EduPace Privacy Policy

1. Definitions and the laws that apply

Terms such as personal information, special personal information, data subject, responsible party, operator, processing, competent person and de-identify bear the meanings given to them in POPIA.

The South African laws most relevant to EduPace are:

• Protection of Personal Information Act 4 of 2013 (POPIA) and the POPIA Regulations, 2018 — how personal information may be processed.
• Promotion of Access to Information Act 2 of 2000 (PAIA) — the right of access to records.
• Electronic Communications and Transactions Act 25 of 2002 (ECTA) — electronic agreements, supplier disclosure and the protection of personal information collected electronically.
• Children's Act 38 of 2005 — the best interests of the child, and the duty on teachers and other professionals under section 110 to report suspected abuse or neglect.
• South African Schools Act 84 of 1996 and the National Education Policy Act 27 of 1996 — the school's own duties to keep learner records and report to the Department of Basic Education, including through LURITS and provincial systems such as CEMIS.
• Employment Equity Act 55 of 1998 and the Basic Conditions of Employment Act 75 of 1997 — employment records and equity reporting for school staff.
• Consumer Protection Act 68 of 2008, the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011 and the Value-Added Tax Act 89 of 1991 — billing records and their retention.
• Cybercrimes Act 19 of 2020 — offences relating to unauthorised access to data and computer systems.

2. Information Officer and PAIA

• HashData has designated an Information Officer as required by sections 55 and 56 of POPIA. All privacy and access requests should be addressed to the Information Officer at info@edupace.co.za.
• HashData is a private body for PAIA purposes and maintains a PAIA manual in terms of section 51, which is available free of charge on request from the Information Officer.
• Each school using EduPace has its own Information Officer — ordinarily the principal — who is responsible for the school's own records.

3. What personal information we process

The categories below reflect what EduPace is actually built to store. Not every field is used by every school; schools choose which modules to activate and which optional fields to complete.

3.1 Learners

• Identity: first, middle and last names; South African identity number (or an indicator that the learner is a foreign national); CEMIS / EMIS / LURITS number; admission number; date of birth; gender.
• Placement: grade, phase, class, year in grade, learner type, and subject enrolment.
• Photograph: a learner profile photo and photographs used on reports, where the school chooses to upload them.
• Academic: baseline and term marks, assessment criteria selections, curriculum differentiation, educator and report comments, progression and DBE schedule comments, certificates, and requested learner adjustments together with who reviewed them.
• Attendance: daily attendance status, the date, free-text notes, and any supporting document uploaded to substantiate an absence.
• Behaviour: merit and demerit records, the category and value, the date, the staff involved, and free-text notes and narrative.

3.2 Parents, guardians and authorised persons

• Names, relationship to the learner, identity or passport number, home, work and mobile numbers, email address, occupation, employer and physical address.
• For persons authorised to collect a learner: name and contact details.
• Records of contact with parents captured in a learner's support plan, including meeting dates, attendance, feedback and agreed responsibilities.

3.3 School staff

• Identity and contact: title, names, initials, identity number, date of birth, gender, photograph, personal and work email addresses, home and cellular numbers, fax, and physical address.
• Employment: designation, whether the person is an educator, date joined and left, employer, contract type, PERSAL number, SACE registration number, tax reference number, and the phase or class to which they are assigned.
• Family and emergency: spouse name and telephone number, and up to two emergency contacts (name, number and relationship).
• Teaching allocations: subjects, grades and classes taught, assessment setup responsibilities, and approvals given.

3.4 User accounts

• Name, email address, hashed password, email-verification status, profile photograph, assigned roles and permissions, dashboard preferences, and the date the account was invited.
• Sign-in and technical records: the date and time of each sign-in and the IP address used, together with session records containing IP address and browser user-agent.
• Audit trail: EduPace keeps an audit record of who created, changed or deleted a record, when, from which IP address and on which screen — including the values before and after the change. Passwords and authentication tokens are excluded from the audit trail.

3.5 School and billing information

• School name, EMIS number, circuit, address, telephone, email, contact person, emblem and stamp.
• Subscription and plan selections, invoices, payment references, amounts, payment status, and any proof of payment uploaded for an electronic funds transfer.
• We do not receive or store full card numbers, CVV codes or PINs — card details are entered on and held by our payment gateway.

3.6 Support interactions

• Messages you send us by email or through the in-app support widget, together with your name, email address and the page you were on when you started the conversation.

3.7 Website visitors and advertising measurement

• What is recorded. When you view one of our public web pages — the EduPace website, this Policy, the Terms, the page on which a school registers, and the email-verification steps that complete a registration — two measurement tools record that the page was viewed, together with your IP address, browser and device type, the page address, the address of the page that referred you, and an identifier stored in your browser. The first is an advertising measurement tool; the second is a website analytics tool, which additionally records how long you spent on the page and which pages you moved between.
• Advertising measurement stops at the door. There is no advertising measurement anywhere inside the EduPace application. No screen a signed-in user visits, and no learner, mark, attendance record, support plan or document, is ever reported to any advertising service, and the sign-in and password-reset pages carry none either.
• Website analytics does run inside the application, and what it records is deliberately limited. So that we can see which parts of EduPace are actually used, the analytics tool also runs on signed-in screens — but it is told the shape of the screen rather than its address. A page recorded as /app/learners/:id/edit says a learner record was edited; it does not say which learner, and the identifier is removed before anything is sent. Anything typed into a search or filter box is discarded entirely rather than filtered, so a name typed into a search box is never transmitted. No learner, mark, attendance record, support plan, document, guardian or staff record is sent, and nothing you type into the Service is sent.
• Three screens are left out altogether. The sign-in flow, the Learners screen and the Staff Members screen report nothing at all — not even their shape. Those are the two screens that exist to list people, and the one everybody passes through daily.
• What they are for. Two purposes only: telling us which of our own adverts brought a school to our website and on to registration, and telling us how our public pages are found and used so that we can improve them. Neither is used to build profiles of learners, parents or staff, we upload nothing from inside EduPace to any advertising or analytics platform, and no school record is ever matched against advertising or analytics data.
• How to switch them off. Section 7 sets out the cookies these use and the ways to block or opt out of each. Doing so does not affect your use of EduPace in any way.

4. Special personal information and children's information

EduPace is built for special needs schools, so it necessarily handles categories that POPIA treats as special personal information under section 26, and it handles them almost entirely about children. We set this out plainly because it carries the highest obligations for both the school and for us.

4.1 Special personal information processed

• Health, wellbeing and disability — learners: recorded disabilities and barriers to learning; risk factors such as epilepsy, diabetes, asthma or cardiac conditions; allergies; medication, including medication administered at school; medical aid scheme and membership number; treating doctor, school nurse and hospital details; vision and hearing screening results and assistive devices; psychological and psychometric assessment results, including test type, administrator, date and IQ scores; therapy records for psychotherapy, occupational therapy, physiotherapy, speech therapy and general learner support, including barriers, goals, results, action plans, session counts and clinical notes; social-services involvement, including social worker, social grant status and reported challenges; and personal-care dependency such as bathroom assistance and communication needs.
• Health — staff: medical aid scheme and number, doctor name and number, and any medical condition recorded by the school.
• Race: recorded for learners and staff, principally to enable schools to meet departmental reporting duties and, for staff, employment equity obligations.
• Religious or philosophical beliefs: a learner's religion, where the school captures it.
• Trade union membership: recorded for staff members.
• Supporting documents: files uploaded to substantiate an absence (which are frequently medical notes) and documents attached to a learner's Individual Support Plan.

EduPace does not collect biometric templates (photographs are stored as ordinary images, not converted into biometric identifiers), and it has no fields for criminal convictions or alleged offences.

4.2 The lawful basis for special personal information

• Section 26 of POPIA prohibits processing special personal information unless an authorisation in section 27 or sections 28 to 33 applies.
• For learner health information, schools ordinarily rely on section 32 of POPIA, which permits schools to process information concerning a learner's health where it is necessary to provide special support or to make special arrangements in connection with their health — precisely the purpose of the Individual Support Plan module.
• Race and trade union membership for staff are processed on the basis of the school's obligations and rights in labour and employment equity law, or with the employee's consent.
• Where no statutory authorisation applies, the school must obtain the explicit consent of the data subject or their competent person.
• Everyone who processes special personal information is bound by a duty of confidentiality (section 27(1)(f) of POPIA), and EduPace restricts access to it through role-based permissions.

4.3 Children's information

• Section 34 of POPIA prohibits processing the personal information of a child unless an authorisation in section 35 applies — most commonly the prior consent of a competent person (a parent or legal guardian), or where processing is necessary to establish, exercise or defend a right or obligation in law, or to comply with an international-law obligation.
• Obtaining and recording that consent is the school's responsibility. EduPace does not collect consent from parents directly and does not provide a consent-capture feature; schools should obtain and retain consent through their own admission and support processes, and must be able to demonstrate it on request.
• All processing of children's information through EduPace must serve the best interests of the child as required by the Children's Act 38 of 2005.
• Learners do not have EduPace accounts and cannot sign in. No information is collected directly from a child through the Service.
• Nothing in this Policy limits the duty on educators and other professionals under section 110 of the Children's Act to report suspected abuse or deliberate neglect of a child to the designated authorities.

5. Where the information comes from

• From the school. Nearly all learner, guardian and staff information is captured or imported by school staff. Section 12 of POPIA requires collection directly from the data subject wherever practicable; where a school captures information about a parent, guardian or emergency contact from someone else, the school must ensure that person is notified as section 18 requires.
• From you. Account, billing and support information you give us directly when registering, subscribing or asking for help.
• Automatically. Sign-in records, session data, audit entries and technical information generated as the Service is used.
• Derived. Date of birth and gender may be derived from a South African identity number during capture or import; this is done locally within EduPace and no identity number is sent to any outside service for verification.
• Public registries. School details may be checked against a departmental EMIS reference lookup.

6. Why we process it and our lawful basis

Section 11 of POPIA requires a justification for every processing activity. Ours are:

We do not use the learner, guardian or staff records held in EduPace for advertising — the advertising measurement described in sections 3.7 and 7 runs only on our public web pages, never inside the application — and we never sell personal information.

6.1 Direct marketing

• Section 69 of POPIA restricts unsolicited electronic direct marketing. We send marketing communications only to school representatives who are existing customers or who have asked to hear from us, always about our own similar products, and every message contains an unsubscribe link.
• We never send marketing to parents, guardians or learners.

6.2 Automated decision-making

• EduPace calculates totals, averages, percentages and progress indicators, and flags matters such as outstanding capture or repeated absence for a person to look at.
• These are calculations and prompts, not decisions. No decision with legal consequences for a learner — such as promotion, progression or placement — is made automatically by EduPace; each is made by school staff, as section 71 of POPIA requires.

7. Cookies, similar technologies, analytics and advertising measurement

Inside the EduPace application we use the cookies the Service needs in order to work, and the analytics cookies described in section 3.7, which tell us which parts of EduPace are used. There is no advertising cookie and no advertising measurement on any signed-in screen, and the sign-in and password-reset pages, the Learners screen and the Staff Members screen carry no measurement of any kind. The analytics that does run there is told the shape of a screen and never its address, so it receives no learner, guardian or staff identifier and nothing you type.

On our public web pages — the EduPace website, this Policy, the Terms, the registration page and the email-verification steps — we additionally run two measurement tools: the Meta Pixel, so that we can tell which of our own adverts bring a school to us, and Google Analytics, so that we can tell how those pages are found and used. They are the only two such tools we use, they run on those public pages and nowhere else, and both are described in the table below and in section 3.7.

Apart from _fbp, _fbc, _ga and _ga_*, all of the above are strictly necessary for the Service to function or are set only at your election, and blocking them in your browser will prevent you from signing in. Our public web pages also load a web font from Google Fonts and an icon library, which means those providers receive your IP address and browser type when the page loads; no cookie is set by those requests.

7.1 Refusing or switching off advertising measurement

You can stop the measurement described above at any time, and doing so has no effect on your use of EduPace — you can still browse our website, register a school and sign in normally:

• Block third-party scripts or cookies for this site in your browser settings, or use its tracking-protection or private-browsing mode. Most browsers also let you delete _fbp, _fbc, _ga and _ga_* on their own.
• Switch off Google Analytics specifically by installing Google's own opt-out browser add-on at tools.google.com/dlpage/gaoptout, which stops the measurement on every site that uses it, not only ours.
• Adjust your advert settings with Meta directly, at facebook.com/settings?tab=ads, which governs how Meta uses information it receives about you from other websites.
• Object to the processing on reasonable grounds under section 11(3) of POPIA, using the route in section 12. We will give effect to an objection without asking for a reason.

We do not currently ask for consent before the pixel or the analytics tag loads on our public pages, because we rely on the legitimate-interest ground set out in section 6 rather than on consent. Should the Information Regulator issue guidance or a code of conduct requiring prior consent for non-essential cookies, we will introduce a consent choice and update this Policy before doing anything further.

8. Who we share information with

We do not sell personal information and we do not share it for anyone else's marketing. We use the following operators (sub-processors), each bound to process information only on our instructions and to keep it secure:

One qualification about Meta and Google. The first four providers in this table are operators in the POPIA sense: they process only on our instructions and for no purpose of their own. Meta is not in that position — it determines its own purposes for the visit information it receives and is therefore itself a responsible party for that processing, governed by its own terms and privacy policy rather than only by ours. Google undertakes to process Google Analytics information on our instructions, but it operates the service on its own infrastructure and terms, and we treat the visit information it receives on the same conservative footing. We say so plainly because it is the reason we keep both tools off every page that touches school records, and the reason section 7.1 tells you how to refuse each. It is also why we neither send nor upload any personal information from inside EduPace to Meta or Google, and do not use their tools to match, target or build audiences from learner, guardian or staff information.

Reports and PDFs are generated on our own servers; no learner information is sent to an outside service to produce them.

We may also disclose personal information:

• to the school that owns the records, and to the users it has authorised;
• to our professional advisers (auditors, accountants, attorneys) under a duty of confidentiality;
• where required by law, a court order, or a lawful request from a regulator or law-enforcement agency — we notify the school first unless the law forbids it; and
• to a successor in a merger, acquisition or sale of business, with prior notice to affected schools, and on terms no less protective than this Policy.

9. Where information is stored and cross-border transfers

• EduPace's database and uploaded files are hosted in the Republic of South Africa. Files such as learner and staff photographs and support-plan documents are stored in Amazon Web Services' Cape Town region (af-south-1) in a private bucket.
• A small number of supporting services may process limited information outside South Africa — principally our support chat provider, the payment gateway, the font and icon services described in section 7, and the advertising measurement and website analytics described in sections 3.7 and 7, which send visit information to Meta Platforms and to Google, both in the United States — Meta from our public pages only, Google from those and from signed-in screens, reduced as section 3.7 describes. What each can access is set out in section 8.
• Where personal information is transferred outside South Africa, we ensure a ground in section 72 of POPIA is met — ordinarily a binding written agreement requiring the recipient to uphold principles of protection substantially similar to POPIA's, and not to transfer the information onward without equivalent protection.
• We do not transfer learner health information, support-plan content or other special personal information about children to any recipient outside South Africa. In particular, no learner, guardian or staff record of any kind is transferred to an advertising platform, whether inside or outside the Republic.

10. How we keep information secure

In line with section 19 of POPIA we maintain appropriate, reasonable technical and organisational measures, including:

• encryption of information in transit over public networks, and encrypted, HTTP-only, secure, same-site session cookies;
• salted one-way hashing of passwords — nobody at HashData can read or recover your password — with minimum-strength requirements and mandatory email verification before access;
• role- and permission-based access control, so teachers see their own classes and subjects while principals and heads of department see what their role requires;
• strict separation of each school's data, applied automatically at the database query level, so one school can never see another's records;
• private storage for uploaded documents and photographs, retrievable only through short-lived expiring links;
• an audit trail of changes, and records of sign-ins including IP address, to support accountability and investigation;
• protection against cross-site request forgery, rate limiting on sensitive endpoints, signature verification of payment callbacks, and a restrictive cross-origin policy; and
• regular backups of the production database.

10.1 If something goes wrong

• If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the affected school without undue delay, with enough detail for it to meet its own duties to the Information Regulator and to affected data subjects under section 22 of POPIA.
• Where HashData is the responsible party — for account, billing and support information — we notify the Information Regulator and affected data subjects ourselves.
• Schools must keep their own devices, networks and user credentials secure, remove access promptly when staff leave, and tell us at once if they suspect an account has been compromised.

11. How long we keep information

Section 14 of POPIA requires that records not be kept longer than necessary for the purpose they were collected for, unless a law requires otherwise. Our approach:

• While a school subscribes, its records are kept so that they remain available across school years — academic histories, attendance and support plans are of continuing value to the learner and are typically required by the school's own record-keeping duties under the South African Schools Act and provincial policy.
• Deletion inside EduPace is a two-step process. When a user deletes a record it is archived — removed from view but retained — so that accidental deletions can be reversed. It is permanently erased on the school's instruction or in line with our retention schedule.
• After a subscription ends, the school has 30 days to export its data (see clause 10.3 of the Terms). Thereafter we delete or de-identify it, except where retention is legally required.
• Billing and tax records are kept for the periods required by the Companies Act and the Tax Administration Act — generally five to seven years.
• Security, audit and sign-in records are kept for as long as needed for accountability, investigation and legal-claim purposes, and are then deleted or de-identified.
• Schools set the rules for their own records. As responsible party, a school may instruct us to delete specific records at any time, and should ensure its own retention policy reflects departmental requirements.

12. Your rights and how to exercise them

Section 5 of POPIA gives every data subject the following rights:

• To be notified that information is being collected, and that it has been accessed by an unauthorised person (sections 18 and 22).
• To access the personal information held about you, and to be told who has had access to it (section 23, read with PAIA).
• To correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24).
• To object to processing on reasonable grounds, using Form 1 of the POPIA Regulations (section 11(3)).
• To withdraw consent where processing is based on consent, without affecting processing already carried out.
• Not to be subject to a decision based solely on automated processing that has legal consequences (section 71).
• To complain to the Information Regulator, and to institute civil proceedings (sections 74 and 99).

12.1 How to make a request

• School records — learners, guardians and staff: send your request to the school. The school is the responsible party and holds the relationship with you; it can also action the request itself inside EduPace. We assist the school on request.
• Account, billing and support information: email the Information Officer at info@edupace.co.za.
• Requests to correct or delete may be made on Form 2 of the POPIA Regulations, 2018; objections on Form 1. We accept a plain written request as well.
• We need to verify identity before acting on a request, and will ask for proof where the request is made on someone else's behalf — including by a parent or guardian for a child.
• We acknowledge requests promptly and respond within the period allowed by POPIA and PAIA. Access requests under PAIA may attract the prescribed fee; POPIA correction and objection requests are free.

13. Contact us and the Information Regulator

14. Changes to this Policy

• We may update this Policy to reflect changes in the Service, our operators, or the law. The version number and effective date at the top of the page always show the current version.
• Material changes — for example a new operator with access to learner information, or a new purpose of processing — are communicated to subscribing schools by email or in-app notice at least 14 days before they take effect, so that a school can consider its own notification duties.
• Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14.1 What changed in this version

• Version 2.3 · 17 September 2026. Extended the website analytics of version 2.2 to signed-in screens, so that we can see which parts of the Service are used. Sections 3.7, 7, 8 and 9 now describe that scope and its limits: the screen's shape is recorded and never its address, record identifiers are removed and query strings discarded before anything is sent, and the sign-in flow, the Learners screen and the Staff Members screen report nothing at all. No learner, guardian or staff record, and nothing typed into the Service, is sent to any analytics provider. Advertising measurement is unchanged and still runs on our public pages only. Because this is a new purpose for information about signed-in use, the 14-day advance-notice undertaking above was engaged and given.
• Version 2.2 · 17 September 2026. Disclosed the website analytics now running on our public web pages: Google Analytics named in sections 3.7 and 7, a lawful basis in section 6, the _ga and _ga_* cookies and the opt-out routes in sections 7 and 7.1, Google Analytics in section 8, and the cross-border position in section 9. As with version 2.1, this concerns visitors to our public pages only: it adds no operator with access to school records, no new purpose for learner, guardian or staff information, and nothing inside the application, so the 14-day advance-notice undertaking above was not engaged.
• Version 2.1 · 11 August 2026. Disclosed the advertising measurement now running on our public web pages: a new section 3.7, a lawful basis in section 6, the _fbp and _fbc cookies and the opt-out routes in sections 7 and 7.1, Meta Platforms and Font Awesome in section 8, and the cross-border position in section 9.
• This change concerns visitors to our public pages only. It adds no operator with access to school records, no new purpose for learner, guardian or staff information, and nothing inside the application — so the 14-day advance-notice undertaking above was not engaged and the version took effect on publication.
• Version 2.0 · 30 July 2026. The consolidated Policy that this version amends.