.
SHARING OF YOUR PERSONAL INFORMATION
1. We will not disclose your personal information and/or personal data to any person except where we have a lawful basis to do so, where you have consented where consent is required, where disclosure is necessary to provide our products or services, where disclosure is in the best interests of a child or Data Subject, or where we are required or authorised by law to do so.
2. You acknowledge that your personal information may be shared with:
  1. our holding companies, subsidiary companies, affiliates, associates, employees, contractors, consultants, agents, advisers, auditors, insurers, legal representatives and professional advisers;
  2. schools, educators, parents, guardians, administrators, implementation partners, training partners and other persons involved in the delivery or support of educational services, where lawful and appropriate;
  3. service providers, Operators, Data Processors, suppliers, hosting providers, cloud providers, payment processors, analytics providers, support providers, security providers, content providers and other authorised third parties who assist us in providing our products, services and Sites;
  4. credit bureaus, anti-corruption agencies, fraud prevention bodies, regulators, authorities, courts, law enforcement agencies or other public bodies where necessary, lawful and proportionate;
  5. a prospective or actual buyer, investor, funder, merger partner, successor in title or other recipient in the event of a business restructuring, sale, transfer, merger, acquisition, financing or change of control involving all or part of our business, provided appropriate safeguards are in place; and
  6. any other third party where disclosure is required or authorised by law, necessary to enforce our rights, necessary to protect the rights or safety of any person, or reasonably necessary for the purposes set out in this Privacy Policy.
3. Where we share personal information with Operators or Data Processors, we require them to process information only for authorised purposes, to keep it confidential, to implement appropriate security safeguards, and not to use it for their own independent purposes unless legally permitted.
4. We do not sell children’s personal information. We do not knowingly share children’s personal information for commercial profiling or targeted advertising.
INTERNATIONAL DATA TRANSFERS
1. Transfers from South Africa: Personal information may be transferred to and stored at destinations outside the RSA. We ensure that such transfers comply with section 72 of POPIA, meaning the recipient is subject to a law, binding corporate rules, binding agreement or other mechanism that provides an adequate level of protection substantially similar to POPIA, or that another transfer justification permitted by POPIA applies.
2. Transfers from the EU/EEA: If we process the personal data of individuals in the EU or EEA, such data may be transferred to our servers or authorised service providers in South Africa or other jurisdictions. As South Africa is considered a “third country” under the GDPR, we ensure that such transfers are governed by European Commission-approved Standard Contractual Clauses (“SCCs”), adequacy decisions where applicable, binding corporate rules, derogations for specific situations, or other valid transfer mechanisms that provide essentially equivalent protection.
3. You may request a copy of the safeguards we have in place for applicable international transfers by contacting our Information Officer, subject to the protection of confidential and commercially sensitive information.
YOUR RIGHTS
1. You have the right to be informed about the collection and processing of your personal information and/or personal data, including the purposes, lawful bases, retention, sharing and rights described in this Privacy Policy.
2. You have the right to establish whether we hold personal information and/or personal data about you and to request access to such information, subject to applicable legal requirements, identity verification, exemptions and limitations.
3. You have the right to request that we correct, update, destroy or delete personal information that we have processed where such information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, obtained unlawfully, no longer necessary, or where we are no longer authorised to retain it.
4. Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal, nor does it affect processing that we are required or permitted to continue under another lawful basis.
5. You have the right to object to the processing of your personal information at any time, on reasonable grounds relating to your particular situation, unless the processing is required or authorised by law or justified by compelling legitimate grounds.
6. You have the right to object to the processing of your personal information at any time if the processing is for purposes of direct marketing.
7. You have the right not to have your personal information processed for purposes of direct marketing by means of unsolicited electronic communications from third parties unknown to you, except as permitted by law.
8. Right to Object to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such processing is authorised by law, necessary for a contract, or based on explicit consent and subject to appropriate safeguards.
9. Right to Data Portability (GDPR): Where the GDPR applies, you have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format and to have that data transmitted to another controller without hindrance, where technically feasible and where the right applies.
10. Right to Restriction of Processing: You have the right to request that we restrict, block or suppress the processing of your personal information and/or personal data in certain circumstances, including where you contest the accuracy of the data, where processing is unlawful and you oppose deletion, or where we no longer need the data but you require it for legal claims.
11. You have the right to submit a complaint to the Information Regulator regarding an alleged interference with the protection of personal information processed in accordance with this Privacy Policy. EU/EEA residents also have the right to lodge a complaint with the competent EU/EEA supervisory authority.
12. You have the right to institute civil proceedings or seek other remedies regarding an alleged interference with the protection of your personal information and/or personal data, as provided for by applicable law.
13. Response Timelines: We will respond to your rights requests within a reasonable time as required by POPIA and, where the GDPR applies, within one month of receipt of the request, unless an extension is permitted by law due to the complexity or number of requests.
14. Requests relating to children’s personal information may need to be submitted or authorised by a parent, legal guardian or competent person, unless applicable law permits or requires the child to exercise the right directly.
USE OF COOKIES
1. Cookies are pieces of information that our Sites may transfer to a user’s device for record-keeping, functionality, analytics, security, preference management and related purposes. Cookies may make use of our Sites easier by saving preferences, supporting authentication, improving security, tracking technical performance and helping us understand usage patterns.
2. We may place cookies or similar technologies on your browser or device to store and sometimes track information about you, subject to applicable law.
3. Essential cookies may be used where necessary for the operation, security or functionality of our Sites. Non-essential cookies, including certain analytics, advertising or tracking cookies, will be used only where we have a lawful basis to do so, including consent where required.
4. While most browsers are initially set up to accept cookies, you can reset your browser to refuse all cookies or indicate when a cookie is being sent. Please note that some parts of our products, services and/or Sites may not function properly if cookies are refused.
5. If we maintain a separate cookie policy or cookie preference tool, you are to familiarise yourself with that policy and/or manage your preferences through that tool when you make use of our Sites from time to time.
BUSINESS PARTNERS AND/OR LINKS TO OTHER SITES
1. When you interact with us or use our products and/or services, you might be required to make use of the products and/or services of our business partners, service providers, platform providers or other third parties. These business partners may collect data or solicit personal information in accordance with their own privacy policies.
2. When you make use of or interact with our Sites, you could be directed to other sites or services that are beyond our control. These other sites may send their own cookies to you, collect data or solicit personal information.
3. We do not control the privacy policies or practices of independent third parties and cannot be held liable for the use thereof by you, except where applicable law imposes responsibility on us for processors, operators or service providers acting on our behalf.
4. Where a third party processes personal information on our behalf as an Operator or Data Processor, we will require appropriate contractual safeguards as contemplated in this Privacy Policy.
DIRECT MARKETING
1. We may process your personal information for the purposes of providing you with information regarding our products and/or services that may be of interest to you only where we have a lawful basis to do so, including consent where required by POPIA, GDPR, electronic communications law or other applicable law.
2. We do not process children’s personal information for commercial profiling or targeted advertising. Any communications relating to children’s educational services will be directed through appropriate adult channels, such as parents, guardians, schools or authorised educators, where appropriate.
3. You may unsubscribe from direct marketing for free at any time. If you are currently receiving marketing information from us which you would prefer not to receive in future, please unsubscribe using the unsubscribe function in the marketing communication or email us using the contact information provided in clause 17 below.
4. We will maintain records of marketing consents, unsubscribes and objections as necessary to comply with applicable law and to ensure that your preferences are honoured.
GOVERNANCE AND CONTACT INFORMATION
1. For any questions regarding this Privacy Policy, or to exercise your rights, please contact our designated officers:
  1. Information Officer / Data Protection Officer: Anya Sonnendecker
  2. Email address: [email protected]
2. Complaints to the South African Information Regulator may be lodged using the prescribed process and forms made available by the Information Regulator. The Information Regulator’s current contact details include:
  1. Complaints email: [email protected]
  2. General enquiries: [email protected]
  3. Telephone: 010 023 5200
  4. Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, South Africa
3. EU/EEA Data Subjects may also contact the competent supervisory authority in their country of residence, place of work, or place of alleged infringement.
4. Before lodging a complaint with a regulator, we encourage you to contact us first so that we may attempt to resolve your concern promptly and appropriately.
GENERAL
1. This Privacy Policy must be read together with any applicable terms and conditions, platform rules, agreements, forms, consent notices, cookie notices, child-friendly privacy summaries, data processing agreements and any other privacy notices that apply to specific products, services or Sites.
2. If there is a conflict between this Privacy Policy and a more specific privacy notice, data processing agreement or lawful written agreement, the more specific document will apply to the extent of the conflict, unless applicable law requires otherwise.
3. Nothing in this Privacy Policy limits any rights that cannot lawfully be limited under POPIA, the GDPR or any other applicable law.

INTRODUCTION:
1. This Privacy Policy describes how RESOLUTE EDUCATION (PROPRIETARY) LIMITED trading as Resolute Education, including its subsidiaries, affiliates and associates, its holding companies and the subsidiaries, affiliates and/or associates of such holding companies (collectively referred to as “the Company”, “we”, “our” or “us”), processes personal information (as defined by the Protection of Personal Information Act No. 4 of 2013 (“POPIA”)) and personal data (as defined by the General Data Protection Regulation (EU) 2016/679 (“GDPR”)).
2. In accordance with POPIA, we act as the “Responsible Party” where we determine the purpose of and means for processing personal information. For the purposes of the GDPR, we act as the “Data Controller” where we determine the purpose of and means for processing personal data.
3. This Privacy Policy applies to all interactions where you entrust us with information relating to an identifiable, living natural person or, where applicable, an identifiable existing juristic person, including when you interact with us in person, virtually, electronically or otherwise, or when you make use of our products, services, learning platforms, websites, social media pages or any other online platforms that we own, operate or manage (collectively, “Sites”).
4. We understand that privacy is a significant responsibility, especially in an educational environment. We are committed to transparency, accountability, security, and the protection of children’s rights in all of our data processing activities.
5. This Privacy Policy is meant to help you understand what information we collect, why we collect it, the lawful bases upon which we rely, and how you can take control of your personal information and/or personal data and the way in which we process, update, manage, delete, store, share or otherwise use same.
INTERPRETATION AND DEFINITIONS
1. Words that are defined in POPIA and used in this Privacy Policy will bear the same meaning as in POPIA, unless the context requires otherwise.
2. Reference to “consent” shall, where consent is the applicable lawful basis, include any freely given, specific, informed and unambiguous indication of your wishes by which you, by a statement or clear affirmative action, signify agreement to the processing of your personal information and/or personal data. Consent may be given in writing, electronically, by clicking an “I Agree” button, by subscribing, submitting or sending a message, updating a profile, or by any other lawful means that clearly conveys your acceptance.
3. Reference to “written” or “in writing” shall include writing as defined in section 12 of the Electronic Communications and Transactions Act No. 25 of 2002, as amended from time to time, and any equivalent electronic record recognised by applicable law.
4. Any reference to the singular shall include the plural, and any reference to a certain gender shall include any other gender.
5. “Personal Data” shall be understood to have the same meaning as “Personal Information” as defined in section 1 of POPIA, referring to any information relating to an identified or identifiable natural person (“Data Subject”).
6. “Data Subject” refers to the person to whom personal information or personal data relates, including natural persons and, under POPIA, existing juristic persons.
7. “Data Controller” or “Responsible Party” refers to the entity which, alone or jointly with others, determines the purposes and means of processing personal information and/or personal data.
8. “Data Processor” or “Operator” refers to an entity processing personal information and/or personal data on behalf of the Data Controller or Responsible Party.
9. “Special Categories of Personal Data” or “Special Personal Information” refers to information regarding a person’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour, and any other category that receives special protection under applicable law.
10. “Child” means a natural person under the age of 18 years for the purposes of POPIA. For GDPR purposes, child-related consent requirements are applied in accordance with the relevant EU or EEA Member State age threshold.
11. “Processing” includes any operation or activity concerning personal information and/or personal data, including collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, use, dissemination, merging, linking, restriction, erasure, destruction, or any other operation contemplated by POPIA or the GDPR.
SECURING YOUR PERSONAL INFORMATION
1. In adopting this Privacy Policy, we wish to balance our legitimate business interests, our educational purpose, our legal obligations, and your reasonable expectation of privacy.
2. We will take appropriate and reasonable technical and organisational measures to prevent loss, damage, unauthorised access to, unauthorised disclosure of, unlawful processing of, or unlawful destruction of your personal information and/or personal data. However, no method of transmission over the internet, or method of electronic or physical storage, can be guaranteed to be 100% secure.
3. Where there are reasonable grounds to believe that your personal information has been accessed or acquired by any unauthorised person, we will notify you and, where required, the Information Regulator appointed in terms of POPIA. Where the GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
4. We may delay notifying you of unauthorised access to, or acquisition of, your personal information if a public body responsible for the prevention, detection or investigation of offences, or the Information Regulator, determines that notification will impede a criminal investigation, or if such notification would constitute a breach of any applicable law.
5. When we notify you of a compromise to the security of your personal information, we will, to the best of our capabilities and as required by applicable law, provide sufficient information to allow you to take protective measures against the potential consequences of the compromise.
6. We require our Operators, Data Processors and service providers who process personal information on our behalf to process such information only on our instructions, to keep it confidential, and to implement appropriate security measures through written agreements or other legally binding arrangements.
CONSENT
1. We do not rely on consent for all processing activities. We may process your personal information and/or personal data on any lawful basis permitted by POPIA and/or the GDPR, including consent, contract, legal obligation, legitimate interests, vital interests, public interest, or the performance of a public law duty, as set out in clause 5 below.
2. Where we rely on your consent, such consent must be clear, affirmative, voluntary, specific and informed. You may withdraw consent at any time, provided that withdrawal shall not affect the lawfulness of processing that occurred before the withdrawal, nor any processing that we are required or permitted to continue under applicable law.
3. If you do not agree with this Privacy Policy, or if you withhold or withdraw consent where consent is required, we might not be able to interact with you or provide you with all our products, services, Sites or support.
4. Where the processing relates to a child, consent must be obtained from a parent, legal guardian or other competent person where required by applicable law, and we will take reasonable steps to verify that such person has authority to provide consent.

LAWFUL BASES FOR PROCESSING PERSONAL INFORMATION

We process your personal information and/or personal data only where we have a valid legal basis under GDPR Article 6 and POPIA Condition 2. These bases include, without limitation, the following:
1. Contractual Necessity: Processing is necessary to fulfil our obligations under a contract with you or to take pre-contractual steps at your request, including providing access to our learning platforms, products, services, support and account functionality.
2. Consent: You have given us clear, affirmative and voluntary consent for a specific purpose, including receiving promotional updates, newsletters, optional communications, or the use of non-essential cookies where applicable.
3. Legal Obligation: Processing is necessary for us to comply with the law, including keeping tax records, accounting records, statutory records, child-safety records or other records required by law.
4. Legitimate Interests: Processing is necessary for our legitimate business, educational, security, administrative or operational interests, provided that these interests are not overridden by your privacy rights, fundamental rights or freedoms. This includes analysing site usage to improve our curriculum, maintaining the security of our IT systems, preventing fraud, and improving our services.
5. Vital Interests: Processing is necessary to protect the life or safety of a Data Subject or another person.
6. Public Law Duty or Public Interest: Processing is necessary for the performance of a public law duty by a public body, or for a task carried out in the public interest, where applicable.

The following table summarises typical processing activities, categories of data and lawful bases. The table is not exhaustive and the actual lawful basis may vary depending on the specific context.

Processing Activity	Category of Data	GDPR Lawful Basis	POPIA Lawful Basis
Account Registration	Name, email address, username, password and account identifiers	Contractual necessity and/or consent	Performance of contract and/or consent
Curriculum Delivery	Grades, learner progress, course activity, assessments and platform usage	Contractual necessity, legitimate interests and/or consent where required	Performance of contract, legitimate interest and/or consent where required
Site and Platform Security	IP address, device identifiers, browser information, log data and access records	Legitimate interests and legal obligation	Legitimate interest, security safeguards and compliance with law
Email Marketing	Contact details and communication preferences	Consent and/or legitimate interests where permitted by law	Consent and direct marketing rules under POPIA
Financial Transactions	Billing details, banking details, tax information and payment records	Legal obligation and contractual necessity	Compliance with law and performance of contract
Child Learning Support	Learner profile, progress, assessment results and support requests	Contractual necessity, consent and/or legitimate interests with child-specific safeguards	Parental/competent person consent and other authorisations permitted by POPIA

VARIATION OF PRIVACY POLICY
1. We reserve the right to vary the terms of this Privacy Policy from time to time in order to reflect changes in our operations, legal obligations, technologies, services or regulatory requirements.
2. We will duly notify you of any material revisions to this Privacy Policy. We will not change this Privacy Policy in a manner that materially reduces your rights without your explicit consent where such consent is required by law.
3. If changes are significant, we will provide a more prominent notice, which may include email notification, website notification, platform notification or other reasonable notice, where necessary to enable you to choose whether or not to continue to interact with us or use our products, services or Sites.
4. It remains your responsibility to familiarise yourself with the most recent version of this Privacy Policy as we update same from time to time.
WHAT TYPE OF PERSONAL INFORMATION DO WE PROCESS
1. If you are an individual:
  1. The personal information that we may process includes information necessary for us to interact with you, provide products and/or services, provide access to our Sites, fulfil our legal and contractual obligations, and protect our legitimate business, educational and security interests.
  2. This may include, inter alia, name, surname, identification number, username, password, e-mail address, physical address, postal address, telephone number, online identifier, location information, device information, communication preferences, education information, assessment information, financial information, tax information, banking details, employment information, opinions, views, preferences, and other information that you choose to provide to us.
  3. Where strictly necessary and permitted by applicable law, we may process special personal information, including information relating to race, gender, sex, age, health, disability, language, culture, biometric information, criminal history or other protected categories. We will process such information only with the appropriate lawful basis and safeguards.
2. THE PROCESSING OF CHILDREN’S PERSONAL INFORMATION
  1. As an educational organisation, we place the highest priority on the protection of children’s personal information and/or personal data.
  2. The Best Interests Principle: In accordance with international law and regulatory guidance, the best interests of the child shall be the primary consideration in all decisions concerning the processing of their personal information. We do not process children’s data for commercial profiling or targeted advertising.
  3. Parental Consent and Age Thresholds: We do not knowingly collect personal information from children without the prior consent of a parent, legal guardian or other competent person where such consent is required by applicable law.
    1. In South Africa, parental or competent-person consent is required for the processing of personal information of children under the age of 18, unless another authorisation permitted by POPIA applies.
    2. In the EU/EEA, the age of digital consent varies by Member State, typically between 13 and 16. For children below the applicable threshold, we obtain verifiable parental consent using reasonable efforts and available technology where consent is the lawful basis relied upon.
  4. Verifiable Consent: We implement procedures to verify that the person granting consent actually holds parental responsibility or lawful authority for the child, which may include email confirmation, digital signature, school confirmation, account verification or other reasonable verification measures.
  5. Child-Friendly Transparency: Where appropriate, we provide summary notices written in clear, plain language that children can reasonably understand, helping them develop privacy literacy from an early age.
  6. Educational Use: Children’s personal information may be processed to provide learning materials, track progress, support educators, provide learner feedback, issue certificates, enable platform access, troubleshoot technical issues and improve educational outcomes, subject always to applicable safeguards.
3. If you are a company, trust, close corporation, school, public body, non-profit organisation or other legal entity:
  1. We may process information relating to the entity, including name, registration number, tax information, banking details, e-mail address, physical address, postal address, telephone number, contact persons, billing information, school information, procurement information, opinions, views or preferences.
4. If you make use of any of our products and/or services:
  1. We collect consent records, communications and other information you provide when you interact with us or make use of our products and/or services, whether in person, electronically, through a formal written agreement, purchase order, quotation, invoice, online platform, support request, training session or otherwise.
  2. We track interactions with our products and/or services for operational, educational, support, analytics, billing and legitimate business purposes. This may include the number of times you make use of our products and/or services, the types of products and services you view or engage with, the features you use, the actions you take, the employees or representatives you interact with, and the time, frequency and duration of your activities.
5. If you make use of our Sites:
  1. Passwords and Login Information. For use of our Sites, we may require you to register personal information with us via e-mail, via our Sites, or as otherwise communicated to you. If you register your personal information, you may create a username and password. You must not provide your username or password to anyone and you are responsible for keeping your username and password confidential.
  2. Communications and content. We collect consent records, communications and other information you provide when you interact with us, sign up for an account, create or share content, message us, submit support requests, complete assessments, complete forms, use platform functions or communicate with us via our Sites.
  3. Usage information. We collect information about how you interact with us or make use of our products, services and/or Sites, including pages viewed, content accessed, lessons completed, quizzes attempted, scores, IDE projects, training progress, certificates, clicks, actions taken, features used, frequency and duration of activities, and other usage data necessary to provide and improve our services.
  4. Device information. We may collect information from and about computers, phones, tablets and other devices used to access our Sites, including operating system, browser type, hardware and software versions, device identifiers, IP address, language, time zone, connection speed, crash data, log data, cookie data and other technical information reasonably necessary for security, troubleshooting, analytics and service delivery.
  5. Data from device settings. We may receive information that you allow us to receive through device settings that you turn on, such as access to location, camera, microphone, photos or files, only where such access is necessary for a specific function and permitted by applicable law.
  6. Information from partners and third-party services. We may receive information from service providers, payment processors, schools, implementation partners, analytics providers, hosting providers, support providers, content providers or other lawful third parties, provided that such parties have lawful grounds to collect, use and share such information with us.
6. We will limit the types and volume of personal information processed to what is adequate, relevant and not excessive for the purpose for which it is processed, or as otherwise allowed by law.
WHEN WILL WE PROCESS YOUR PERSONAL INFORMATION
1. Personal information and/or personal data may be processed by us when:
  1. you interact with us in any way or manner;
  2. you contract with us or do business with us in any way or manner;
  3. you visit, browse, register, subscribe, apply for, purchase, use or access our products, services and/or Sites;
  4. you register to receive notifications, marketing communications, support communications, authentication services or other communications from us;
  5. we provide educational content, training, assessments, certificates, support, implementation services, platform access or account administration;
  6. we carry out research, analytics, product development, quality assurance, troubleshooting, security testing or service improvement;
  7. processing is required or authorised by law, a regulator, a competent authority, a contract, a court order, or a lawful instruction;
  8. processing is in your best interest, in the best interests of a child, or necessary to protect vital interests; and
  9. processing is otherwise permitted under POPIA, GDPR or any other applicable law.
2. You acknowledge that personal information processed by us may be stored by us and used, inter alia, for any of the purposes listed in clause 9 below, subject to the lawful bases set out in clause 5 above.
HOW DO WE USE YOUR PERSONAL INFORMATION
1. We may use your personal information and/or personal data:
  1. to deliver, manage, support, improve and secure our products, services, Sites, courses, learning platforms, assessments, certificates and educational content;
  2. to interact and communicate with you in any way or manner, including responding to enquiries, support requests, complaints, rights requests and service communications;
  3. to enter into, administer, perform or enforce any contract, purchase order, quotation, invoice, service arrangement or other business relationship with you;
  4. to create, maintain, authenticate and secure user accounts, including login functionality, password management, access control and account recovery;
  5. to personalise educational features and content, make curriculum or learning suggestions, provide learner feedback, support educators and improve the relevance of our services, provided that we do not use children’s information for commercial profiling or targeted advertising;
  6. to develop, test, troubleshoot, quality assure and improve our products, services and/or Sites, including through surveys, analytics, research, user experience testing and product development;
  7. to provide measurement, analytics and operational reporting for schools, administrators, educators, parents, guardians and internal teams, where permitted by law and subject to applicable access controls;
  8. to process payments, invoices, refunds, credits, orders, procurement documentation, financial records, tax records and related administrative records;
  9. to promote safety, integrity and security, including preventing unauthorised access, spam, fraud, harmful conduct, misuse of our Sites, security incidents, unlawful activities or breaches of our terms and policies;
  10. to conduct credit, fraud, anti-corruption, sanctions or background checks where necessary, lawful and proportionate to the relevant relationship, transaction or legal obligation;
  11. to communicate with you about our policies, terms, products, services, training, updates, service changes, security notices and other administrative matters;
  12. to send marketing communications only where we have a lawful basis to do so and subject to your right to unsubscribe or object at any time;
  13. to comply with applicable laws, regulations, lawful requests, regulatory obligations, court orders, tax obligations, accounting obligations, child-protection obligations or other legal requirements;
  14. to conduct research and innovation for educational, technological and social good purposes, using de-identified, anonymised or aggregated information wherever reasonably possible and appropriate; and
  15. for any other purpose that is legally authorised, compatible with the purpose for which the information was collected, or permitted by applicable law.
WHERE WE STORE YOUR PERSONAL INFORMATION
1. All of the information you provide to us may be stored manually and/or electronically, including on secure cloud-based platforms, servers, databases, storage systems and business systems operated, maintained or protected in the Republic of South Africa (“RSA”) and/or other jurisdictions where our authorised service providers operate.
2. Where we have given you, or where you have chosen, a password that enables you to access certain parts of our Sites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Should you share your password with anyone, you indemnify us against any damages or third-party claims resulting from such sharing, to the extent permitted by law.
3. Data Retention and Storage Limitation: We do not retain personal information and/or personal data for longer than is necessary to achieve the purpose for which it was collected, unless:
  1. retention is required or authorised by law, including where financial, accounting or tax records must be retained for 7 years or another legally prescribed period;
  2. retention is required by a contract between the parties;
  3. the Data Subject, parent, guardian or competent person has consented to longer retention where such consent is valid and appropriate;
  4. retention is required for historical, statistical, educational, evidentiary, audit or research purposes, provided appropriate safeguards such as restriction, access control, aggregation, anonymisation or de-identification are in place; or
  5. retention is reasonably necessary for the establishment, exercise or defence of legal claims, dispute resolution, compliance, security investigations, audit purposes, or protection of the rights, property or safety of the Company, Data Subjects or third parties.
4. Retention periods are determined based on the nature of the data, the reason it was collected, legal and contractual obligations, operational requirements, the sensitivity of the information, and the potential risk of harm from unauthorised use or disclosure. Upon expiry of the applicable retention period, data is securely destroyed, deleted, anonymised or permanently de-identified.
5. Unfortunately, the transmission of information via the internet is not completely secure. We will use appropriate and reasonable technical and organisational measures to protect the information, but we cannot guarantee the security of information transmitted to our Sites or any other location by electronic means. Any transmission is at your own risk, subject to applicable law.
SHARING OF YOUR PERSONAL INFORMATION
1. We will not disclose your personal information and/or personal data to any person except where we have a lawful basis to do so, where you have consented where consent is required, where disclosure is necessary to provide our products or services, where disclosure is in the best interests of a child or Data Subject, or where we are required or authorised by law to do so.
2. You acknowledge that your personal information may be shared with:
  1. our holding companies, subsidiary companies, affiliates, associates, employees, contractors, consultants, agents, advisers, auditors, insurers, legal representatives and professional advisers;
  2. schools, educators, parents, guardians, administrators, implementation partners, training partners and other persons involved in the delivery or support of educational services, where lawful and appropriate;
  3. service providers, Operators, Data Processors, suppliers, hosting providers, cloud providers, payment processors, analytics providers, support providers, security providers, content providers and other authorised third parties who assist us in providing our products, services and Sites;
  4. credit bureaus, anti-corruption agencies, fraud prevention bodies, regulators, authorities, courts, law enforcement agencies or other public bodies where necessary, lawful and proportionate;
  5. a prospective or actual buyer, investor, funder, merger partner, successor in title or other recipient in the event of a business restructuring, sale, transfer, merger, acquisition, financing or change of control involving all or part of our business, provided appropriate safeguards are in place; and
  6. any other third party where disclosure is required or authorised by law, necessary to enforce our rights, necessary to protect the rights or safety of any person, or reasonably necessary for the purposes set out in this Privacy Policy.
3. Where we share personal information with Operators or Data Processors, we require them to process information only for authorised purposes, to keep it confidential, to implement appropriate security safeguards, and not to use it for their own independent purposes unless legally permitted.
4. We do not sell children’s personal information. We do not knowingly share children’s personal information for commercial profiling or targeted advertising.
INTERNATIONAL DATA TRANSFERS
1. Transfers from South Africa: Personal information may be transferred to and stored at destinations outside the RSA. We ensure that such transfers comply with section 72 of POPIA, meaning the recipient is subject to a law, binding corporate rules, binding agreement or other mechanism that provides an adequate level of protection substantially similar to POPIA, or that another transfer justification permitted by POPIA applies.
2. Transfers from the EU/EEA: If we process the personal data of individuals in the EU or EEA, such data may be transferred to our servers or authorised service providers in South Africa or other jurisdictions. As South Africa is considered a “third country” under the GDPR, we ensure that such transfers are governed by European Commission-approved Standard Contractual Clauses (“SCCs”), adequacy decisions where applicable, binding corporate rules, derogations for specific situations, or other valid transfer mechanisms that provide essentially equivalent protection.
3. You may request a copy of the safeguards we have in place for applicable international transfers by contacting our Information Officer, subject to the protection of confidential and commercially sensitive information.
YOUR RIGHTS
1. You have the right to be informed about the collection and processing of your personal information and/or personal data, including the purposes, lawful bases, retention, sharing and rights described in this Privacy Policy.
2. You have the right to establish whether we hold personal information and/or personal data about you and to request access to such information, subject to applicable legal requirements, identity verification, exemptions and limitations.
3. You have the right to request that we correct, update, destroy or delete personal information that we have processed where such information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, obtained unlawfully, no longer necessary, or where we are no longer authorised to retain it.
4. Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal, nor does it affect processing that we are required or permitted to continue under another lawful basis.
5. You have the right to object to the processing of your personal information at any time, on reasonable grounds relating to your particular situation, unless the processing is required or authorised by law or justified by compelling legitimate grounds.
6. You have the right to object to the processing of your personal information at any time if the processing is for purposes of direct marketing.
7. You have the right not to have your personal information processed for purposes of direct marketing by means of unsolicited electronic communications from third parties unknown to you, except as permitted by law.
8. Right to Object to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such processing is authorised by law, necessary for a contract, or based on explicit consent and subject to appropriate safeguards.
9. Right to Data Portability (GDPR): Where the GDPR applies, you have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format and to have that data transmitted to another controller without hindrance, where technically feasible and where the right applies.
10. Right to Restriction of Processing: You have the right to request that we restrict, block or suppress the processing of your personal information and/or personal data in certain circumstances, including where you contest the accuracy of the data, where processing is unlawful and you oppose deletion, or where we no longer need the data but you require it for legal claims.
11. You have the right to submit a complaint to the Information Regulator regarding an alleged interference with the protection of personal information processed in accordance with this Privacy Policy. EU/EEA residents also have the right to lodge a complaint with the competent EU/EEA supervisory authority.
12. You have the right to institute civil proceedings or seek other remedies regarding an alleged interference with the protection of your personal information and/or personal data, as provided for by applicable law.
13. Response Timelines: We will respond to your rights requests within a reasonable time as required by POPIA and, where the GDPR applies, within one month of receipt of the request, unless an extension is permitted by law due to the complexity or number of requests.
14. Requests relating to children’s personal information may need to be submitted or authorised by a parent, legal guardian or competent person, unless applicable law permits or requires the child to exercise the right directly.
USE OF COOKIES
1. Cookies are pieces of information that our Sites may transfer to a user’s device for record-keeping, functionality, analytics, security, preference management and related purposes. Cookies may make use of our Sites easier by saving preferences, supporting authentication, improving security, tracking technical performance and helping us understand usage patterns.
2. We may place cookies or similar technologies on your browser or device to store and sometimes track information about you, subject to applicable law.
3. Essential cookies may be used where necessary for the operation, security or functionality of our Sites. Non-essential cookies, including certain analytics, advertising or tracking cookies, will be used only where we have a lawful basis to do so, including consent where required.
4. While most browsers are initially set up to accept cookies, you can reset your browser to refuse all cookies or indicate when a cookie is being sent. Please note that some parts of our products, services and/or Sites may not function properly if cookies are refused.
5. If we maintain a separate cookie policy or cookie preference tool, you are to familiarise yourself with that policy and/or manage your preferences through that tool when you make use of our Sites from time to time.
BUSINESS PARTNERS AND/OR LINKS TO OTHER SITES
1. When you interact with us or use our products and/or services, you might be required to make use of the products and/or services of our business partners, service providers, platform providers or other third parties. These business partners may collect data or solicit personal information in accordance with their own privacy policies.
2. When you make use of or interact with our Sites, you could be directed to other sites or services that are beyond our control. These other sites may send their own cookies to you, collect data or solicit personal information.
3. We do not control the privacy policies or practices of independent third parties and cannot be held liable for the use thereof by you, except where applicable law imposes responsibility on us for processors, operators or service providers acting on our behalf.
4. Where a third party processes personal information on our behalf as an Operator or Data Processor, we will require appropriate contractual safeguards as contemplated in this Privacy Policy.
DIRECT MARKETING
1. We may process your personal information for the purposes of providing you with information regarding our products and/or services that may be of interest to you only where we have a lawful basis to do so, including consent where required by POPIA, GDPR, electronic communications law or other applicable law.
2. We do not process children’s personal information for commercial profiling or targeted advertising. Any communications relating to children’s educational services will be directed through appropriate adult channels, such as parents, guardians, schools or authorised educators, where appropriate.
3. You may unsubscribe from direct marketing for free at any time. If you are currently receiving marketing information from us which you would prefer not to receive in future, please unsubscribe using the unsubscribe function in the marketing communication or email us using the contact information provided in clause 17 below.
4. We will maintain records of marketing consents, unsubscribes and objections as necessary to comply with applicable law and to ensure that your preferences are honoured.
GOVERNANCE AND CONTACT INFORMATION
1. For any questions regarding this Privacy Policy, or to exercise your rights, please contact our designated officers:
  1. Information Officer / Data Protection Officer: Anya Sonnendecker
  2. Email address: [email protected]
2. Complaints to the South African Information Regulator may be lodged using the prescribed process and forms made available by the Information Regulator. The Information Regulator’s current contact details include:
  1. Complaints email: [email protected]
  2. General enquiries: [email protected]
  3. Telephone: 010 023 5200
  4. Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, South Africa
3. EU/EEA Data Subjects may also contact the competent supervisory authority in their country of residence, place of work, or place of alleged infringement.
4. Before lodging a complaint with a regulator, we encourage you to contact us first so that we may attempt to resolve your concern promptly and appropriately.
GENERAL
1. This Privacy Policy must be read together with any applicable terms and conditions, platform rules, agreements, forms, consent notices, cookie notices, child-friendly privacy summaries, data processing agreements and any other privacy notices that apply to specific products, services or Sites.
2. If there is a conflict between this Privacy Policy and a more specific privacy notice, data processing agreement or lawful written agreement, the more specific document will apply to the extent of the conflict, unless applicable law requires otherwise.
3. Nothing in this Privacy Policy limits any rights that cannot lawfully be limited under POPIA, the GDPR or any other applicable law.

Privacy Policy

Overview

Resources

About Us

Legal

Privacy Policy