Privacy Policy

1. Who This Policy Applies To

This Policy applies to personal information collected from:

• Schools and their administrators and staff
• Teachers and other staff members
• Parents and guardians
• Learners (including minors)

who access or are represented within the Service.

2. Our Role Under POPIA

2.1 The School is the Responsible Party. For personal information relating to its learners, families, and staff, the School determines the purpose and means of processing and is the "responsible party" as defined in POPIA.

2.2 ClassroomX is the Operator. We process that personal information only on the School's behalf and instruction, to provide the Service (for example: attendance, marks, messaging, reporting). We do not use School, learner, or family data for our own independent purposes, and do not sell it.

2.3 For personal information we collect directly for our own purposes — such as website visitor data, marketing contacts, or School administrator billing details — ClassroomX itself is the responsible party.

3. Personal Information We Collect

• Identity and contact details — name, email, phone number, role (from schools, staff, parents)
• Learner academic data — attendance, marks, report cards, homework, behaviour records (from school staff)
• Communication data — messages, notices, broadcasts sent through the platform (from all Authorised Users)
• Account and usage data — login activity, device/browser information, in-app actions (automatically, via the Service)
• Billing information — school billing contact, invoicing details (from school administrators)
• MrX interaction data — prompts and queries submitted to the AI assistant (from Authorised Users who use MrX)

We do not knowingly collect more personal information than is reasonably necessary for the purpose it is collected for, in line with POPIA's minimality condition.

4. How We Use Personal Information

We (as operator, on the School's instruction) use personal information to:

• Provide core platform functionality — attendance, timetables, marks, messaging, dashboards
• Authenticate users and manage role-based access
• Send notifications, notices, and communications configured by the School
• Provide MrX AI assistance within the boundaries described in our Terms of Service
• Maintain platform security, detect abuse, and troubleshoot issues
• Fulfil legal or contractual obligations, including those owed to the School

We do not use Learner Data for advertising, and do not sell or rent personal information to third parties.

5. Lawful Basis for Processing

Processing is carried out on one or more of the following bases, consistent with POPIA's processing conditions:

• Consent obtained by the School from parents/guardians, where required for learner data;
• Performance of a contract, i.e. the School's Subscription Agreement with ClassroomX, and the School's relationship with families;
• Legitimate interests of the School in administering education, where not overridden by the data subject's rights;
• Legal obligation, where processing is required by applicable law (for example, education regulation).

Schools are responsible for establishing the appropriate lawful basis with their parents/guardians and staff before submitting personal information to the Service.

6. Children's Personal Information

6.1 Because ClassroomX is a school management platform, it necessarily processes personal information relating to minors (learners).

6.2 Schools are responsible for obtaining appropriate parental or guardian consent, or otherwise establishing a lawful basis under POPIA (such as processing that is educationally necessary and in the child's interest), before submitting learner information to the Service.

6.3 We apply additional safeguards to learner-facing features, including: restricting learner accounts to age-appropriate functionality and permissions; limiting MrX's exposure to sensitive learner data to what is functionally necessary; giving Schools and parents visibility into what learner data is captured.

6.4 A parent or guardian who wants to review, correct, or request deletion of their child's information should contact their School directly, or reach us at info.classroomx@gmail.com and we will coordinate with the relevant School.

7. How We Protect Personal Information

We apply technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit and at rest
• Role-based, least-privilege access controls
• Secure authentication practices
• Ongoing monitoring, logging, and dependency/security management
• Regular backups and disaster-recovery planning
• Staged deployments with rollback capability to reduce the risk of faulty changes exposing data

No system is completely secure, and we continuously review and improve these measures.

8. Sharing of Personal Information

We do not sell personal information. We may share personal information with:

• Sub-operators / service providers who support our infrastructure (e.g. hosting, email delivery, error monitoring), under contractual confidentiality and security obligations;
• Third-party AI providers that power MrX, limited to what is necessary to generate a response, and subject to contractual data protection terms;
• The School itself, since much of the data is inherently shared with the School as responsible party;
• Regulators or authorities, where required by law.

Any sub-operator we engage is contractually bound to at least the same level of protection required of us under POPIA.

9. Cross-Border Data Transfers

Where personal information is processed or stored outside South Africa (for example, by a hosting or AI service provider), we take reasonable steps to ensure the recipient is subject to a law, binding corporate rules, or contractual terms that provide an adequate level of protection substantially similar to POPIA, as required by section 72 of POPIA.

10. Data Retention

We retain personal information for as long as the School's subscription is active, and thereafter for a reasonable export/retention period set out in the School's Subscription Agreement or Operator Agreement, after which it is securely deleted or de-identified, unless a longer period is required by law.

11. Your Rights

Subject to POPIA, and coordinated through the School where the School is the responsible party, data subjects have the right to:

• Request confirmation of whether we hold their personal information, and access to it;
• Request correction or deletion of inaccurate, irrelevant, excessive, or unlawfully obtained personal information;
• Object to processing of their personal information on reasonable grounds;
• Withdraw consent, where processing is based on consent;
• Lodge a complaint with the Information Regulator (South Africa) if they believe their rights have been infringed.

Requests relating to learner, family, or staff data should generally be directed to the relevant School in the first instance; we support Schools in fulfilling these requests within a reasonable time.

12. Data Breach Notification

If we become aware of a security compromise that has, or may have, affected personal information for which a School is the responsible party, we will notify the affected School without undue delay, in line with POPIA's notification requirements and our operator agreement, so the School can meet its own notification obligations to data subjects and the Information Regulator where required.

13. Cookies and Similar Technologies

Our website and Service may use cookies or similar technologies for authentication, session management, and understanding basic usage patterns. We do not use these for third-party advertising. You can control cookies through your browser settings, though some features may not function correctly if cookies are disabled.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to Schools with reasonable notice. The "Last Updated" date at the top of this Policy reflects the most recent revision.

15. Information Officer and Contact Details

ClassroomX Company · Information Officer: [Insert Name] · Website: classroomx.co.za · Email: info.classroomx@gmail.com · Instagram: @classroomx.co.za

For complaints not resolved directly with us, you may contact the Information Regulator (South Africa): Website: inforegulator.org.za · Email: complaints.IR@justice.gov.za