Koa Academy Privacy Policy
Last updated: 21 November 2020
1. Introduction
The right to privacy and this privacy "Policy" is important to us. Koa Academy Proprietary Limited (registration number 2020/779068/07) ("Koa Academy", "us" or "we") is committed to taking steps to protect your privacy when we process your personal information. We therefore implement business practices that comply with applicable data protection laws, including the Protection of Personal Information Act 4 of 2013 ("POPIA"). This Policy applies to all processing of personal information.
Where we refer to "Personal Information" in this Policy, we mean personal information as defined in POPIA, being information that may be used to directly or indirectly identify you. Personal Information includes, for example, a data subject's name, surname, email address, identity number (or company registration number), contact details, photograph and location.
In this Policy, we explain how we will use and protect your Personal Information in compliance with POPIA. "You" means any natural or legal person whose Personal Information we process. Additional terms may also apply to our relationship, depending on whether you are a parent/guardian of a learner that attends Koa Academy or a learner. The terms of this Policy will prevail if there is any conflict between this Policy and any other agreement entered into between us. We may change the terms of this Policy and will always process Personal Information in accordance with the latest version.
In terms of POPIA, Koa Academy processes information as a responsible party for the purposes of managing our relationship and offering our services. We also process certain Personal Information as a responsible party when someone visits our website (even if they are not a parent/guardian or a learner).
Parts of this Policy will apply to you if you are a visitor to our website or where you are a parent/guardian or a learner.
2. Children's personal information and special personal information
Koa Academy will only process personal information of children and special personal information in compliance with POPIA, and therefore with the consent of the learner's parent/guardian (where the learner is under the age of 18). Signature of Koa Academy's school admissions contract by a learner's parent/guardian, and any other specific written consent provided by the parent/guardian, will constitute consent by the parent/guardian for Koa Academy to process the learner's personal information. If necessary, Koa Academy may also process personal information of children and special personal information if provided for in law, for example, where it is necessary for the establishment, exercise or defence of a right or obligation in law or where it is necessary to comply with an obligation of international public law.
3. Collecting Personal Information
We collect Personal Information about you from the following sources:
3.1. directly from you when you provide it to us, such as when you apply to enrol your child as a learner, through our provision of our services and interaction with you, as a parent/guardian or a learner;
3.2. from third parties when you, the parent/guardian or learner, interacts with them and where the parent/guardian has authorised the third party to share any Personal Information with us, such as medical and occupational health practitioners, private after hours tutors, persons providing extra-curricular activities to learners, etc.;
3.3. from third party service providers and platform that we use to provide our services, where the parent/guardian has authorised us to access relevant information stored by or created as a result of those service providers, such as Google (for online classroom facilities and email) and Koa Academy's educational partners;
3.4. from third party sources where you have made Personal Information public; and
3.5. from your use of our website.
4. Categories of Personal Information that we process
4.1. General personal details: name and surname, gender, date of birth, age, nationality, language preferences, identity or passport number of learners and parents/guardians.
4.2. Children's Personal Information: Personal Information of any learner that qualifies as a child in terms of POPIA necessary for us to render the services and with the consent of a parent/guardian. We will only process the Personal Information of children with the consent of a parent/guardian of that child where required in terms of POPIA.
4.3. Special personal information: such as health information about learners (allergies, medication, etc.), information from occupational health professionals, educational psychologists, race or ethnic origin, personal interests and hobbies.
4.4. Contact details: learner and parent/guardian address, contact number, email address.
4.5. School-related information: information about learner's academic performance, use of third party software used by us to provide our services, attendance, behaviour and incident reports, engagement in extra-curricular activities.
4.6. Communication information: Personal Information included in correspondence from parents/guardians and learners.
4.7. Consent records: records of any consents you have given us in respect of using your Personal Information and any related information, such as the specific details of the consent. We will also record any withdrawals or refusals of consent.
4.8. Transaction and payment details: transaction records, payment method, payment amount, date and related information.
4.9. Data relating to our website: such as the type of device used to access the website, operating system and browser, browser settings, IP address, dates and times of connecting to and using the website, cookies and other technologies, and other technical communications information, subject to your browser settings.
4.10. Account details: such as the account information of learners for their access to the online platforms used by Koa Academy in providing the services.
4.11. Content and advertising data: records of your interactions with our online advertising on the various websites which we advertise and records relating to content displayed on our web-pages displayed to you.
4.12. Views and opinions: any views and opinions that you choose to share with us, or publicly post about us on social media platforms or elsewhere.
5. Purposes of processing Personal Information
5.1. We only process adequate and relevant Personal Information for the following purposes and legal bases:
5.1.1. to perform in terms of our agreement with you (the school admissions contract) to provide our services;
5.1.2. operate and manage your account or relationship with us, which includes correspondence with parents/guardians and learners;
5.1.3. monitor and analyse our business to ensure that it is operating properly, for financial management and for business-development purposes;
5.1.4. contact you by email, SMS, a third party school communications app which you have signed up to use, or other means to inform you about our services, unless you have opted-out of such communications (direct marketing);
5.1.5. form a view of you as an individual and to identify, develop or improve our services;
5.1.6. carry out market research and surveys, business and statistical analysis and necessary audits;
5.1.7. fraud prevention;
5.1.8. perform other administrative and operational tasks like testing our processes and systems and ensuring that our security measures are appropriate and adequate; and
5.1.9. comply with our regulatory, legal or other obligations.
5.2. In addition to the above purposes, we may use Personal Information for other purposes if the law allows for it, if you consent to it, or if it is in the public interest to do so. All purposes for the processing of your Personal Information will be legal in terms of POPIA.
6. Direct marketing
6.1. We may process your Personal Information to contact you, the parent/guardian, to provide you with information regarding our services, or the services of our partner organisations, that may be of interest to you. Where we provide services to you (where you are a customer of ours), we may send information to you regarding our services and other information that may be of interest to you, using the contact details that you have provided to us. We will only send you direct marketing communications where you have consented to us sending you direct marketing, or about our services, or otherwise in compliance with POPIA.
6.2. You may unsubscribe from any direct marketing communications at any time by clicking on the unsubscribe link that we include in every direct marketing communication or by contacting us and requesting us to do so.
6.3. After you unsubscribe, we will not send you any direct marketing communications, but we will continue to contact when necessary in connection with providing you with the services or in connection with our business.
7. Disclosure of Personal Information to third parties
7.1. We will keep your Personal Information confidential and only share it with others in terms of this Policy, or if you consent to it, or if the law requires from us to share it. We may disclose your Personal Information to:
7.1.1. our business partners or third party processors in order to provide you with the website, and/or our services, this includes data storage service providers, third party software/platform providers (such as Google, Khan Academy, Boom, etc.) in accordance with written agreements with these parties;
7.1.2. extra-curricular activity providers, educational psychologists, medical and occupational health practitioners;
7.1.3. legal and regulatory authorities, upon their request, or for the purposes of reporting any breach of POPIA;
7.1.4. accountants, auditors, lawyers and other external professional advisors in terms of written agreements with them;
7.1.5. any relevant party to the extent necessary for the establishment, exercise or defence of legal rights, criminal offences, threats to public security, etc.;
7.1.6. any relevant third party if we sell or transfer all or any portion of our business or assets; and
7.1.7. any relevant third party provider where our website uses third party advertising, plugins or content.
7.2. If we engage third party operators to process Personal Information, the operators will only be appointed in terms of a written agreement which will require the third party operators to only process Personal Information on our written instructions, use appropriate measures to ensure the confidentiality and security of Personal Information and comply with any other requirements set out in the agreement and required by POPIA.
7.3. If we share a learner's Personal Information with any third parties, such as where a third party provides services to the learner (extra-curricular activities, additional classes, etc.), it will be with the consent of the parent/guardian or as a result of your instructions/discussions with us.
8. International transfers of Personal Information
8.1. Due to the nature of our services and the resources that Koa Academy makes use of in providing the services, we may need to transfer Personal Information to and from different countries for our business purposes.
8.2. We may transfer Personal Information to recipients in other countries. We will only transfer Personal Information to third parties in countries with adequate data protection laws or do so in terms of a written agreement with the recipient which imposes data protection requirements on that party as required by POPIA.
8.3. Please note that when you transfer any Personal Information directly to a third party in another country (i.e. we do not send your Personal Information to the third party), Koa Academy is not responsible for that transfer of Personal Information (and such transfer is not based on or protected by this Policy). Any Personal Information that we receive from a third party country will nevertheless be processed in terms of this Policy.
9. Security
9.1. We have implemented appropriate technical and organisational security measures designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, disclosure, access and other unlawful or unauthorised forms of processing. These measures are in accordance with POPIA.
9.2. The internet is an open and often vulnerable system and the transfer of information via the internet is not completely secure. Although we will implement all reasonable measures to protect Personal Information, we cannot guarantee the security of your Personal Information transferred to us using the internet. Therefore, you acknowledge and agree that any transfer of Personal Information via the internet is at your own risk and you are responsible for ensuring that any Personal Information that you send is sent securely.
10. Your legal rights
10.1. You have certain rights in relation to your Personal Information. As available and except as limited under POPIA, you have the following rights in respect of your Personal Information:
10.1.1. right of access: the right to be informed of and request access to the Personal Information that we process about you;
10.1.2. right to rectification: you may request that your Personal Information be amended or updated where it is inaccurate or incomplete;
10.1.3. right to erasure: the right to request that we delete your Personal Information, subject to applicable limitations and exceptions;
10.1.4. right to restrict processing: you may request that we temporarily or permanently stop processing your Personal Information;
10.1.5. right to object:
10.1.5.1. you may object to us processing your Personal Information; and
10.1.5.2. to your Personal Information being processed for direct marketing purposes;
10.1.6. right not to be subject to automated decision-making: where a decision that has a legal or other significant effect is based solely on automated decision making, including profiling, you may request that your Personal Information not be processed in that manner.
10.2. Where you have provided consent for us to process your Personal Information, you may also withdraw your consent where our processing is based on your consent. However, we may continue to process your Personal Information if another legal justification exists for the processing.
11. Use of cookies and similar technologies
11.1. When you use our website we automatically receive and record information on our server logs from your browser. This information may include, amongst others, your location, IP address, cookie information and Google Analytics information. This is statistical data about browsing actions and patterns. We may also obtain information about your general internet usage through a cookie file which is stored on the hard drive of your computer. Cookies enable us to improve our website and services, estimate our audience size and usage patterns, store information about your preferences and recognise when you return to the website.
11.2. In some instances, we collect and store information about your location through cookies (other than when you share your location with us). We convert your IP address or mobile GPS data into a rough geo-location, and we may use location information to improve and personalise the website and services for you.
11.3. You can set your web browser to refuse cookies, but if you do this you may not be able to enjoy the full use of the website or services and you may not be able to take advantage of certain promotions we may run.
11.4. Please note that third parties may also use cookies, but we do not have access to, or control over them, and therefore cannot take responsibility for them.
12. Links on our website and third party services
Our website may include links to third party websites, and we make use of third party services and platforms to provide the services, but these websites and services/platforms do not fall under our supervision. We cannot accept any responsibility for your privacy or the content of these third party sites, but we display these links in order to make it easier for you to find information about specific subjects and make use of these third party services and platforms to provide our services. Your use of and reliance on these links is at your own risk.
13. Right to object
You may, on reasonable grounds, object to us using your Personal Information for certain purposes. If you object, we will stop using your Personal Information, except if POPIA allows its use. To exercise this right or to discuss it with us, please contact us on info@koaacademy.com
14. Quality and access to your information
14.1. Quality: we want to ensure that your Personal Information is accurate and up to date. You may ask us to correct or remove any Personal Information that you think is inaccurate, by sending us an email on info@koaacademy.com
14.2. Access: you have the right to request that we provide you with Personal Information that we hold about you. You must contact us directly to do so or send an email to info@koaacademy.com. This request may be subject to an access to information request in terms of POPIA and may require you to verify your identity, identify the rights you are wishing to exercise and pay a fee.
14.3. The right to access your Personal Information may further be limited in terms of POPIA.
15. Retention of information
15.1. We take every reasonable step to ensure that your Personal Information is only processed for the minimum period necessary for the purposes set out in this Policy.
15.2. We retain Personal Information in accordance with the required retention periods in POPIA or as required by other laws or regulations, or for legitimate business purposes. We will only retain your Personal Information for the purposes explicitly set out in this Policy. We may keep Personal Information indefinitely in a de-identified format for statistical purposes, which may include for example statistics of how you use the website and services.
15.3. This Policy also applies when we retain your Personal Information.
15.4. We may retain your Personal Information for the duration of any period necessary to establish, exercise or defend any legal rights.
16. Security breach
We will report any breach of Personal Information to the Information Regulator in terms of POPIA and to the persons whose Personal Information is involved in the breach. If you want to report any concerns about our privacy practices or if you suspect any breach regarding your Personal Information, kindly notify us by sending an email to info@koaacademy.com .
17. Lodging a complaint
17.1. If you want to raise any objection or have any queries about our privacy practices, you can contact our data protection officer on info@koaacademy.com.
17.2. You also have the right to formally lodge a complaint to the Information Regulator in terms of POPIA with the following contact details:
17.2.1. Website: https://www.justice.gov.za/inforeg/
17.2.2. Address: 33 Hoofd Street, Forum III, 3rd Floor Braampark, P.O Box 31533, Braamfontein, Johannesburg, 2017, South Africa
17.2.3. Tel: +27 10 023 5207
17.2.4. Email: inforeg@justice.gov.za