Privacy notice

The preschool generally decides why and how learner, parent and staff information is used and is the responsible party under South Africa’s Protection of Personal Information Act, 2013 (POPIA). PlayPals processes that information for the preschool as its technology operator, according to the school’s instructions and the PlayPals service agreement.

PlayPals is separately responsible for information used to operate platform accounts, security, billing, support and legal compliance.

• School identity, contact, staff and subscription information.
• Learner identity, date of birth, class, attendance and progress-report information.
• Parent or guardian names, contact details and relationship to learners.
• Invoices, payment records, receipts and privately stored proof-of-payment documents.
• Account, sign-in, audit, device, security and support information.
• School banking details encrypted for secure parent payment instructions.

• To provide school administration, attendance, reporting and finance features.
• To authenticate users and enforce school and staff permissions.
• To generate invoices, receipts, exports and learner reports.
• To process PlayPals subscription payments and provide support.
• To protect the service, prevent fraud and maintain audit records.
• To comply with lawful obligations and respond to valid legal requests.

Information about children receives heightened protection. Schools must have a lawful basis and provide appropriate notices to parents or guardians before entering real learner information. PlayPals does not sell children’s information or use it for behavioural advertising.

Progress reports and payment documents are restricted to authorised users and secure links. Schools must not share those links with unauthorised persons.

PlayPals uses specialist providers for hosting, databases, authentication, file storage and payments, including Vercel, Neon, Clerk and Paystack. Some processing or backups may occur outside South Africa. PlayPals requires appropriate contractual and security safeguards from service providers and limits information to what is needed for the service.

Schools control operational retention subject to law and their own policies. PlayPals retains information while an account is active and for a reasonable period afterward for export, recovery, disputes, audit and legal obligations. Information is securely deleted or de-identified when it is no longer required, subject to backups and lawful retention duties.

PlayPals uses access controls, school-level data separation, encrypted connections, private document storage, audit records and encrypted school banking details. No system can guarantee absolute security. Users must protect passwords, devices, exported files and secure parent links, and report suspected incidents promptly.

Subject to POPIA, people may ask to access, correct or delete personal information, object to certain processing, or complain about handling. Parents should normally contact their preschool first because the school controls learner records. Requests relating to PlayPals accounts, security or platform billing may be directed to PlayPals support.

Concerns should first be raised with the preschool or PlayPals, depending on who controls the information. A person may also contact the Information Regulator of South Africa using the official contact information published by the Regulator.

This notice may be updated as PlayPals changes. Material changes will be communicated through the platform or to the school account owner. Schools are responsible for giving updated notices to parents and staff where required.