Privacy Policy
Last updated: July 2026 · Compliant with the Protection of Personal Information Act (POPIA), 2013
1. Who We Are
My School Admin is operated by Nuur Digital (Pty) Ltd, a cloud-based school administration platform designed for schools, academies, and training centres in South Africa. We act as an Operator (data processor) on behalf of schools, which are the Responsible Parties (data controllers) under POPIA.
This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with POPIA, PAIA, the ECT Act, the Consumer Protection Act, and RICA.
Information Officer: info@my-school-admin.co.za
2. Data Controller and Processor Roles
2.1 Schools as Responsible Parties
Schools subscribing to My School Admin are the Responsible Parties under POPIA. They determine the purposes and means of processing personal information of their learners, parents/guardians, teachers, and staff. Schools are responsible for obtaining all necessary consents, ensuring data accuracy, and responding to data subject access requests.
2.2 My School Admin as Operator
We process personal information solely on behalf of subscribing schools, under their instruction, within the boundaries of our service agreement. Our obligations include treating all information as confidential, implementing appropriate security measures, notifying schools of any suspected breach, and deleting or returning data upon termination.
3. Children's Personal Information
Our platform processes personal information of children under 18. Processing requires the consent of a parent or legal guardian (POPIA Section 35). Schools are responsible for obtaining this consent.
Safeguards for Children's Data
- Minimum data collection — only information necessary for educational management
- No marketing — never used for marketing, profiling, or behavioural analysis
- No third-party sharing — never shared with advertisers or data brokers
- Strict access controls — only authorised staff within the child's school
- Data isolation — each school's data is logically isolated at database level
- Parental access — parents can view their child's information through the parent app
Categories of Children's Data
| Category | Examples | Purpose |
|---|---|---|
| Biographical | Name, date of birth, gender | Identification and administration |
| Academic | Grades, assessments, progress reports | Educational tracking and reporting |
| Attendance | Daily attendance, check-in/out times | Safety and compliance |
| Health (Special) | Allergies, medical conditions, dietary needs | Safety and emergency response |
| Contact | Emergency contacts, parent details | Communication and emergencies |
4. Special Personal Information
Under POPIA Sections 26–33, health information (allergies, chronic conditions, medication) is classified as special personal information. We process this only with consent obtained by the school, for the vital interest and safety of the child. It is encrypted at rest and in transit, with access restricted to authorised staff.
5. Information We Collect
School Administrators
- Name, email, phone number — account management and communication
- Authentication credentials — secure access
- School details (name, address, type) — platform configuration
- Billing information (via PayFast) — subscription management
Teachers / Staff
- Name, email, phone number — account management and communication
- Class/subject assignments — platform functionality
- Teaching schedule — timetable management
Parents / Guardians
- Name, email, phone number — account management and communication
- Relationship to learner(s) — access control
- Communication preferences — notification delivery
Learners
- Biographical details, academic records, attendance records
- Health information, class assignments, progress reports
- Daily updates (ECD/preschool), check-in/out records
6. Legal Basis for Processing
| Ground | Application |
|---|---|
| Contract performance | Delivering services under the subscription agreement |
| Consent | Children's data, special personal information, marketing |
| Legal obligation | Financial record-keeping (7 years), tax compliance |
| Legitimate interest | System security, fraud prevention, service improvement |
7. What We Do NOT Do
- We do not sell, rent, trade, or share personal information with advertisers or data brokers
- We do not use data for advertising, ad targeting, or behavioural profiling
- We do not collect location/GPS data, contact lists, biometric data, browsing history, or social media data
- We do not use Google Analytics, Meta Pixel, or any advertising tracking on the platform
8. Data Storage and Security
Data Location — South Africa
All personal information is stored on infrastructure hosted in South Africa by Hetzner South Africa in Cape Town. Your data does not leave South African borders.
Security Measures
- All data encrypted in transit (TLS 1.3) and at rest
- Dedicated server infrastructure with network firewalls and DDoS protection
- Role-based access control with principle of least privilege
- Multi-tenant data isolation — each school's data logically separated
- Web Application Firewall (WAF) with OWASP Core Rule Set
- JWT-based authentication with short-lived tokens and refresh rotation
- Automated daily backups retained for 30 days
- Microservice architecture — compromise in one service doesn't expose another
- Rate limiting, input validation, and parameterised queries
9. Third-Party Service Providers
| Provider | Purpose | Location |
|---|---|---|
| Hetzner South Africa | Server hosting | Cape Town, SA |
| PayFast (Paystack Payments SA) | Payment processing | South Africa |
| Google Firebase (FCM only) | Push notification delivery | EU/US (anonymous tokens only) |
| SMTP Provider | Transactional email | Google infrastructure |
We never see, store, or process your full payment card details.
10. Data Retention
| Category | Retention Period |
|---|---|
| Active learner records | Duration of enrolment |
| Archived learner records | 5 years after departure |
| Academic records | 7 years |
| Financial/billing records | 7 years |
| Attendance records | 3 years after academic year |
| Communication logs | 2 years |
| Inactive school accounts | 1 year, then deleted |
| Deleted school accounts | 90-day grace, then permanently deleted |
11. Your Rights Under POPIA
You have the right to:
- Access — request confirmation and a copy of personal information we hold
- Correction — request correction of inaccurate or incomplete information
- Deletion — request deletion where it is no longer necessary or consent is withdrawn
- Objection — object to processing on grounds of legitimate interest or direct marketing
- Portability — receive your data in CSV or JSON format
- Complaint — lodge a complaint with the Information Regulator
Parents and teachers: contact your school administrator first.
School administrators: contact us at info@my-school-admin.co.za.
We respond within 30 days.
12. Data Breach Response
In the event of a security compromise:
- We notify the Information Regulator as soon as reasonably possible
- Critical breach (confirmed access): affected schools notified within 24 hours
- Suspected breach: within 48 hours
- Schools are responsible for notifying their own data subjects
13. Cookies and Tracking
Our platform uses only:
- Session cookies — strictly necessary for authentication
- Preference cookies — remembering display settings
We do not use analytics cookies, advertising cookies, or third-party tracking scripts on the platform.
14. Direct Marketing
- Service-related communications to administrators (billing, updates, security) cannot be opted out of
- Personal information of learners, parents, and teachers is never used for direct marketing
- Administrators may opt out of promotional communications at any time
15. International Data Transfers
We do not transfer personal information outside South Africa. The limited exception is anonymous push notification device tokens sent to Firebase Cloud Messaging — these are not linked to any individual's identity.
16. Policy Updates
For material changes, we provide 30 days' written notice via email to school administrators. The updated policy will be posted here. Continued use after the effective date constitutes acceptance.
17. Contact Us
Email: info@my-school-admin.co.za
Website: https://my-school-admin.co.za
18. Information Regulator
If you are not satisfied with our response, you may lodge a complaint with:
The Information Regulator (South Africa)
Website: https://inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Physical: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001