POPIA Collection Notice and Parental Consent
Protection of Personal Information Act, 2013 (Act 4 of 2013), section 18
This notice is provided to parents and legal guardians of learners enrolled at schools that use Skoolara, operated by Teleios IT Consulting (Pty) Ltd, prior to the school (the "School") collecting personal information about the parent/guardian and the learner. It is intended to satisfy the information sharing duties of a Responsible Party under section 18 of POPIA.
Please read this notice carefully. If you do not understand any part of it, ask your school to explain it. Your school captures your consent at enrolment and through the Skoolara application.
1. Name and address of Responsible Party
Responsible Party: the school at which the learner is enrolled. Your school's registered details and the contact details of its Information Officer are provided to you at enrolment and are available in the Skoolara application.
Operator engaged by the Responsible Party:
- Teleios IT Consulting (Pty) Ltd (operating the Skoolara platform)
- Company registration: 2025/487193/07
- Information Officer: Sachen Govender (Information Regulator registration 2026-005741)
- Contact:
privacy@skoolara.co.za
Skoolara processes personal information on the documented instructions of the School in terms of a written Operator Agreement (POPIA s20–21). Teleios does not determine the purposes of or means for processing personal information and acts solely as Operator. Notwithstanding that Teleios built and owns the Skoolara platform, all decisions regarding the collection, use and disclosure of personal information are made by the School as Responsible Party.
2. Purposes for which information is collected
The School collects and processes personal information about the learner and the parent/guardian for the following purposes:
- Enrolment and administration registering the learner with the School, assigning classes, managing school fees and communications.
- Education delivery recording and reporting on the learner's attendance, academic performance, assessments, homework and conduct.
- Safety and duty of care identifying adults authorised to collect the learner, responding to medical emergencies, safeguarding of children.
- Statutory and regulatory reporting submitting information required by the Department of Basic Education and the relevant provincial education department, including through SA-SAMS or any successor system.
- Legal obligations compliance with the South African Schools Act 84 of 1996, the Children's Act 38 of 2005, tax legislation and other applicable laws.
- Communication notifying the parent/guardian of school events, attendance, academic results, and incidents involving the learner.
- Security and audit protecting the integrity of the School's records and detecting unauthorised access.
3. Whether supply of the information is voluntary or mandatory
Some categories of information must be supplied for the learner to be enrolled and for the School to meet its statutory duties. Others are voluntary.
| Information | Voluntary or Mandatory | Reason |
|---|---|---|
| Learner full name, date of birth, gender | Mandatory | Required for enrolment and SA-SAMS. |
| Learner South African ID number or passport number | Mandatory | Required for SA-SAMS reporting. |
| Learner home language, nationality, population group | Mandatory | Required for statutory reporting. |
| Copy of birth certificate / ID | Mandatory | Required to verify age and identity. |
| Proof of residence | Mandatory | Required for feeder-zone and admissions compliance. |
| Immunisation / medical information | Voluntary but strongly recommended | Needed for emergency care. |
| Parent/guardian contact details | Mandatory | Required for communication and emergency contact. |
| Parent/guardian ID / passport | Mandatory | Required to verify guardianship. |
| Photograph for school records | Voluntary | Used for learner identification within the School. |
| Use of learner's image in school publications | Voluntary (separate consent) | Not required for enrolment. |
| Religion / dietary preferences | Voluntary | Used for pastoral care and catering. |
4. Consequences of failure to supply information
If you do not supply mandatory information, the School may be unable to enrol the learner, unable to submit required statutory reports, or unable to meet its duty of care. This may result in refusal or cancellation of enrolment.
If you do not supply voluntary information (for example, medical details), the School will not refuse enrolment, but may be less able to care for the learner in specific circumstances (for example, in a medical emergency).
5. Particular law authorising or requiring collection
The School collects certain categories of personal information under, or to comply with:
- the South African Schools Act 84 of 1996 and regulations made under it;
- the National Education Policy Act 27 of 1996;
- the Children's Act 38 of 2005;
- the Basic Education Laws Amendment Act (as applicable);
- the Identification Act 68 of 1997 (for identity-related information);
- the Income Tax Act 58 of 1962 (for financial records);
- provincial education regulations issued by the relevant provincial education department;
- directives of the Department of Basic Education, including those relating to SA-SAMS; and
- POPIA itself, together with any regulations and codes of conduct issued under it.
Certain categories of personal information collected by the School constitute special personal information as defined in POPIA s26. In particular: (a) population group and ethnic origin information is processed in reliance on POPIA s29, as it is necessary for identification purposes and to comply with laws designed to protect or advance persons disadvantaged by unfair discrimination (including statutory reporting to the Department of Basic Education); (b) immunisation and medical information (health information) is processed in reliance on POPIA s32(1)(c), as it is necessary for schools to provide special support for learners or to make special arrangements in connection with their health; and (c) religious beliefs and dietary preferences, where voluntarily supplied, are processed with the consent of the data subject or the competent person (POPIA s27(1)(a)). All special personal information is treated with a heightened standard of confidentiality and security, and is accessible only to authorised personnel on a need-to-know basis.
6. Recipients of the information
Personal information collected under this notice may be shared with:
- Authorised School staff, on a role-based, need-to-know basis;
- Teleios IT Consulting (Pty) Ltd (trading as Skoolara) as Operator, solely to operate the Skoolara platform;
- Sub-operators engaged by Skoolara reputable third-party service providers, engaged under written data-processing terms that comply with POPIA s19–21, solely for the purpose of email relay and push-notification delivery. No personal information is hosted or stored by sub-operators; all data is encrypted and stored on local servers operated by Skoolara within the Republic of South Africa;
- The Department of Basic Education and the relevant provincial education department;
- The South African Revenue Service (for fee-related information, where required);
- Law-enforcement authorities and courts, where required by a lawful order;
- The Information Regulator, where required by POPIA;
- Medical service providers, in the case of an emergency affecting the learner; and
- Professional advisors of the School (auditors, legal advisors), bound by duties of confidentiality.
7. Where information is stored
Personal information processed through Skoolara is stored and processed within the Republic of South Africa on local servers owned and operated by Teleios IT Consulting (Pty) Ltd. All personal information is encrypted at rest and in transit. Access is controlled through role-based access controls and audit logging. Teleios maintains appropriate technical and organisational security measures in accordance with POPIA s19, including regular risk assessments, vulnerability testing and incident-response procedures.
The only routine cross-border element is the delivery of push notifications to mobile devices, which relies on a global messaging service. These notifications are data-minimised and do not contain learner names or other direct identifiers — only an opaque device identifier and a generic message. To the extent any transfer occurs, the School and Skoolara rely on the safeguards permitted by POPIA s72, including binding contractual obligations (such as Standard Contractual Clauses) with the relevant provider.
8. Rights of the data subject
As a data subject (or, on behalf of your child, as the child's competent person), you have the right to:
- Be informed of what information is being collected and why (this notice).
- Access the information held about you and the learner (POPIA s23).
- Request correction or deletion of inaccurate, out-of-date, incomplete, misleading or excessive information (POPIA s24).
- Object to the processing of personal information on reasonable grounds (POPIA s11(3)).
- Submit a complaint to the Information Regulator if you believe the School or Skoolara has not complied with POPIA (POPIA s74).
- Institute civil proceedings in a court having jurisdiction against a responsible party for damages arising from any breach of POPIA (POPIA s99).
- Not be subject to a decision based solely on automated processing of personal information intended to provide a profile, where that decision has legal consequences or affects the data subject to a substantial degree (POPIA s71).
- Object to the processing of personal information for purposes of direct marketing (POPIA s11(3)(b) and s69).
- Be notified if there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person (POPIA s22).
Contact for exercising these rights
- Your school's Information Officer (contact details are in your enrolment pack and the Skoolara application)
- Skoolara:
privacy@skoolara.co.za - Information Regulator (South Africa):
POPIAComplaints@inforegulator.org.za/https://inforegulator.org.za
9. Retention
Personal information is retained for the periods set out in the School's Data Retention Schedule (provided on request). In general:
- Active learner records: during enrolment + 7 years after the learner leaves (to allow the data subject a reasonable opportunity to request access as contemplated by POPIA s14(3)(b), and to comply with the limitation period under the Prescription Act 68 of 1969).
- Academic results and certificates: statutory retention (for certification purposes).
- Financial records: 5 years minimum (Tax Administration Act).
- Audit logs: 7 years (retained for compliance verification and to support the School's accountability obligations under POPIA s8 and for purposes of proof as contemplated by POPIA s14(6)(b)).
10. Further information
A full Privacy Policy is available from the School and on the Skoolara platform. It describes in more detail the nature of the information processed, the security measures applied, and the rights available to data subjects. The School's and Teleios's PAIA section 51 Manuals, which describe how to request access to records held by each body, are available on request from the School's Information Officer and from Skoolara at privacy@skoolara.co.za respectively.
11. Consent of competent person (POPIA s35)
Where the processing of the learner's personal information relies on consent, your signature below constitutes the consent of a competent person in terms of POPIA s35.
You may withdraw your consent at any time by writing to the School Information Officer. Withdrawal will not affect:
- processing already carried out before withdrawal;
- processing required by law (for example, statutory reporting); or
- processing carried out on a legal basis other than consent.
12. How consent is given
Your school obtains the consent of a parent or legal guardian before processing a learner's personal information where that processing relies on consent. Consent is captured at enrolment and, for use of the platform, through the Skoolara application, where a parent or guardian can:
- confirm they have read and understood this notice;
- give or decline consent to the School collecting and processing the learner's personal information for the purposes set out above, and sharing it with the Operator and sub-operators described in this notice;
- give or decline the separate, optional consents for the use of the learner's photograph in internal school publications, on the School's public website or social-media channels, and for sharing relevant medical information with emergency medical service providers in an emergency; and
- withdraw any consent at any time, subject to the limitations described above.
A record of each consent who gave it, what was consented to, and when is kept by the School.
End of POPIA Collection Notice.