Privacy notice

Our role

For learner and school records on the platform, the school is the responsible party and Classly is the operator — we process that information on the school’s instructions to provide the platform.

For information about account holders themselves (for example, a parent’s or staff member’s own contact and login details), Classly may act as responsible party. This notice covers both.

Information we collect

Depending on your role, this may include: name and contact details; school, grade and class; login and account details; behaviour, merit, attendance, detention and intervention records; messages and notification preferences; and technical information needed to run and secure the platform.

Children’s information

The platform processes the personal information of learners, who are children. POPIA gives children’s information special protection (sections 34 and 35). We process it only on the school’s instructions and apply heightened care, including access controls and separation of each school’s data.

Why we process it

To provide the platform; to record and manage discipline, behaviour, attendance, detentions, merits and interventions; to communicate with parents and staff; to send notifications; to provide analytics to the school; to keep the platform secure; and to meet legal obligations.

Who we share it with

We share information with the relevant school, and with service providers who help us run the platform — our hosting and database providers and our email provider — under contracts that require them to protect it. We do not sell personal information.

Processing outside South Africa

Some of our service providers may process information outside South Africa. Where this happens, we take the steps required by section 72 of POPIA to ensure the information receives an adequate level of protection.

How we protect it

We use appropriate, reasonable technical and organisational measures, including encryption in transit, access controls, separation of each school’s data, logging and regular backups, and we develop the platform against recognised application-security standards (OWASP ASVS Level 2 and the OWASP API Security Top 10).

How long we keep it

We keep personal information for as long as needed to provide the platform to the school and as required by law. When a school’s subscription ends, we make its data available for export and then delete or de-identify it, subject to backup cycles and legal requirements.

Your rights

Subject to POPIA, you may ask to access your personal information, to correct or delete it, or to object to certain processing.

For learner and school records, please direct your request to the school; we will assist the school in responding. For information where Classly is the responsible party, contact our Information Officer below.

POPIA Operator Agreement (for schools)

Because Classly processes personal information on a school’s behalf, every school subscription includes a POPIA Operator Agreement — the written contract required by section 21 of POPIA, forming part of the Master Subscription Agreement.

It commits Classly to process personal information only on the school’s documented instructions; to maintain the security safeguards required by sections 19 and 21 (tenant isolation between schools, role-based access control, encryption in transit, logging and regular backups); to bind any sub-operators to equivalent obligations; to notify the school immediately of any security compromise (sections 21(2) and 22); to handle trans-border processing in line with section 72; and to return or delete the school’s data when the subscription ends.

Schools can request a copy of this agreement from the Information Officer.

Contact us

Information Officer: Murendeni Kwinda. Email: info@classlyempowering.co.za. Address: 4298 Joshua Nkomo Street, Mohlakeng, Randfontein.

Complaints to the regulator

If you are not satisfied, you may complain to the Information Regulator (South Africa). Website: inforegulator.org.za. POPIA complaints: POPIAComplaints@inforegulator.org.za. PAIA complaints: PAIAComplaints@inforegulator.org.za.

Changes to this notice

We may update this notice from time to time. The current version and its effective date appear at the top of this page.