Privacy Policy POPIA & PAIA

Who we are and who is responsible

For purposes of POPIA, Step-Up Rynfield Private Academy acts as the responsible party in relation to personal information that it determines the purpose and means of processing.

Privacy, POPIA and PAIA enquiries should be directed to the school’s Information Officer or authorised delegate using the contact details above.

Scope of this policy

This policy applies to personal information processed in connection with:

• the Step-Up Rynfield website and online forms;
• enquiries by phone, email, WhatsApp, social media or in person;
• applications, enrolments, waiting lists and school administration;
• children enrolled at or attending the school;
• parents, guardians, authorised collectors and emergency contacts;
• staff, job applicants, contractors and service providers;
• visitors to the school premises;
• school photography, video, events and authorised media use;
• security systems, access control and CCTV where used;
• payments, invoices, fee administration and related financial records; and
• records that may be requested under PAIA.

How we apply POPIA

We aim to process personal information in line with POPIA’s conditions for lawful processing. In practical terms, this means we seek to ensure that information is:

• processed accountably, lawfully and in a reasonable manner;
• collected for specific, defined and legitimate purposes;
• adequate, relevant and not excessive for those purposes;
• kept reasonably accurate and up to date;
• not retained for longer than necessary, subject to legal and operational requirements;
• protected by appropriate technical and organisational safeguards; and
• processed transparently so that data subjects can understand how their information is used.

Personal information we may collect

Children’s personal information

Because Step-Up Rynfield provides services to children, we may process personal information relating to minors. We recognise that children’s information requires particular care.

We may process children’s information where:

• a parent or competent guardian has supplied or authorised the information;
• processing is necessary to provide education, care, safety or related services;
• processing is required or permitted by law; or
• another lawful basis or POPIA exception applies.

We do not intentionally invite young children to submit personal information directly through the website without parent or guardian involvement. Parents and guardians should avoid submitting unnecessary sensitive information through unsecured channels.

Special personal information and health information

The school may need to process sensitive information, including health, medical, disability, therapy, dietary, allergy or other support-related information where this is relevant to a child’s wellbeing, education or safety.

We limit access to this information to staff and service providers who reasonably need it for an authorised purpose. Where required, we will rely on consent or another lawful basis permitted by POPIA.

How we collect personal information

Information may be collected:

• directly from parents, guardians, applicants, staff, visitors or service providers;
• through website contact forms, enrolment forms and other documents;
• through telephone calls, email, WhatsApp or social-media communication;
• during school attendance, activities, assessments, events or day-to-day care;
• from authorised third parties such as previous schools, healthcare providers or therapists where lawful and appropriate;
• through payment providers, banks or accounting systems where relevant;
• through security and access-control systems where installed; and
• automatically through limited website technologies such as cookies, server logs or analytics tools where enabled.

Why we use personal information

We may process personal information to:

• respond to enquiries and arrange school visits;
• process applications, enrolments and waiting lists;
• provide education, supervision, meals, activities and care;
• support a child’s health, safety, development and learning needs;
• communicate with parents, guardians and emergency contacts;
• manage attendance, collection arrangements and school security;
• administer fees, payments, invoices and financial records;
• manage staff, recruitment, contractors and service providers;
• meet legal, regulatory, insurance and recordkeeping obligations;
• investigate incidents, complaints, safeguarding concerns or disputes;
• maintain and secure our website, systems, facilities and records;
• send school notices and, where legally permitted, marketing communications;
• publish photographs or media where appropriate permission has been obtained; and
• establish, exercise or defend legal rights.

Lawful grounds for processing

Depending on the context, processing may be based on one or more grounds permitted by POPIA, including:

• the consent of the data subject or a competent person acting for a child;
• processing necessary to perform or take steps relating to a contract;
• processing required to comply with a legal obligation;
• processing necessary to protect a legitimate interest of the child or another data subject;
• processing necessary for the proper performance of a public-law duty where applicable; or
• processing necessary to pursue the legitimate interests of the school or a third party, where this is lawful and does not unjustifiably prejudice the data subject.

Where consent is the basis of processing, consent may generally be withdrawn, but withdrawal does not affect processing that was lawful before withdrawal and may not prevent processing that is justified on another lawful basis.

When we may share personal information

We do not sell personal information. We may disclose information only where reasonably necessary and lawful, including to:

• authorised school staff and management;
• parents, guardians or authorised representatives;
• medical, emergency or therapeutic professionals where necessary;
• education authorities, regulators or government bodies where required;
• banks, accountants, auditors, insurers or payment providers;
• IT, hosting, email, communications, security, backup and website service providers;
• legal advisers, debt-recovery providers or professional consultants where necessary;
• law-enforcement or public authorities where disclosure is required or authorised by law; and
• other parties where the data subject has authorised disclosure.

Operators and service providers

Some third-party service providers may process personal information on our behalf as “operators” under POPIA. Where appropriate, we require such providers to process information only for authorised purposes, protect confidentiality and implement reasonable security safeguards.

Examples may include website hosting, cloud storage, email, accounting, communications, security, backup, IT support, payment and other administrative services.

Cross-border processing and cloud services

Some technology or cloud providers may store or process information outside South Africa. Where this occurs, Step-Up Rynfield will seek to ensure that any cross-border transfer is handled in a manner permitted by POPIA, including by considering whether appropriate contractual protections, consent, comparable legal protection or another lawful basis applies.

Cookies, analytics and embedded services

Our website may use cookies or similar technologies to make the website work, remember preferences, improve performance, prevent abuse or understand general website usage.

Third-party services

The website may contain or embed services provided by third parties such as Google Maps, Google-related services, social-media links or other external tools. Those providers may process technical information according to their own privacy policies.

Cookie choices

Where non-essential cookies are used and consent is legally required, users should be offered an appropriate choice before those cookies are activated. Users can also manage cookies through their browser settings, although blocking essential cookies may affect website functionality.

How we protect personal information

We use reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved. These may include:

• role-based or need-to-know access controls;
• password protection and account-security measures;
• secure hosting, backups and software updates;
• anti-malware, firewall and website-security controls where appropriate;
• physical security for paper records and school premises;
• confidentiality requirements for staff and service providers;
• secure disposal or deletion of records when no longer required; and
• reasonable incident-response and security-compromise procedures.

No system can guarantee absolute security. Users should also take care when sending sensitive information by ordinary email, messaging applications or other unencrypted channels.

Security compromises

If we have reasonable grounds to believe that personal information in our possession has been accessed or acquired by an unauthorised person, we will investigate the incident and take reasonable steps required by POPIA. Where legally required, this may include notifying the Information Regulator and affected data subjects as soon as reasonably possible, subject to lawful restrictions.

How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where retention is required or authorised by law, contract, legitimate operational needs, dispute management, safeguarding, accounting, tax, insurance or other valid reasons.

When information is no longer required, we will take reasonable steps to delete, destroy or de-identify it, subject to applicable retention obligations.

Your privacy rights

Subject to POPIA and other applicable law, you may have the right to:

• ask whether we hold personal information about you or your child;
• request access to personal information;
• request correction or updating of inaccurate or incomplete information;
• request deletion or destruction where legally permissible;
• object to certain processing on reasonable grounds;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• request information about the identity of third parties who have had access where applicable;
• lodge a complaint with the Information Regulator; and
• exercise rights available under PAIA in relation to access to records.

We may need to verify identity and authority before releasing, changing or deleting records, especially where a request concerns a child or another person.

Direct marketing and communication preferences

We may send operational school communications that are necessary for enrolment, safety, attendance, fees, events or service delivery. These are different from optional marketing.

Electronic direct marketing will be handled in accordance with POPIA. Where consent is required, we will seek appropriate consent. Marketing messages should provide a reasonable method to opt out.

You may ask us to stop optional marketing communications by using the unsubscribe method provided or contacting us at reception@stepuprynfield.co.za.

Photographs, video and social media

Because the school works with children, photographs and video are treated carefully. We may create photographs or recordings for internal school records, learning activities, events or communications.

Where images are intended for public marketing, the website or social media, we will seek appropriate parent or guardian permission where required. Parents may contact the school to discuss or update media-consent preferences, subject to legitimate archival, legal or safeguarding requirements.

Access to records under PAIA

PAIA gives persons a right, in appropriate circumstances, to request access to records held by public and private bodies where the statutory requirements are met.

A PAIA request relating to Step-Up Rynfield should be submitted to the school’s Information Officer or the person designated to handle access requests. The request should identify the record sought, the requester, the right that is to be exercised or protected where required, and sufficient information to enable the record to be located.

Access may be refused or limited where a ground of refusal under PAIA applies, including where disclosure would unlawfully reveal another person’s private information, confidential information, legally privileged material, security information or other protected records.

Prescribed forms and fees may apply. The Information Regulator publishes a PAIA Guide and prescribed complaint forms for requesters.

Questions and complaints

We encourage you to raise privacy or access concerns with Step-Up Rynfield first so that we can try to resolve the matter promptly.

Information Regulator (South Africa)

If you believe that your personal information has been handled unlawfully, or you have a PAIA complaint, you may contact or lodge a complaint with the Information Regulator.

Changes to this privacy policy

We may update this policy from time to time to reflect changes in law, school practices, technology, services or regulatory guidance. The latest version will be published on the Step-Up Rynfield website with an updated revision date.

Where a change materially affects how personal information is processed, we may take additional reasonable steps to bring the change to the attention of affected persons.