In-Touch Schools Privacy Policy

Explains how In-Touch Schools collects, uses, stores, protects and shares personal information in connection with its website, software platform, mobile application and related services.

1. Document status and important notice

This Privacy Policy is a founder-stage legal draft prepared for the In-Touch Schools project. It is intended to form the basis of the public-facing privacy notice and must be reviewed and approved by a South African attorney or privacy specialist before the platform processes live learner, parent or school information. Nothing in this document is intended to replace professional legal advice.

2. Who we are

In-Touch Schools is a school communication and management platform designed to connect schools, parents, learners and authorised school personnel. The legal entity responsible for the platform is [INSERT LEGAL COMPANY NAME] (registration number [INSERT COMPANY REGISTRATION NUMBER, IF APPLICABLE]), with an address at [INSERT REGISTERED / BUSINESS ADDRESS]. Privacy enquiries may be directed to [INSERT PRIVACY / LEGAL EMAIL ADDRESS] and the Information Officer is [INSERT INFORMATION OFFICER NAME].

3. Scope

This Policy applies to the In-Touch Schools website, web application, mobile application, school portals, administrative interfaces, communications and related services. It applies to information relating to parents/guardians, learners, teachers, principals, administrators, HODs, SGB users, district/department users and other authorised users.

4. Personal information we may process

Depending on the service and the school’s configuration, information may include names, contact details, account credentials and authentication data, learner identifiers, school and grade/class information, attendance, academic results and assessment information, school communications, consent records, support requests, device/browser information, security logs and audit records. Financial or other sensitive information will only be processed where necessary, lawful and appropriately protected.

5. Children’s information

The platform is designed to operate in a school environment and may process personal information relating to children. Access to learner information is therefore restricted according to role, school authority and the learner’s authorised relationship with the school. Parent/guardian access is intended to be limited to learners properly linked and authorised by the school. The platform will apply heightened safeguards to learner information and will not treat a learner’s information as ordinary public information.

6. Why we process information

Purposes may include creating and managing user accounts; authenticating users; linking authorised parents/guardians to learners; delivering announcements, attendance, academic and calendar information; managing consent; providing messaging and support; maintaining audit trails; improving reliability and security; preventing fraud or misuse; meeting contractual, legal and regulatory obligations; and providing aggregated or de-identified analytics where appropriate.

7. Lawful basis and data minimisation

Personal information will be processed only for a lawful and specific purpose and in accordance with applicable South African law. The platform will seek to collect information that is adequate, relevant and not excessive for the stated purpose. Where consent is relied upon, consent will be appropriately recorded and managed. Where processing is required for the school’s lawful functions, contractual obligations or another lawful basis, the relevant legal basis will be documented.

8. School as authoritative source

For learner-school relationships, enrolment status, class allocation, academic records and other school-controlled information, the school is intended to remain the authoritative source. In-Touch Schools provides the technology and controls through which authorised information is processed. Where a learner transfers schools, access and record-linking will be managed according to the school’s procedures and applicable law.

9. Parent and guardian access

A parent/guardian account does not automatically create an unrestricted right to all information held about a learner. Access is controlled by the school’s authorisation and relationship records. Access may be changed, suspended or removed where the school determines that the relationship, authority or entitlement has changed or where required by law.

10. Sharing and operators

In-Touch Schools may use carefully selected service providers (Operators) such as hosting, infrastructure, messaging, email, SMS, analytics, support or security providers. Such providers should be contractually required to protect information and process it only for authorised purposes. Personal information will not be sold as a business model. Disclosures may also occur where required by law or to protect the rights, safety or security of users, schools or the platform.

11. International processing and transfers

Some technology providers may process information outside South Africa. Before enabling such processing for live learner information, In-Touch Schools and/or the relevant school must assess the applicable POPIA requirements, contractual safeguards, security measures and any required transfer mechanism or authorisation.

12. Security safeguards

In-Touch Schools will use reasonable technical and organisational safeguards appropriate to the risks, which may include role-based access control, least-privilege permissions, authentication controls, encryption in transit, secure credential handling, audit logging, monitoring, backups, vulnerability management, incident response and supplier controls. Security measures will be reviewed as the platform evolves.

13. Security compromises

If a security compromise occurs, the incident will be assessed and managed under the applicable incident-response procedure. Where POPIA requires notification, the responsible party will notify the Information Regulator and affected data subjects as soon as reasonably possible after discovery, subject to the Act and applicable guidance.

14. Retention

Personal information will be retained only for as long as reasonably necessary for the purposes for which it was collected, to meet legal or contractual obligations, to resolve disputes, to maintain legitimate audit records, or for other lawful purposes. School-specific retention schedules may apply. When information is no longer required, it should be securely deleted, destroyed or de-identified in accordance with the applicable retention schedule.

15. Data subject rights

Subject to applicable law and lawful limitations, data subjects may have rights concerning access to, correction of, deletion of, objection to or other lawful control over their personal information. Requests should be directed to [INSERT PRIVACY / LEGAL EMAIL ADDRESS] or the relevant school where the school is the responsible party for the underlying learner information.

16. Complaints

Users may raise privacy concerns with In-Touch Schools and, where applicable, the Information Regulator of South Africa. The platform will maintain an internal process for receiving and escalating privacy requests and complaints.

17. Cookies and similar technologies

The public website may use only those cookies or similar technologies required for functionality, security or permitted analytics. The separate Cookie Policy explains the intended categories and choices.

18. Changes

This Policy may be updated as the platform, law, security controls or processing activities change. Material changes should be communicated through appropriate channels. Where acceptance is required for continued use, the system should record the applicable policy version and acceptance date.

19. Contact

Privacy contact: [INSERT PRIVACY / LEGAL EMAIL ADDRESS]

Information Officer: [INSERT INFORMATION OFFICER NAME]

Support: [INSERT SUPPORT EMAIL]

Address: [INSERT REGISTERED / BUSINESS ADDRESS]