How EduKZN collects, uses, shares and protects personal information — and the rights you have under the Protection of Personal Information Act 4 of 2013.
Last updated 2026-10-25 ·
EduKZN School Management Systems
EduKZN processes personal information as an operator on behalf of the school, and as a responsible party for its own business records. Where your school is the responsible party, direct data subject requests to the school first — we assist the school in responding.
Who we are and what this notice covers
EduKZN School Management Systems ("EduKZN", "we", "us") supplies school management systems — online enrolments, attendance, billing, transport, boarding, academics, announcements and a parent portal — to schools across South Africa.
This notice explains how we handle personal information in two distinct roles. When we host and operate a school's platform, we act as an operator and process learner, guardian and staff information strictly on that school's written instruction. When we manage our own enquiries, contracts, invoices and website analytics, we act as a responsible party in our own right.
It applies to our public website, the enquiry forms on it, the platforms we operate for schools, and any communication you have with our team.
Information we collect
We collect only what a specific purpose requires. Depending on how you interact with us, this may include:
Contact details you submit through our enquiry form — name, school, email address, telephone number and the message you write.
School and learner records loaded into a platform we operate: learner particulars, guardians and emergency contacts, class and grade placement, attendance registers, assessment marks, hostel and transport assignments.
Financial records needed for billing: payer details, fee accounts, payment references and transaction outcomes. We do not store full card numbers; card data is handled by a registered payment provider.
Staff records for schools using the staff module: names, roles, contact details and employment metadata.
Technical data generated when you use our website or platforms — IP address, browser and device type, pages requested and timestamps — together with one essential session cookie.
We do not knowingly collect information from children through our public website. Learner information reaches us only through a school that has the authority to share it with us, or through a guardian acting on the learner's behalf.
Why we process your information
We process personal information for the following purposes, and we do not use it for anything else without a lawful basis:
Responding to enquiries and preparing proposals or quotations you have asked for.
Performing our contract with a school — hosting, maintaining and supporting the platform it has subscribed to.
Delivering the platform's core functions: enrolment intake, attendance registers, billing runs, transport rosters, hostel administration, academic reporting and announcements.
Communicating operational notices such as maintenance windows, security advisories and changes to terms.
Complying with legal obligations, including tax, company and access-to-information law.
Protecting the platform against fraud, abuse and unauthorised access — including the abuse-throttling described below.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that already took place, or processing we are required to continue by law.
Learner and special personal information
Information about a child is special personal information under POPIA and we treat it accordingly. Schools instruct us to process it, and we do so only for the educational and administrative purposes of that school.
We do not sell learner information, we do not use it for advertising or profiling, and we do not disclose it to third parties beyond the operators listed below. Access inside a school's platform is role-based, scoped down to grade and class level, and every record view or change is written to an audit log.
Health, medical, disciplinary and financial-hardship notes, where a school chooses to record them, are held in restricted fields that only designated staff roles can open.
Sharing and operators
We share personal information only where it is necessary and lawful. Our operators — service providers who process information on our instruction — are bound by written agreements requiring confidentiality and POPIA-compliant safeguards. They include:
Data-centre and hosting providers, where the platform's servers and backups live.
Email and SMS delivery providers, used to send enrolment confirmations, statements and notifications.
Registered payment providers, for collecting school fees and processing our own invoices.
Professional advisers — auditors, accountants and attorneys — where legally required or necessary to protect our rights.
A regulator, court or law-enforcement body, where the law compels disclosure.
We do not share personal information with advertisers, data brokers or social-media platforms. An operator may not use your information for its own purposes.
Where your information is held
Our default hosting is in South African data centres within the borders of the Republic. Some schools elect a self-hosted deployment on premises, in which case the information never leaves their estate and they remain in full control of it.
If an operator we use stores data outside South Africa, we only do so where POPIA section 72 is satisfied — the recipient is subject to a law or binding agreement that provides an adequate, comparable level of protection.
How long we keep it
We keep personal information only as long as a purpose or a law requires it, and then destroy, delete or de-identify it.
Website enquiries — retained for up to 24 months from our last contact with you, then deleted.
School platform records — retained for the duration of the school's subscription and returned or destroyed on termination, subject to the retention periods the school itself is bound by.
Financial records — retained for the statutory period required by tax and companies legislation (currently five years from the end of the relevant tax year).
Audit and access logs — retained for up to 12 months, for security and incident investigation.
Where a school instructs us to delete records, we coordinate the deletion across live systems, replicas and backup rotation cycles, and confirm completion in writing.
Cookies and similar technologies
This website is deliberately light on tracking. We set one essential cookie, edukzn_sid, which holds a session identifier used to protect the enquiry form against cross-site request forgery and to remember one-time status messages. It carries no advertising or profiling data and expires when your browsing session ends.
The cookie is marked HttpOnly and SameSite, and Secure whenever the site is served over HTTPS. A small local-storage key, edukzn.consent.v1, remembers that you have dismissed our privacy prompt — it stays on your device and is never transmitted to us.
The platforms we operate for schools also use an essential session cookie to keep a signed-in user authenticated. That cookie is required for the service to function and shares the same protections.
We do not use advertising cookies, third-party social plug-ins, cross-site tracking pixels or behavioural profilers. You can block or delete cookies in your browser at any time; the enquiry form may then reject a submission because it cannot verify the request token.
How we protect it
We apply administrative, physical and technical safeguards appropriate to the sensitivity of the information, and we review them as the platform evolves.
Encryption in transit (TLS) for every connection, and encryption at rest for databases and backups.
Role-based access control scoped to grade, class and function, with least-privilege defaults.
Server-side validation of all input, output escaping, parameterised database queries and cross-site request forgery tokens on every state-changing request.
Rate limiting and bot defences on public forms, plus audit logging of administrative actions.
Confidentiality undertakings for every staff member and contractor with access to personal information.
If a security compromise occurs that affects your personal information, we notify the Information Regulator and every affected school or data subject as soon as reasonably possible after discovery, in line with section 22 of POPIA.
Your data subject rights
POPIA gives you the following rights. We respond to valid requests within 30 days. Requests concerning information held by a school on its platform should be directed to that school, which is the responsible party; we assist the school in fulfilling them.
To be notified that your personal information is being collected, and to know whether we hold it.
To request access to the personal information we hold about you, and to ask what it has been used for.
To request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.
To object, on reasonable grounds, to processing — including processing for direct marketing, which you may refuse at any time.
To withdraw consent you previously gave, without affecting processing already carried out.
To lodge a complaint with the Information Regulator.
To not be subject to a decision based solely on automated processing that significantly affects you, where that decision profiles you.
To exercise a right, write to our Information Officer using the contact block at the end of this notice. We may ask you to verify your identity before we release or change information, so that we never disclose it to the wrong person.
Complaints and the Information Regulator
If you believe we have handled your personal information unlawfully, please raise it with our Information Officer first — most concerns are resolved quickly at that level.
If you are not satisfied, you may complain to the Information Regulator (South Africa), the body that enforces POPIA and PAIA. Complaints may be submitted at inforeg.org.za, by email to complaints.IR@justice.gov.za, or by post to the Information Regulator, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
Changes to this notice
We review this notice at least annually and whenever we change how we process personal information. The date at the top of the page always reflects the current version. Material changes are notified to schools directly and, where the change affects you, through the platform or by email before they take effect.
