Privacy and Data Protection Policy

School website and mobile application

1Introduction

1.1

Riverside College ("the school", "we", "us" or "our") is a registered school in terms of the South African Schools Act (SASA), 1996 (Act 84 of 1996), and is managed and governed in terms of the provisions of the SASA as well as the language and admissions policies drafted in terms thereof.

1.2

The school operates physical and administrative school services, a public website, and a mobile application (the "App") used by parents, learners (where applicable), educators, office staff and other authorised users. Through these channels the school gathers and uses certain information about individuals and juristic persons (collectively "data subjects").

1.3

Section 1 of the Protection of Personal Information Act (POPIA), 2013 (Act 4 of 2013) defines a "data subject" as the person to whom personal information relates. Data subjects may include learners, parents/guardians, educators, employees, applicants, alumni, suppliers, service providers, volunteers, website visitors, App users, and any other person with whom the school has a relationship or may need to contract.

1.4

This policy describes how personal information must be collected, handled, stored, shared and destroyed so that the school meets its personal information protection standards and complies with POPIA, the regulations under POPIA, and related South African law (including, where applicable, the Promotion of Access to Information Act, 2000 (PAIA)).

1.5

The school regards the lawful and appropriate processing of personal information as crucial to service delivery and to maintaining confidence between the school, data subjects and third parties. The school fully endorses and adheres to the conditions for lawful processing under POPIA.

1.6

This policy applies to school administration and teaching activities; the school's website(s) and online forms; the Riverside College mobile App (iOS and Android), including account registration, messaging, events, lessons/focus content, store features, notifications and related services; and any personal information processed by staff, contractors or processors on the school's behalf.

1.7

The Information Officer of the school is the Principal, who may be contacted in writing regarding POPIA-related matters.

1.8

The Deputy Information Officer, as delegated by the Principal, is [insert full name and written contact details] and may be contacted in writing.

1.9

Definitions of key terms appear at the end of this policy.

2Purpose of this policy

This policy aims to:

• ensure compliance with POPIA's eight conditions for lawful processing;
• protect the privacy of data subjects, including children;
• set clear rules for staff and processors who handle personal information;
• explain to data subjects (including App users) what we collect, why, and how they may exercise their rights; and
• reduce the risk of unauthorised access, loss or misuse of personal information.

3Scope

3.1

This policy applies to all personal information processed by or for the school, whether in paper, electronic, cloud or App form, in South Africa or (where lawfully transferred) elsewhere.

3.2

It binds employees, governing body members, contractors, volunteers and any operator (processor) who processes personal information for the school.

4Categories of personal information we process

Depending on your relationship with the school and features you use, we may process:

4.1Identity and contact information

Name, surname, identity or passport numbers (where required for enrolment or employment), date of birth, gender, contact numbers, email addresses, physical and postal addresses, account usernames.

4.2Learner and academic information

Grade, class, subjects, lessons, homework, assessments, attendance-related records, extramural participation, and communications about learning progress (including content shown in the App's weekly focus / lesson features).

4.3Parent / guardian and family information

Relationship to the learner, emergency contacts, and correspondence with the school.

4.4Account and App usage information

Login credentials (stored in protected form), role (e.g. parent, teacher, office, admin), account status (e.g. active / pending approval), device-related technical data reasonably required to operate the App, in-app preferences, and records of actions you take in the App (e.g. bookings, store activity).

4.5Communications

Messages sent or received via the App's chat/messaging features, emails (including verification and password-reset messages), support requests, and other correspondence with the school.

4.6Events, bookings and applications

Open day, webinar, event or enrolment application details, and related confirmations.

4.7Financial and store-related information

Where applicable: fee-related references, store product selections, order details and payment references processed through authorised channels.

4.8Images and media

Profile or cover images you upload, photographs used for school publications where consent or another lawful basis applies, and images selected via the device photo picker when you choose to upload them. The App uses the system photo picker where available and does not require broad access to your entire photo library solely to select an image.

4.9Special personal information and children's information

POPIA gives extra protection to special personal information and to personal information of children. The school processes such information only where permitted by POPIA and with appropriate safeguards.

We do not intentionally collect more personal information than needed for the stated purposes.

5How we collect personal information

• Directly from you (enrolment forms, applications, website forms, App registration, profile updates, chats, bookings, uploads).
• From parents/guardians in respect of learners, where lawful.
• From educators and staff in the ordinary course of school administration and teaching.
• Automatically, to a limited extent, when you use the website or App (e.g. technical logs needed for security, reliability and abuse prevention).
• From third parties where lawful, when necessary for our functions.

6Purposes of processing

We process personal information only for specific, explicitly defined and legitimate purposes, including to:

• Admit, enrol, educate and support learners, and communicate with parents/guardians.
• Employ and manage staff and manage governing body and volunteer relationships.
• Operate the website and App, create and manage user accounts, verify email addresses, authenticate users, and reset passwords.
• Provide App features such as messaging, events and calendars, weekly focus/lessons, notifications, store/cart functionality and related school communications.
• Process applications, open day/webinar bookings and enrolment-related requests.
• Meet legal, regulatory, audit and reporting obligations.
• Protect the safety, security and integrity of learners, staff, systems and premises.
• Improve services, troubleshoot technical issues and maintain records.
• Send important service messages (e.g. account approval status, security notices).

7Lawful basis under POPIA

Processing is undertaken only if at least one condition for lawful processing applies, including where:

• the data subject (or a competent person where the data subject is a child) consents;
• processing is necessary to carry out actions for the conclusion or performance of a contract;
• processing complies with an obligation imposed by law;
• processing protects a legitimate interest of the data subject;
• processing is necessary for the proper performance of a public law duty by a public body (where applicable); or
• processing is necessary for pursuing the legitimate interests of the school or a third party, balanced against the data subject's rights.

8Website and App-specific practices

8.1Accounts

App registration may collect name, surname, mobile number/username, email, password, grade and role. Accounts may remain inactive until approved by the school. Email verification and password-reset codes may be sent to the address you provide.

8.2Messaging

Messages exchanged in the App are processed to deliver the communication service and for legitimate school administration, safety and record-keeping.

8.3Photos and uploads

When you choose an image, the App may use the device's system photo picker. Only the image(s) you select are made available to the App for upload.

8.4Notifications

Where push or in-app notifications are enabled, they are used for service and school-related alerts. Device permission for notifications is controlled by you in your device settings.

8.5Password reset limitations

For security, certain staff roles (such as admin, office and teacher accounts) may be restricted from self-service password reset and must contact the school through official channels.

8.6Children's privacy

The App and school systems may process children's personal information in the education context with heightened care, limited to what is necessary, and in accordance with POPIA.

9Disclosure and operators

9.1

We do not sell personal information.

9.2

We may share personal information with authorised school staff; operators who provide IT hosting, databases, email delivery, payment or support services under contract; professional advisers; public authorities where required by law; and other parties with your consent or as otherwise permitted by POPIA.

9.3

Operators are required to process personal information only on our instructions and with appropriate security measures.

10Cross-border transfers

Personal information may be stored or processed on systems hosted outside the Republic of South Africa. Where we transfer personal information outside South Africa, we will do so in accordance with POPIA section 72.

11Security safeguards

The school implements reasonable and appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised destruction and unlawful access or processing. Users must keep login details confidential and notify the school promptly of suspected unauthorised account use. Security compromises will be managed in line with POPIA section 22.

12Retention and destruction

Personal information is retained only as long as necessary for the purposes for which it was collected, or as required by law, or for legal claims. When no longer required, it will be destroyed, deleted or de-identified as far as reasonably possible.

13Rights of data subjects

Subject to the limitations in POPIA, data subjects have the right to:

• be notified that personal information is being collected and of security compromises where required;
• request access to their personal information;
• request correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
• object to processing on reasonable grounds relating to their particular situation, or for purposes of direct marketing;
• submit a complaint to the Information Regulator; and
• withdraw consent where processing is based on consent (this will not affect processing already lawfully completed).

Requests should be made in writing to the Information Officer (or Deputy).

14Direct marketing

Electronic direct marketing will only be conducted in compliance with section 69 of POPIA. You may opt out of non-essential marketing communications by following unsubscribe instructions or contacting the school in writing.

15Third-party websites and services

The website or App may link to third-party sites or services. Their privacy practices are governed by their own policies.

16Changes to this policy

This policy may be updated from time to time. The current version will be published on the school website and/or made available in the App or on request.

17Contact and complaints

17.1Information Officer (Principal)

Riverside College

Email: principal@riversidecollege.co.za

17.2Deputy Information Officer

Mrs. Carlien Ellis

17.3Information Regulator (South Africa)

Website: https://inforegulator.org.za

18Definitions

• App means the Riverside College mobile application for iOS and Android and related backend services.
• Child means a natural person under the age of 18 years.
• Competent person means any person who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child.
• Data subject means the person to whom personal information relates.
• Information Officer means the Principal of the school, as contemplated in POPIA.
• Operator means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party.
• Personal information has the meaning in section 1 of POPIA.
• POPIA means the Protection of Personal Information Act 4 of 2013, as amended, and the regulations under it.
• Processing has the meaning in section 1 of POPIA.
• Responsible party means Riverside College.
• Special personal information has the meaning in section 26 of POPIA.
• Website means the school's public websites and online forms under its control.

19Acknowledgement

By using the school's services, website or App, or by submitting personal information to the school, you acknowledge that you have had an opportunity to read this policy. Where consent is required for a specific processing activity, that consent will be obtained separately in a clear manner.