Privacy Policy

Responsible party: DUZATHS PRO MATSCIENCE PRIVATE TUTORING (Pty) Ltd, trading as DPM Academy ("DPM Academy", "the academy", "we", "us", "our"). Company registration number: 2023/727988/07 · VAT number: 9269724259 Registered and trading address: 13992 Mojela Street, KwaThema Ext 2, Springs, Gauteng, 1575 Website covered by this policy: www.dpmacademy.co.za · Version: 1.0

1

1. About this policy

DPM Academy is a South African tutoring academy. Most of our learners are children — under the age of 18 — so protecting their personal information is at the heart of how we work. This policy explains, in plain language, what personal information we collect, why we collect it, who we share it with, how long we keep it, how we keep it safe, and the rights you have over your own information.

We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy is written to meet POPIA, and where relevant the Electronic Communications and Transactions Act (ECTA) and the Consumer Protection Act (CPA). South African law governs it.

If you are a parent or guardian deciding whether to enrol a child with us, section 4 is written especially for you.

2. Who is responsible, and how to reach us

Our Information Officer is registered with the Information Regulator and is accountable for how we handle personal information.

You can use these details for any privacy question, to exercise your rights (section 12), or to make a complaint (section 16).

3. The personal information we collect

We collect only what we need, and we group it by the purpose it serves.

To assess an application. A learner's name and email address, current school, grade, subjects and preferred campus, and whether the learner is returning, from a host school, or sponsored. Where a parent or guardian applies, we also collect that adult's name, their relationship to the learner, and their email address. Supporting documents may include proof of indigency (to assess fee eligibility) and academic transcripts. We do not ask for identity documents.

To deliver teaching. Enrolments, timetables and attendance; assessment submissions and uploaded answer scripts; marks and grades; and e-learning activity such as lesson progress, the last position reached in a video, and a record of quiz answers.

To identify learners on campus. A photograph and an access card carrying a QR token.

To administer accounts. Names, date of birth, contact details, home address, school, a short biography and a profile photograph.

To bill. Registration fees, subscriptions, payments and payment history, processed through a South African payment provider. We never see or store card numbers — the payment provider handles the card details, and only a payment reference returns to us.

To link a parent to a learner. The parent's name, relationship, contact details, their own account, and the verified link between them.

To recruit. For job applicants: name, contact details, a CV, qualifications, experience and a motivation letter.

From every visitor to our website. IP address, browser and device information, the pages viewed and the site you came from. Analytics information is collected only after you consent (see section 8).

Is it compulsory to give us this information?

Most of it is voluntary in the sense that you choose whether to apply or enrol — but some of it we cannot do without.

• Required to enrol and to teach: the learner's name, contact details, grade and subject choices, and — where the learner is under 18 — a parent or guardian's details and consent. Without these we cannot process an application, create an account, or provide tutoring, and we will not be able to enrol the learner.
• Required to bill: the information needed to raise and collect fees. Without it we cannot maintain an account.
• Voluntary: proof of indigency. You only need to give it if you are asking to be assessed for reduced fees; not giving it means we assess your fees at the standard rate. It has no other effect.
• Voluntary: a profile photograph and biography, newsletter subscription, and anything you type into a free-text field. Declining these does not affect enrolment, teaching or fees.

Where the law requires us to keep information — tax records, for example — we must retain it even if you later ask us to delete it. Section 12 explains this.

Special personal information

We do not seek special personal information. Proof of indigency reveals a household's financial circumstances; we use it only to assess fee eligibility, and we delete the document as soon as eligibility is verified — after that we keep only a record that verification took place (see section 10).

4. Children and parental consent

Most of our learners are children under 18. Under POPIA (sections 34–35), a child's personal information may be processed only with the consent of a competent person — a parent or legal guardian. This is the most important commitment in this policy.

Applying. The application form asks who is completing it — the learner, if they are 18 or older, or a parent or legal guardian. Where a parent or guardian applies, we record their name, their relationship to the learner, their email address, and the date and version of this policy they accepted.

Verifying. After an application by a parent or guardian, we email that adult a unique confirmation link. We do not treat consent as given until the person who holds that mailbox uses the link to confirm it. Confirming creates the parent or guardian's own account with us and links them to the learner, so that they can see and manage the learner's information from then on. Where a parent or guardian cannot use email, our staff confirm consent by telephone or in person instead, and we record who verified it and how.

Enforcing. A learner whose application was completed by a parent or guardian cannot be enrolled until that consent is confirmed. This is enforced by our systems, not merely by procedure.

Maintaining. Consent can be withdrawn at any time by contacting our Information Officer, and we keep a record of who withdrew it and when. If a consent request is never answered, we follow it up rather than leaving an application unresolved. When a learner turns 18, we ask them to consent for themselves.

POPIA does not prescribe a particular method for verifying a competent person's consent. Our approach is to require a real, reachable adult to act, and to keep evidence of who consented, when, and to which version of this policy. We do not claim any statutory certification of this method.

5. Why we process your information, and our lawful basis

We rely on the following lawful bases under POPIA section 11:

6. Photographs

We use a learner's photograph on their access card so that we can identify them on campus. This is part of providing our service.

We also use learner photographs in marketing — for example on posters, our website, our blog, and social media. This is a different purpose, and we only do it with your separate, specific consent, which you can withdraw at any time. Withdrawing it removes the learner from future marketing use. We do not treat one enrolment tick-box as covering both uses.

7. Marketing and communications

We send administrative messages you need to receive as part of the service (for example, enrolment, billing and account messages).

For marketing and newsletters, subscription is double opt-in: an address becomes mailable only after the person holding that mailbox confirms it. Every marketing message carries an unsubscribe link that works without an account. When someone unsubscribes, we honour the objection permanently — we keep only a one-way suppression record so that we do not accidentally contact them again, and not a readable marketing list.

We treat marketing to people who are not yet customers as requiring their prior consent, in line with POPIA section 69.

8. Cookies and similar technologies

Nothing that is not strictly necessary loads before you choose. Strictly necessary cookies (for signing in, security and remembering your cookie choice) are always on. Analytics cookies load only after you consent, and you can change your choice at any time from the cookie banner or the footer; withdrawing consent removes what the earlier consent allowed. The map on our contact page and embedded videos load only when you ask for them.

Full details — every cookie, its purpose, and how long it lasts — are in our Cookie Policy at www.dpmacademy.co.za/cookies.

9. Who we share your information with

We share personal information only with operators who process it on our instruction, under contract, for the purposes described. We do not sell personal information, and we do not share it for anyone else's marketing.

Cross-border transfers

Our application, primary database and uploaded files are all kept in South Africa. Some information is processed outside South Africa: an off-site backup copy of our database in Ireland, email through a provider in France, and analytics, content-delivery, video and map services in the United States. POPIA section 72 requires a lawful basis for each transfer. We rely, as applicable, on: the transfer being necessary to perform our contract with you; the operator being bound by an agreement that provides an adequate level of protection; or your consent (for analytics). Uploaded documents and photographs do not leave South Africa.

10. How long we keep information, and how we dispose of it

We keep personal information only as long as we need it, on the schedule below, after which it is deleted or anonymised.

Anonymisation. Where the schedule says a record is anonymised, we remove the identifiers and keep only statistics; anonymised records cannot be linked back to a learner.

Legal hold. Where a record is subject to a dispute, an investigation, or a legal obligation, we keep it until the matter is resolved, and we record the reason.

11. How we keep your information secure

We take the security of personal information seriously, and we can describe our measures specifically rather than in vague terms. We use:

• HTTPS across the whole site, with traffic proxied and filtered at the edge;
• passwords stored only in hashed form — never recoverable;
• short-lived session tokens (five minutes for access, seven days for renewal), held in cookies that JavaScript cannot read;
• rate limiting on sign-in;
• role-based access, so learners, guardians, tutors and staff each see only what they should — a guardian sees only learners they are verifiably linked to, and a tutor only learners in the courses they teach;
• uploaded documents served only through an authorisation gate — they are never publicly addressable;
• hosting of the application and database in South Africa, with encrypted off-site backups on a bounded retention;
• least-privilege access for staff, reviewed periodically.

We do not claim any external security certification.

Data breaches. If a security compromise creates a risk to your personal information, we will notify the Information Regulator and the affected people as soon as reasonably possible, as POPIA section 22 requires.

12. Your rights, and how to use them

You have the following rights over your personal information under POPIA:

• Access — ask us for a copy of the personal information we hold about you, and who we have shared it with.
• Correction — ask us to correct information that is wrong or out of date. You can update your profile, contact details and address yourself; academic and billing records, which we must keep accurate as records, are corrected on request.
• Deletion — ask us to delete your account and your personal information. We will tell you what we can delete and what we must keep by law (financial records above all).
• Objection — object to certain processing.
• Withdraw consent — including your cookie choices (from the banner or footer) and marketing (from any marketing message's unsubscribe link).
• Complain to the Information Regulator — at any time, and without going through us first. Contact details are in section 16.

A parent or guardian may exercise any of these rights on behalf of a learner they are verifiably linked to.

You can exercise these rights at any time by contacting our Information Officer using the details in section 2. We respond within 30 days. Every request is logged with the date we receive it. Where self-service tools are available in your account — updating your profile, managing cookie preferences, or unsubscribing — you may also use those for the same outcome.

13. Access to information (PAIA)

The Promotion of Access to Information Act (PAIA) gives you a route to request access to records we hold. We have appointed a registered Information Officer and publish a PAIA Manual, which describes the records we hold and how to request them. It is available at www.dpmacademy.co.za/paia, and from our Information Officer on request.

Note that the two routes are different. If you are asking for your own personal information, use section 12 — there is no fee and you do not have to justify the request. PAIA is the route for anyone else's information, and for records that are not personal information.

14. What we do not do

• We do not make decisions about you by automated means alone, and we do not profile you.
• We do not sell your personal information.
• We do not share your information for anyone else's marketing.

15. Free-text fields

Our contact form, motivation letters and document descriptions accept free text, and we ask you not to include sensitive details such as health or financial information. Anything you do submit is handled under this policy.

16. Complaints

If you are unhappy with how we handle your personal information, please contact our Information Officer first (section 2) so that we can try to resolve it. You also have the right to complain to the regulator:

Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: enquiries@inforegulator.org.za · Complaints: POPIAComplaints@inforegulator.org.za Telephone: +27 (0)10 023 5200 (Please confirm the Regulator's current contact details at inforegulator.org.za before publication.)

17. Changes to this policy

We record the version of this policy you accepted, and when you accepted it. When we make a material change, we ask you to accept the new version before continuing to use your account, and we record the new acceptance against the new version. The current version and effective date appear at the top of this policy.

Prepared as a draft for review by a South African attorney. Do not publish until reviewed and until the effective date and version are set.