Privacy Policy

1. DEFINITIONS

For purposes of this Data Protection and Privacy Management Policy, unless the context indicates otherwise, the following terms shall bear the meanings assigned to them below:

1. “Applicable Law” means the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Constitution of the Republic of South Africa, 1996, and any other legislation, regulations, codes of conduct or regulatory guidance applicable to the processing of personal information in the Republic of South Africa.

2. “Child” means a natural person under the age of 18 years.

3. “Consent” means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information.

4. “Data Subject” means the natural person or juristic person to whom personal information relates.

5. “De-identified Information” means information that has been processed in such a manner that it cannot reasonably be used to identify a data subject, and which cannot be re-identified by Kambio or any other person using reasonably foreseeable methods.

6. “Information Officer” means the person appointed by Kambio in terms of POPIA who is responsible for encouraging compliance with POPIA, dealing with requests made in terms of the Act, working with the Information Regulator, and ensuring the implementation of this Policy.

7. “Information Regulator” means the Information Regulator established in terms of section 39 of POPIA.

8. “Kambio” means Kambio (Pty) Ltd, a private company duly incorporated in accordance with the laws of the Republic of South Africa, acting as the Responsible Party in respect of personal information processed in the course of operating its digital educational platform and related services.

9. “Operator” means a person or entity who processes personal information for Kambio in terms of a contract or mandate, without coming under the direct authority of Kambio.

10. “Personal Information” means information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person, as defined in section 1 of the Protection of Personal Information Act 4 of 2013, including any information that identifies or could reasonably be used to identify such person.

11. “Platform” means the Kambio digital educational platform, including its website, application interfaces, learning management systems, payment systems and associated technological infrastructure through which educational content and services are provided.

12. “POPIA” means the Protection of Personal Information Act 4 of 2013, together with any regulations, codes of conduct or amendments promulgated thereunder.

13. “Processing” means any operation or activity or set of operations, whether or not by automatic means, concerning personal information, including collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, use, dissemination by means of transmission, distribution or making available in any other form, merging, linking, restriction, degradation, erasure or destruction.

14. “Responsible Party” means the public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information.

15. “Security Compromise” means any unauthorised access to, acquisition of, disclosure of, or destruction of personal information, or any other incident that compromises the confidentiality, integrity or availability of personal information.

16. “Special Personal Information” means personal information as defined in section 26 of POPIA, including information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or criminal behaviour, subject to the additional protections prescribed by POPIA.

17. “Third Party” means any natural or juristic person other than the data subject, Kambio, or an operator acting under the direct authority of Kambio, who receives personal information.

18. “User” means any person who accesses, registers on, subscribes to, or otherwise makes use of the Platform, including learners, parents or guardians, educators and other authorised individuals.

Words importing the singular include the plural and vice versa; words importing any gender include the other genders; and references to any statute include any amendment, re-enactment or replacement thereof.

2. INTRODUCTION

1. Kambio (Pty) Ltd operates an online educational platform providing digital Mathematics and Physical Sciences content and related academic support services to high school learners, and in the course of conducting its business collects and processes personal information relating to learners, parents or guardians, educators, employees, contractors, service providers and other users of its platform and associated systems.

2. For purposes of the POPIA, Kambio acts as the Responsible Party in respect of all personal information processed through its platform, infrastructure and related business operations, and accordingly determines the purpose of and means for such processing in accordance with applicable law.

3. This Data Protection and Privacy Management Policy aim to establish the governance framework, principles, safeguards and internal controls regulating the lawful collection, recording, organisation, structuring, storage, updating, retrieval, consultation, use, dissemination, transmission, restriction, retention and destruction of personal information by Kambio.

4. The Policy gives effect to the constitutional right to privacy in section 14 of the Constitution of the Republic of South Africa, 1996, and ensures that all processing of personal information complies with POPIA and any other applicable data protection legislation.

5. It further formalises Kambio’s commitment to transparency, accountability, data minimisation, purpose specification, security safeguards and data subject participation in the operation of its digital educational platform and related services.

3. SCOPE OF POLICY

1. This Policy applies to all processing of personal information undertaken by Kambio in the course of its operations, whether such processing occurs electronically, in paper-based form, or by any other means.

2. It extends to all business units, functions and activities of Kambio, including the operation of its digital educational platform, website, application interfaces, payment structures, marketing activities, customer support services, recruitment processes, administrative functions and any ancillary or related services.

3. This Policy binds all directors, officers, employees, contractors, temporary staff, consultants and any other persons acting under the authority of Kambio, as well as all operators and third-party service providers who process personal information on Kambio’s behalf.

4. This Policy applies to personal information relating to learners, parents or guardians, educators, employees, job applicants, suppliers, service providers, prospective users, website visitors and any other natural or juristic persons whose personal information is processed by Kambio.

5. The Policy applies to personal information processed within the Republic of South Africa and to any cross-border transfers of personal information where Kambio determines the purpose of and means for processing. It does not apply to information that has been irreversibly anonymised or de-identified such that it can no longer be linked to an identifiable data subject.

6. Compliance with this Policy is mandatory and forms part of the contractual and statutory obligations binding on all persons to whom it applies.

4. CATEGORIES AND PURPOSE OF PROCESSING PERSONAL INFORMATION

In the course of operating its digital educational platform and conducting its business activities, Kambio processes personal information that is adequate, relevant and not excessive in relation to the specific, explicitly defined and lawful purposes for which it is collected and processed.

1. Depending on the nature of the interaction with Kambio, such personal information may include, but is not limited to the following:

   1. Identification and contact information of learners, parents or guardians, educators, employees, contractors and other users, including names, email addresses and contact numbers;

   2. Educational and learner-related information such as grade level, school name, subject enrolment details, assessment submissions, performance records and progress tracking data;

   3. Account and authentication information including usernames, encrypted passwords, login credentials and access records;

   4. Transactional and billing information including payment confirmations and subscription status;

   5. Communication and support records including correspondence, support tickets, chat logs and related metadata;

   6.  Where applicable, recruitment and employment-related information submitted by applicants or contractors.

2. Personal information is generally collected directly from the data subject, although in the case of minor learners it may be collected from parents or legal guardians, and may also be received from schools, payment service providers or other authorised third parties where lawfully permitted.

3. Certain personal information is mandatory for the creation and administration of user accounts, the processing of payments and the provision of access to educational services, and failure to provide such information may result in Kambio being unable to conclude or perform a contract or provide access to the platform.

4. Personal information is processed for purposes including but not limited to:

   1. Account administration,

   2. The provision of educational content and services,

   3. Subscription management,

   4. Payment processing,

   5. Communication of service-related information,

   6. Provision of technical support,

   7. Investigation of complaints,

   8. Enforcement of contractual rights,

   9. Compliance with legal and regulatory obligations,

   10. Prevention of fraud or misuse,

   11. The improvement of platform functionality and system security.

5. Where processing is based on consent, including for direct marketing by electronic communications, Kambio will obtain consent directly from the individual in question, and such individuals may withdraw such consent at any time subject to legal or contractual limitations.

5. PROCESSING OF PERSONAL INFORMATION OF MINORS

1. Kambio’s platform is designed for use by high school learners, many of whom may be under the age of 18 years. Kambio recognises that, in terms of POPIA, the personal information of a child constitutes personal information requiring heightened protection and may not be processed unless one of the lawful justifications contemplated in section 35 of POPIA applies.

2. Where a learner is under the age of 18 years, Kambio will process such learner’s personal information only with the prior and informed consent of a competent parent or legal guardian.

3. By registering an account on behalf of a minor or permitting a minor to access the platform, the parent or legal guardian warrants that he or she has the legal capacity and authority to provide the required consent and to enter into any applicable contractual arrangements on behalf of the minor.

4. In the case of minor learners, Kambio may collect and process personal information relating both to the learner and to the parent or legal guardian, including identification details, contact information, consent records, billing information and communications necessary for the administration of the learner’s account and access to educational services.

5. Payment details must be provided by a parent or legal guardian or by a person lawfully authorised to act on behalf of the minor.

6. Kambio does not knowingly collect personal information directly from a child without appropriate parental or guardian consent. Where Kambio becomes aware that personal information of a minor has been collected without the requisite lawful basis, it will take reasonable steps to verify consent or, failing such verification, to delete or de-identify the information in accordance with applicable law.

7. Parents or legal guardians have the right, subject to applicable legal limitations, to request access to the minor’s personal information, to request correction or deletion of inaccurate or unlawfully processed information, and to object to or restrict certain processing activities. Such requests will be handled in accordance with POPIA and Kambio’s internal data subject access procedures.

6. DISCLOSURE AND SHARING OF PERSONAL INFORMATION

1. Kambio does not disclose personal information to third parties except where such disclosure is necessary for a lawful purpose connected to the operation of its platform, the performance of a contract, compliance with a legal obligation, or where the data subject has consented to such disclosure.

2. Personal information may be shared with authorised third-party service providers who process information on behalf of Kambio strictly in accordance with written agreements and documented instructions.

3. Such operators may include but is not limited to:

   1. Website hosting and cloud infrastructure providers;

   2. Secure payment processing service providers;

   3. Email and communication service providers;

   4. Analytics and technical support providers;

   5. And other professional advisers or service providers engaged in connection with Kambio’s business operations.

4. All operators are contractually required to implement appropriate technical and organisational security measures to protect personal information against loss, unauthorised access, disclosure, alteration or destruction.

5. Operators are further prohibited from using personal information for their own purposes or for any purpose not expressly authorised by Kambio.

6. Kambio may disclose personal information where required to do so by law, regulation, court order or lawful request from a competent authority, or where such disclosure is necessary to protect the legitimate interests of Kambio, its users or third parties, including for the purposes of preventing fraud, enforcing contractual rights, or establishing, exercising or defending legal claims.

7. Kambio does not sell, rent or otherwise commercially exploit personal information for independent third-party marketing purposes.

7. INFORMATION SECURITY AND SAFEGUARDS

1. Kambio implements appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in its possession or under its control, as required by section 19 of POPIA. Such measures are designed to prevent loss of, damage to, or unauthorised destruction of personal information, and to prevent unlawful access to or processing of personal information.

2. Kambio maintains internal security controls and risk management procedures appropriate to the nature of the personal information processed and the risks associated with its processing.

3. Access to personal information is restricted to authorised personnel and operators who require such access for legitimate business purposes and who are subject to confidentiality obligations. Kambio takes reasonable steps to ensure that its employees and service providers are aware of and comply with applicable data protection and information security requirements.

4. Where personal information is processed by an operator on behalf of Kambio, Kambio requires, by written agreement, that the operator establish and maintain security measures substantially similar to those required under POPIA and that the operator promptly notify Kambio of any actual or suspected security compromise.

5. Notwithstanding the implementation of reasonable safeguards, no method of transmission over the internet or method of electronic storage is entirely secure. Accordingly, while Kambio takes appropriate steps to protect personal information, it cannot guarantee absolute security against all potential threats.

8. THIRD-PARTY WEBSITES AND EXTERNAL LINKS

1. The Kambio platform may contain links to third-party websites, applications, resources or services that are not owned, operated or controlled by Kambio.

2. Such links are provided for convenience or informational purposes only and do not constitute endorsement, sponsorship or approval of the content, policies or practices of such third parties.

3. Kambio does not control and is not responsible for the privacy practices, security measures, content or data processing activities of third-party websites or services.

4. Once a user leaves the Kambio platform or is redirected to a third-party environment, any personal information collected or processed will be subject to the applicable privacy policies and terms of that third party.

5. Users are advised to review the privacy policies and terms of service of any third-party websites or services before providing personal information or engaging with such platforms.

6. Kambio disclaims liability, to the fullest extent permitted by law, for any loss, damage or harm arising from the use of or reliance on third-party websites or their data protection practices.

9. DATA RETENTION AND DESTRUCTION

1. Kambio retains personal information only for as long as is necessary to fulfil the specific, lawful purposes for which it was collected or subsequently processed, unless a longer retention period is required or permitted by applicable law.

2. Retention periods are determined with reference to the nature of the information, the purpose of processing, contractual requirements, operational necessity, and applicable statutory or regulatory obligations.

3. Personal information may be retained for the duration of a user’s account and thereafter for a reasonable period to enable the provision of educational services, maintenance of academic records, processing of transactions, compliance with tax, accounting and audit obligations, resolution of disputes, enforcement of contractual rights, investigation of complaints, and establishment, exercise or defence of legal claims.

4. Where personal information is processed on the basis of consent, such information will not be retained longer than necessary for the purpose for which consent was obtained, subject to any overriding legal obligations requiring continued retention.

5. Kambio maintains internal retention schedules and records management controls to ensure that personal information is periodically reviewed and not retained for longer than necessary.

6. Once personal information is no longer required for a lawful purpose and no legal basis for continued retention exists, it will be securely deleted, destroyed, or irreversibly anonymised in a manner that prevents its reconstruction or re-identification, in accordance with applicable data protection and information security standards.

10. REVIEW AND PUBLICATION

1. This Policy shall be reviewed annually, or as and when required to reflect changes in applicable legislation, regulatory guidance, operational requirements or risk exposure.

2. The current version of this Policy shall be made available on Kambio’s digital platform, (https://www.kambio.co.za/)  and may be provided upon request.

3. Internal copies shall be accessible to all directors, employees and relevant operators to whom this Policy applies, and any updated version shall supersede previous versions with effect from the date of publication of said Policy.

11. CONTACT INFORMATION 

1. If you have any individual or entity have any queries regarding this Policy, wish to exercise any of your rights under applicable data protection legislation, or wish to lodge a complaint regarding the processing of your personal information, you may contact Kambio at: Email: info@kambio.co.za

2. Kambio will respond to requests within a reasonable time and in accordance with applicable legislation. Data subjects also have the right to lodge a complaint with the Information Regulator of South Africa if they believe that their personal information has been processed unlawfully.