POPIA Compliance

What is POPIA?

The Protection of Personal Information Act (POPIA), Act 4 of 2013, is South Africa's primary data protection law. It came into full effect on 1 July 2021 and governs how organisations collect, store, use, share, and destroy personal information about individuals.

POPIA is enforced by the Information Regulator of South Africa and applies to any organisation that processes personal information within South Africa, including schools, EdTech platforms, and software companies like iSkool.

Who We Are (Responsible Party)

The responsible party for personal information processed through iSkool is:

What Personal Information We Collect

We collect only the personal information necessary to provide the iSkool platform. This includes:

School administrators and teachers:

• Full name and professional role
• Work email address and phone number
• School name, EMIS number, province, and school type
• Usage data (login times, features accessed)

Learners:

• First name and surname
• Grade and class
• Assessment scores, submission data, and gradebook records
• AI Invigilator session data (tab switches, focus events) during live assessments only

Parents / guardians:

• Name and email address (provided by the school)
• Communication records with teachers

Why We Collect It (Purpose Specification)

All personal information collected by iSkool is collected for specific, explicitly defined, and lawful purposes related to delivering the iSkool platform to schools. These include:

• Creating and managing user accounts for teachers, learners, and parents
• Delivering assessments and recording results in the gradebook
• Monitoring assessment integrity via the AI Invigilator
• Providing analytics and reports to teachers, HODs, and principals
• Enabling parent-teacher communication
• Providing technical support and responding to queries
• Complying with our legal obligations under South African law

We do not use personal information for advertising, profiling for third parties, or any purpose incompatible with the above.

The Eight Conditions for Lawful Processing

POPIA sets out eight conditions that all responsible parties must comply with. Here is how iSkool meets each one:

Your Rights as a Data Subject

Under POPIA Section 5, every data subject whose personal information we hold has the following rights:

Learner Data and Minor Protections

iSkool processes personal information about learners, who may be minors (persons under 18). We take this responsibility seriously and apply additional protections:

• Learner accounts are created by the school, not by learners themselves, ensuring institutional oversight.
• Learner data is only accessible to their assigned teachers, HOD, and principal within the same school.
• We do not display learner data publicly or make it accessible outside the school's institutional account.
• AI Invigilator data is accessible only to teachers and administrators at the relevant school, and solely for academic integrity purposes.
• Schools are required under our Terms of Service to inform learners and their parents that monitoring occurs during assessments.

Security Safeguards

We implement appropriate technical and organisational measures to prevent loss, damage, or unauthorised access to personal information. These include:

• Encryption: All data transmitted between users and iSkool is encrypted using TLS. Sensitive stored data is encrypted at rest.
• Access controls: Role-based access ensures users only see information relevant to their role (learner, teacher, principal).
• Data hosting: iSkool data is hosted by Namecheap, Inc. on servers located in the United States. This cross-border transfer is carried out in accordance with POPIA Section 72. Namecheap is contractually bound by their own data protection commitments.
• Regular security reviews: We conduct regular security assessments of our infrastructure and code.
• Staff training: All iSkool staff with access to personal information are trained on their POPIA obligations.
• Data integrity: iSkool takes reasonable measures to ensure data availability and integrity through backup and recovery processes maintained by our hosting provider.

Data Retention

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law. Our retention periods are:

• Active accounts: Personal information is retained for the duration of the school's subscription or pilot agreement.
• After account closure: Data is retained for 12 months after account deactivation, to allow for data export requests. It is then permanently deleted.
• Assessment records: Assessment scores and gradebook data may be retained for up to 24 months to support academic record requirements, unless the school requests earlier deletion.
• Legal holds: In the event of a legal dispute or regulatory investigation, we may retain relevant data for longer as required by law.

Third-Party Operators

iSkool uses a limited number of trusted third-party service providers (operators) to deliver the platform. All operators are contractually bound to process personal information only on our instructions and in compliance with POPIA.

• Cloud infrastructure: Namecheap, Inc. — servers and databases (United States). Namecheap processes data solely to host and serve the platform and is bound by their data protection commitments.
• Email delivery: For transactional system emails (password resets, notifications)
• Error monitoring: For platform stability and debugging (anonymised where possible)

We do not sell personal information to third parties. We do not share personal information with advertisers. We do not share data with any party beyond what is required to deliver the iSkool service.

Cross-Border Transfers

iSkool data is hosted by Namecheap, Inc. on servers located in the United States of America. This means that personal information collected through the iSkool platform is transferred outside of South Africa for storage and processing purposes.

This cross-border transfer is carried out in accordance with POPIA Section 72. By using the iSkool platform, schools and users acknowledge and consent to this transfer. We have taken the following steps to ensure your data remains protected:

• Namecheap, Inc. is contractually bound by their own privacy policy and terms of service, which govern the security and handling of data on their infrastructure.
• All data in transit between your device and our servers is encrypted using TLS/HTTPS.
• Namecheap processes your data solely to host and serve the iSkool platform and does not use it for any other purpose.

Cookies and Tracking Technologies

The iSkool platform uses session cookies strictly to maintain your logged-in state while using the platform. We do not use advertising cookies, preference cookies, or third-party tracking of any kind.

• Session cookies: Required to keep you logged in while using the platform. These expire when you close your browser.
• Internal platform data: iSkool's own backend systems record standard activity data such as login events and feature usage to maintain and improve the platform. This data stays on iSkool's servers and is never shared with third parties.

By using the iSkool platform, you consent to our use of essential session cookies. You can disable cookies in your browser settings, but this will affect your ability to log in and use the platform.

Data Breaches

In the event of a data breach that compromises personal information, iSkool will:

• Notify the Information Regulator as soon as reasonably possible after becoming aware of the breach, in the prescribed manner.
• Notify all affected data subjects (schools, teachers, and where relevant, learners and parents) of the nature of the breach, what information was affected, and the steps being taken.
• Conduct a post-incident review and implement remediation measures to prevent recurrence.

Exercising Your Rights

To exercise any of your rights under POPIA (access, correction, deletion, objection, or withdrawal of consent), please submit a written request to our Information Officer. Requests must include:

• Your full name and the email address associated with your iSkool account
• The name of your school
• A clear description of the right you wish to exercise and the specific information concerned
• A copy of a valid form of identification (ID or passport)

We will acknowledge your request within 3 business days and respond fully within 30 business days, as required by POPIA regulations (Form 2).

Contact Us & Complaints

For any POPIA-related queries, concerns, or complaints, contact our Information Officer:

If you are not satisfied with our response to a complaint, you have the right to escalate the matter directly to the Information Regulator of South Africa at inforeg.org.za.