POPIA and data processing

For learner, parent and staff administration, the preschool is generally the POPIA responsible party and PlayPals is its operator. The school determines the purpose of processing and instructs PlayPals through use of the platform and the service agreement.

PlayPals acts as a responsible party for its own account administration, platform security, subscription billing, support and legal compliance activities.

PlayPals processes school information only to provide and secure agreed services, follow documented school instructions, meet legal duties, prevent abuse and support authorised users. PlayPals will inform the school if an instruction appears unlawful or materially unsafe.

• Provide appropriate privacy notices to parents, guardians and staff.
• Establish a lawful justification for processing, including children’s information.
• Limit information entered to what is adequate, relevant and not excessive.
• Keep records accurate and correct errors promptly.
• Assign least-privilege roles and remove access when staff leave.
• Respond to data-subject requests and notify PlayPals when assistance is required.
• Set lawful retention periods and request export or deletion when appropriate.

• Authentication and server-side role checks.
• School-scoped queries and composite database relationships.
• Private storage for proof-of-payment documents.
• Encryption for connections and stored school banking details.
• Audit logs for important financial, report and platform actions.
• Backups, managed infrastructure and access restrictions.
• Security and tenant-integrity testing before pilot use.

PlayPals uses vetted infrastructure and service providers, including Neon for PostgreSQL, Vercel for hosting and file storage, Clerk for authentication and Paystack for platform subscription checkout. PlayPals remains responsible for managing operator obligations and will update schools when material sub-operators change.

PlayPals will investigate suspected compromises and notify affected schools without undue delay when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. The school, as responsible party, remains responsible for notifications to data subjects and the Information Regulator where required, with reasonable assistance from PlayPals.

PlayPals will reasonably assist schools with access, correction, export, restriction and deletion requests. At termination, the school should export required records. PlayPals will delete or de-identify remaining information after an agreed retention period, except where retention is legally required or temporarily necessary in protected backups.