Terms and Conditions for EduPace Subscription Service

These Terms and Conditions ("Terms") govern your use of the EduPace school and curriculum management platform ("Service"), a subscription-based software product provided by HashData (Pty) Ltd ("HashData," "we," "us," or "our"), a private company incorporated in the Republic of South Africa. By accessing, registering for, or using the Service, you ("Subscriber," "you," or "your") agree to be bound by these Terms together with the EduPace Privacy Policy, which forms part of this agreement.

Acceptance by electronic means — including ticking the acceptance checkbox during registration — constitutes a valid, binding and enforceable agreement in terms of sections 11 and 22 of the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"). If you do not agree to these Terms, do not register for or use the Service.

1. Definitions

• EduPace / the Service: the cloud-based platform for schools, aligned with the Differentiated Curriculum and Assessment Policy Statement ("DCAPS"), including the DCAPS module, the Individual Support Plan ("ISP") module, and the Learner Attendance and Learner Behaviour modules.
• Subscriber: the school, institution or other entity subscribing to the Service.
• Users: individuals authorised by the Subscriber to access the Service (principals, deputy principals, HODs, teachers, school administrators and other staff).
• Subscription: the licence granting access to the Service for a billing period, per the online sign-up process or an Order.
• POPIA: the Protection of Personal Information Act 4 of 2013, including its Regulations and any codes of conduct issued under it.
• PAIA: the Promotion of Access to Information Act 2 of 2000.
• Personal Information, Special Personal Information, Responsible Party, Operator, Data Subject, Processing: each bears the meaning assigned to it in POPIA.
• Subscriber Data: all data the Subscriber or its Users load into, or generate through, the Service — including learner records, guardian details, marks, attendance, behaviour records, ISP records and uploaded documents.
• Information Regulator: the Information Regulator (South Africa) established under section 39 of POPIA.

2. Eligibility and Authority

• The Service is intended for educational institutions — in particular special needs and main stream schools implementing the DCAPS curriculum — and not for personal or household use.
• By subscribing you warrant that you are duly authorised to bind the Subscriber, and that the Subscriber is lawfully entitled to process the learner and staff information it loads into the Service in terms of POPIA, the South African Schools Act 84 of 1996 and applicable provincial education policy.
• Where the Subscriber is a public school, it remains subject to its obligations towards its provincial education department, including learner-record and LURITS/CEMIS reporting duties.
• The Service is not made available directly to learners or to children, and no child may register an account.

3. Free Trial, Subscription and Access

3.1 Free trial

• New Subscribers receive a once-off free trial of 30 days from registration, with access to the Service. No payment is required during the trial and no card details are required to begin it.
• At the end of the trial a plan must be selected and paid for to retain access. Data captured during the trial is retained and becomes available again once a plan is activated, subject to clause 10.
• HashData may change the length or availability of the free trial for future registrations.

3.2 Licence

• HashData grants the Subscriber a non-exclusive, non-transferable, non-sublicensable and revocable licence to access and use the Service for its own internal educational administration during the Subscription period.
• Subscriptions are per school and per module. DCAPS is priced according to curriculum type (special needs or main stream); ISP may be added to any subscription or taken on its own; Learner Attendance and Learner Behaviour are included with every account at no additional charge.
• Subscriptions run month-to-month with no minimum term unless an Order records otherwise.

3.3 User accounts

• The Subscriber creates, manages and deactivates its own User accounts and assigns roles and permissions. The Subscriber is responsible for ensuring that access is removed promptly when a User leaves its employ or changes role.
• Credentials are personal and may not be shared. The Subscriber is liable for all activity under its Users' accounts.
• Users must verify their email address before gaining access, and passwords must meet the minimum strength enforced by the Service.
• The Subscriber must notify HashData without delay at info@edupace.co.za if it suspects any unauthorised access to its account.

4. Acceptable Use

You and your Users may not:

• copy, modify, adapt, translate, decompile, disassemble or reverse-engineer the Service or attempt to derive its source code;
• rent, lease, resell, sublicense or make the Service available to any third party, or use it to operate a service bureau;
• upload malicious code, or interfere with, disrupt or place unreasonable load on the Service or its infrastructure;
• attempt to gain unauthorised access to the Service, another Subscriber's data, or any underlying system — conduct which may constitute an offence under the Cybercrimes Act 19 of 2020;
• use the Service to process personal information for which the Subscriber has no lawful basis, or for any unlawful, discriminatory or harassing purpose;
• use automated means to scrape or extract data from the Service other than through the export features provided; or
• remove or obscure any proprietary notice in the Service or its outputs.

HashData may suspend access immediately, without prior notice, where it reasonably believes conduct threatens the security, integrity or lawful operation of the Service, and will inform the Subscriber as soon as practicable thereafter.

5. Fees, Billing and Payment

5.1 Fees

• Subscription fees are charged monthly per school and per active module, at the rates published on the EduPace website or recorded in an Order.
• All fees are quoted in South African Rand and exclude Value-Added Tax, which is added at the prevailing rate. HashData is a registered VAT vendor (VAT number 4960274779) and issues tax invoices complying with the Value-Added Tax Act 89 of 1991.

5.2 Payment methods

• Payment may be made by card through our third-party payment gateway, or by electronic funds transfer against a tax invoice with proof of payment uploaded to the Service.
• Card payments are processed by the payment gateway. HashData does not receive or store full card numbers, CVV codes or PINs; it records only the payment reference, status and amount returned by the gateway.
• Fees are payable monthly in advance and are not dependent on the extent to which the Service is used.

5.3 Late payment and suspension

• Overdue amounts bear interest at the maximum rate permitted by the National Credit Act 34 of 2005 and the prescribed rate of interest, whichever is lower.
• Where an account remains unpaid, HashData may suspend access after giving 14 days' written notice. Suspension does not delete Subscriber Data, and access is restored on payment.

5.4 Refunds and cancellation

• Because the free trial allows the Service to be evaluated in full before payment, fees already paid are generally non-refundable except as set out below or as required by law.
• A refund of the first monthly payment may be requested within 7 days of that payment where the Service has not been materially used, by writing to info@edupace.co.za. Approved refunds are paid within 14 business days.
• No refunds are made for renewals, partial months or unused capacity.
• Nothing in this clause limits any right the Subscriber may have under the Consumer Protection Act 68 of 2008 ("CPA") where that Act applies to the transaction, or the cooling-off right in section 44 of ECTA where it applies. The CPA applies only to transactions falling within its scope, including those with juristic persons whose asset value or annual turnover is below the threshold determined by the Minister.

5.5 Fee changes

• Fees may be adjusted on 30 days' written notice, taking effect from the next billing cycle. If the Subscriber does not accept the new fees it may cancel before they take effect.

6. Data Protection — Operator Terms (POPIA sections 20 and 21)

This clause 6 constitutes the written contract required by section 21(1) of POPIA between the Subscriber (as responsible party) and HashData (as operator).

6.1 Roles of the parties

• In respect of Subscriber Data — including learner, guardian and staff personal information — the Subscriber is the responsible party and determines the purpose and means of processing. HashData is the operator and processes that information only on the Subscriber's documented instructions, of which these Terms and the Subscriber's use of the Service's features are the primary record.
• In respect of the account, billing and support information of the Subscriber's own representatives, and of website visitors, HashData is the responsible party and processes that information in accordance with the Privacy Policy.

6.2 HashData's undertakings as operator

HashData will:

• process Subscriber Data only for the purpose of providing, maintaining, securing and supporting the Service, and not for its own purposes;
• treat all Subscriber Data as confidential and not disclose it except as permitted by these Terms or required by law, and only after notifying the Subscriber where that notification is lawful (section 20(2) of POPIA);
• secure the integrity and confidentiality of Subscriber Data through appropriate, reasonable technical and organisational measures as required by section 19 of POPIA, as described in clause 7;
• notify the Subscriber without undue delay after becoming aware of reasonable grounds to believe that Subscriber Data has been accessed or acquired by an unauthorised person, with sufficient detail for the Subscriber to meet its own notification duties to the Information Regulator and affected data subjects under section 22 of POPIA;
• assist the Subscriber, at reasonable cost, in responding to data subject requests, in conducting impact assessments, and in engaging with the Information Regulator;
• ensure that its personnel who access Subscriber Data are subject to a duty of confidentiality; and
• engage sub-operators only where equivalent contractual protections are imposed. The categories of sub-operators currently used are listed in the Privacy Policy, which is updated when they change.

6.3 The Subscriber's undertakings as responsible party

The Subscriber will:

• ensure that a lawful basis under section 11 of POPIA exists for every category of personal information it loads into the Service, and that data subjects have been notified as required by section 18;
• obtain the consent of a competent person (usually a parent or legal guardian), or rely on another justification in section 35, before processing the personal information of a child — noting that section 32(1) of POPIA permits schools to process information concerning a learner's health where it is necessary to provide special support or make special arrangements;
• observe the minimality principle in section 10 and capture only information that is adequate, relevant and not excessive for the educational purpose;
• keep information accurate and up to date (section 16), and remove records it is no longer entitled to retain;
• configure roles and permissions so that Users see only the information they need, and manage account deactivation promptly;
• handle requests from data subjects for access, correction or deletion in respect of records under its control, including requests made under PAIA; and
• not load Special Personal Information or children's information into free-text fields where a structured field is provided, and not use the Service to process criminal-behaviour information.

6.4 Cross-border processing

• Subscriber Data is hosted, and uploaded documents are stored, in the Republic of South Africa.
• A limited number of supporting services may process personal information outside South Africa. Where that occurs, HashData ensures the transfer meets a ground in section 72 of POPIA — ordinarily a binding agreement imposing an adequate level of protection. The current services and their roles are listed in the Privacy Policy.

6.5 Return and deletion

• On termination, the Subscriber may export its data as set out in clause 10.3. Thereafter HashData deletes or de-identifies Subscriber Data in accordance with section 14 of POPIA, except where it must be retained by law.

7. Security

HashData maintains security safeguards appropriate to the sensitivity of school data, including:

• encryption of data in transit over public networks, and encrypted, HTTP-only, same-site session cookies;
• salted, one-way hashing of passwords — passwords are never stored or recoverable in readable form — with minimum-strength rules and mandatory email verification;
• role- and permission-based access control, per-record authorisation checks, and strict separation of each school's data so that one Subscriber can never access another's;
• private object storage for uploaded documents and photographs, served only through short-lived expiring links;
• an immutable audit trail recording who created, changed or deleted a record, when, and from which IP address, together with sign-in records;
• protection against cross-site request forgery, rate limiting on sensitive endpoints, and verification of payment-gateway callbacks; and
• regular backups of the production database.

No system can be guaranteed absolutely secure. The Subscriber is responsible for the security of its own devices, networks and User credentials.

8. Intellectual Property

• All intellectual property in the Service — software, interfaces, documentation, branding and trade marks — vests in HashData or its licensors and is protected by the Copyright Act 98 of 1978 and the Trade Marks Act 194 of 1993. No rights are granted except the licence in clause 3.2.
• Curriculum, assessment and policy frameworks published by the Department of Basic Education remain the property of the State; EduPace merely provides tooling around them.
• The Subscriber retains all rights in Subscriber Data. The Subscriber grants HashData a limited licence to host, copy, transmit and display Subscriber Data solely to provide the Service.
• HashData may use anonymised and aggregated statistics — which are no longer personal information under POPIA and cannot identify any school, User or learner — to operate and improve the Service.
• Feedback and suggestions may be used freely by HashData without obligation or compensation.

9. Availability, Support and Changes

• HashData will use commercially reasonable efforts to keep the Service available, excluding planned maintenance (notified in advance where practical), emergency maintenance, and matters beyond its reasonable control.
• Onboarding assistance and ongoing support are included in every plan and are available during business hours at info@edupace.co.za or through the in-app support widget.
• HashData may add, change or discontinue features. Where a change materially reduces core functionality the Subscriber is given reasonable prior notice and may cancel without penalty.

10. Term, Cancellation and Data Export

10.1 Cancellation by the Subscriber

• The Subscriber may cancel at any time through the Billing screen in the Service or by written notice to info@edupace.co.za. Cancellation takes effect at the end of the billing period already paid for.

10.2 Termination by HashData

HashData may suspend or terminate the Subscription where the Subscriber:

• fails to pay and does not remedy within 14 days of notice;
• breaches these Terms and does not remedy a remediable breach within 14 days of notice; or
• uses the Service unlawfully or fraudulently, or in breach of clause 4.

10.3 Data export on exit

• The Service provides self-service export to Excel, CSV and PDF throughout, and the Subscriber is encouraged to export before cancelling.
• For 30 days after termination HashData will, on request and provided all amounts due are settled, give the Subscriber a reasonable opportunity to export outstanding Subscriber Data.
• After that period HashData may delete or de-identify Subscriber Data. Data already deleted by the Subscriber during the Subscription may not be recoverable.

11. Warranties and Disclaimers

• HashData warrants that the Service will perform materially as described in its documentation under normal use, and that it will provide the Service with reasonable skill and care.
• The Subscriber warrants that it has authority to enter into these Terms and will use the Service lawfully, including in compliance with POPIA and applicable education legislation.
• Except as expressly stated, and to the fullest extent permitted by law, the Service is provided "as is" and HashData disclaims all other warranties, whether express or implied, including merchantability, fitness for a particular purpose and non-infringement. HashData does not warrant uninterrupted or error-free operation.
• The Service is an administrative tool. The Subscriber remains responsible for the accuracy of the marks, attendance and learner information it captures, for professional and educational judgements, and for meeting Department of Basic Education reporting requirements. Reports, schedules and certificates generated by the Service must be checked before they are relied on or submitted.
• Nothing in these Terms excludes liability that cannot lawfully be excluded, including under the CPA where it applies.

12. Limitation of Liability

• Subject to the paragraph below, HashData's total aggregate liability arising out of or in connection with these Terms or the Service is limited to the fees paid by the Subscriber in the 12 months preceding the event giving rise to the claim.
• HashData is not liable for indirect, incidental, special or consequential loss, including loss of profit, loss of data, or loss of goodwill, even if advised of the possibility.
• These limitations do not apply to liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or to any liability that may not be limited under South African law, including under section 61 of the CPA where applicable.

13. Indemnities

• The Subscriber indemnifies HashData against claims, fines and damages arising from the Subscriber's or its Users' unlawful use of the Service, from Subscriber Data that infringes third-party rights, or from the Subscriber's failure to obtain a lawful basis or consent required by POPIA.
• HashData indemnifies the Subscriber against claims that the Service itself infringes a third party's South African intellectual property rights, provided the Subscriber notifies HashData promptly, allows HashData to conduct the defence, and provides reasonable co-operation.

14. Confidentiality

• Each party will keep the other's confidential information confidential, use it only for the purposes of this agreement, and protect it with at least the same care it applies to its own confidential information.
• This obligation does not apply to information that is public through no breach, was lawfully known before disclosure, or must be disclosed by law — in which case the disclosing party is notified where lawful to do so.

15. Access to Information (PAIA)

• HashData is a private body for the purposes of PAIA. Requests for access to records held by HashData may be directed to the Information Officer at info@edupace.co.za, and are dealt with in terms of PAIA and HashData's PAIA manual, which is available on request.
• Records belonging to a Subscriber remain under the Subscriber's control. A request for a learner's or employee's school records must be directed to the school concerned, not to HashData.

16. Governing Law and Disputes

• These Terms are governed by the laws of the Republic of South Africa.
• The parties will first attempt to resolve any dispute by good-faith negotiation between senior representatives within 15 business days.
• Failing resolution, the dispute is subject to the exclusive jurisdiction of the courts of the Western Cape Division of the High Court, Cape Town. Either party may nevertheless approach a Magistrate's Court with jurisdiction, or seek urgent interim relief from any competent court.
• Where the CPA applies, the Subscriber may also refer a dispute to the Consumer Goods and Services Ombud, the National Consumer Commission or a consumer court. Data-protection complaints may be lodged with the Information Regulator as set out in the Privacy Policy.

17. General

Entire agreement

• These Terms, any Order, and the Privacy Policy constitute the entire agreement between the parties and supersede all prior arrangements on the same subject matter.

Amendments

• HashData may amend these Terms by publishing a revised version with a new effective date. Material changes are communicated by email or in-app notice at least 14 days before they take effect. Continued use after the effective date constitutes acceptance; a Subscriber that does not accept a material change may cancel under clause 10.1.

Force majeure

• Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disaster, civil unrest, load shedding, or failure of national telecommunications infrastructure.

Cession and assignment

• The Subscriber may not cede or assign its rights or delegate its obligations without HashData's prior written consent. HashData may cede this agreement to a successor in a merger, acquisition or sale of business, subject to the successor being bound by these Terms and the Privacy Policy.

Severability, waiver and notices

• If any provision is found unenforceable, the remainder continues in force. No indulgence constitutes a waiver.
• Notices to HashData must be sent to info@edupace.co.za; notices to the Subscriber are sent to the email address on its account. Email notices are deemed received on the business day after sending, unless a delivery failure is received.

18. Contact

• HashData (Pty) Ltd t/a EduPace
• Email: info@edupace.co.za
• Telephone: +27 (0)21 330 5784
• Address: E001, Fairway Square, 23 Fairway Close, Parow Golf Course, Parow, Cape Town, 7500, South Africa