Privacy Notice

Effective date: 6 July 2026

This Privacy Notice explains how Teleios IT Consulting (Pty) Ltd, 30 Rydalvale Drive (referred to as "Teleios" or "Skoolara" or "we" or "us") may process personal data about learners enrolled at schools that use Skoolara, their parents/guardians, and school staff using the Skoolara platform.

This Privacy Notice also explains how the school at which a learner is enrolled ("The School") collects, uses, shares and protects personal information through the Skoolara platform. The school is the Responsible Party under the Protection of Personal Information Act, 2013 ("POPIA"). Teleios IT Consulting (Pty) Ltd, operating the Skoolara platform ("Skoolara"), acts as the Operator as defined in POPIA and processes personal information on the school's behalf under a written operator agreement as required by POPIA s21. All personal information is encrypted and stored on local servers within the Republic of South Africa.

We use plain language wherever possible. Where precise legal language is necessary, we have used it and noted it.

1. About the Parties Processing Data

The School is the Responsible Party

The Responsible Party for a learner's personal information is the school at which that learner is enrolled. Each school's registered details and the contact details of its designated Information Officer are provided to parents and guardians at enrolment and are available inside the Skoolara application. Skoolara supports schools across South Africa, so this notice refers to "The School" generically — it means the specific school your child attends.

Teleios is the Operator

• Registered name: Teleios IT Consulting (Pty) Ltd (operating the Skoolara platform)
• Company registration: 2025/487193/07
• Information Officer: Sachen Govender — registered with the Information Regulator of South Africa under reference 2026-005741 (appointed 2026-04-01).
• Contact for privacy queries: privacy@skoolara.co.za
• Website: https://skoolara.co.za

If you have a question about your own or your child's personal information, you should normally contact your school first. Skoolara will only act on instructions from the school except where law requires otherwise.

2. What this notice covers

This notice covers personal information collected and processed through:

• the Skoolara website (including the school portal and any marketing pages);
• the Skoolara mobile application for parents, learners and staff; and
• the Skoolara staff dashboard used by teachers, administrative staff and school leadership.

It does not cover third-party websites linked from the platform. Those sites have their own privacy notices.

3. Personal information we collect

The information we collect depends on who you are. Much of the information we hold relates to children (learners under 18 years of age) and is therefore subject to additional protections — see section 6 below.

In accordance with POPIA s18, we inform you that:

• Certain information is mandatory — the school is legally required to collect it under the South African Schools Act 84 of 1996, the Children's Act 38 of 2005, and applicable provincial education regulations. This includes the learner's full name, date of birth, identity or passport number, grade, and parent/guardian contact details. If mandatory information is not provided, the school may be unable to enrol or continue to enrol the learner, comply with statutory reporting obligations, or provide required services.
• Other information is voluntary — fields marked as optional in the Skoolara platform (for example, medical information, employment details of parents, and event photographs) are collected only with your consent. There is no adverse consequence for declining to provide voluntary information, although it may limit the school's ability to provide certain services (for example, emergency medical response if medical details are not supplied).

3.1 About learners (including children)

• identifying information: full name, preferred name, date of birth, gender, nationality, South African ID number or passport number, home-language;
• school-related information: grade, class, homeroom teacher, enrolment date, academic history;
• attendance records (daily and per-period);
• academic performance: marks, assessments, reports, progression data;
• documents: copies of identity document / birth certificate, proof of residence, previous school reports, immunisation records and other documents the school may require;
• medical information (where voluntarily provided): allergies, chronic conditions, medication, emergency contact information. Note: medical information constitutes special personal information under POPIA s26 and is processed under the authorisation in s32(1)(c) (processing by schools necessary for special support or arrangements in connection with learners' health);
• communications: messages between the learner (if age-appropriate) and staff, submissions, homework uploads;
• images: school photographs, event media (with consent).

3.2 About parents and guardians

• full name, relationship to learner (parent, legal guardian, grandparent, etc.);
• contact details: mobile number, email address, physical and postal address;
• identity document / passport number (where required for guardianship verification);
• employment and emergency contact details (voluntary);
• communications with the school.

3.3 About teachers and staff

• employment information: full name, SACE number, ID number, qualifications, role;
• contact details;
• role-based data: classes taught, marks captured, attendance captured, messages sent;
• authentication and audit data (logins, actions performed in the system).

3.4 Technical information (all users)

• device type, operating system, application version;
• IP address and approximate location derived from it;
• authentication tokens and push-notification tokens;
• audit logs of actions taken within the platform.

4. Why we collect the Data (Purposes)

We collect and use personal information for the following purposes:

1. Education delivery: Enrolling learners, assigning them to classes, recording marks, setting homework, publishing reports, facilitating communication between teachers, learners and parents.
2. Attendance compliance: Recording attendance as required by the South African Schools Act 84 of 1996 and provincial education regulations.
3. Statutory reporting: Submitting learner-level and aggregate data to the Department of Basic Education's information systems (including SA-SAMS and its successors) and to provincial departments of education.
4. Safety and duty of care: Verifying identity of adults collecting learners, emergency medical response, safeguarding.
5. School–Parent communication: Sending notices, newsletters, attendance alerts, invoices, academic reports and direct messages.
6. Billing and administration: Fees, invoices, school-level reporting.
7. Security, fraud prevention and audit: Detecting unauthorised access, investigating incidents, maintaining audit trails.
8. Legal compliance: Responding to lawful requests from regulators, courts or authorised public bodies.

We will not use personal information for any purpose that is materially different from these without first obtaining fresh consent or establishing another lawful basis.

5. Legal basis for processing

Under POPIA, we rely on the following justifications (s11) depending on the data and purpose:

• Consent of a competent person (POPIA s11(1)(a) and s35) for the processing of a child's personal information, we rely on the consent of the child's parent or legal guardian. For adult learners (18+), we rely on the learner's own consent.
• Performance of a contract (s11(1)(b)) the contract of enrolment between the school and the parent/guardian.
• Compliance with an obligation imposed by law (s11(1)(c)) e.g. the South African Schools Act, the Children's Act 38 of 2005, education policy requirements.
• Protection of a legitimate interest of the data subject (s11(1)(d)).
• Proper performance of a public law duty by a public body (s11(1)(e)) where the school is a public school.
• Legitimate interest of the responsible party or a third party (s11(1)(f)) e.g. security and audit logging, balanced against the interests of learners and parents.

Certain personal information collected through Skoolara constitutes special personal information under POPIA s26, including:

• health information (allergies, chronic conditions, medication) processed under the authorisation in POPIA s32(1)(c): processing by schools necessary for special support for learners or making special arrangements in connection with their health;
• race or ethnic origin (where derivable from identity numbers or home language fields) processed under the authorisation in POPIA s29: processing necessary to identify data subjects and only when essential for that purpose, or to comply with laws designed to protect or advance people disadvantaged by unfair discrimination.

Special personal information is subject to additional confidentiality obligations and is accessible only to authorised school staff with a legitimate need. Where special personal information is processed, the responsible party is subject to an obligation of confidentiality by virtue of office, employment or legal provision, as required by POPIA s32(2).

Where we rely on consent, you may withdraw it at any time (POPIA s11(2)(b)). Withdrawal does not affect the lawfulness of processing carried out before withdrawal, nor does it affect processing where we have another lawful basis (for example, statutory reporting obligations).

6. Children's Data Special Protections

Because the Skoolara platform is designed for use by schools, most of the personal information we hold relates to children. We apply the following additional safeguards:

• Parental / guardian consent (POPIA s35). A child's personal information may be processed only with the consent of a competent person, or under one of the limited exceptions set out in POPIA s35(1)(b)–(e). At enrolment, the school obtains consent from the parent or legal guardian via the POPIA collection notice (see the POPIA Collection Notice).
• Child-friendly notice. We provide a plain-language summary for children, in fulfilment of the POPIA s18 transparency obligation.
• No direct marketing to children. Skoolara and the school will not send direct marketing, advertising or promotional content to children. Marketing communications about the platform are directed to adults (parents, staff, school decision-makers).
• No automated profiling of children. Skoolara does not subject children's personal information to automated decision-making or profiling within the meaning of POPIA s71. Any analytics used to support teaching (for example, identifying learners who may need support) are designed to assist teachers, not to take decisions without human involvement. Data subjects have the right, under s71, not to be subject to a decision based solely on automated processing that results in legal consequences or substantially affects them.
• Minimisation. We collect only the information necessary for education delivery, statutory reporting and the child's safety. Voluntary fields are clearly marked.

7. Who sees personal information

Within the school, access is role-based:

• Class teachers — see the learners in their classes.
• Subject teachers — see academic information for the subjects they teach.
• School administrators and the principal — see information necessary for running the school.
• Linked parents / guardians — see only their own children's information and their own information.
• The learner — age-appropriate access, subject to parental controls.

Outside the school, personal information may be disclosed to:

• Authorised officials of the Department of Basic Education and the relevant provincial education department, to the extent required by law (for example, SA-SAMS submissions).
• The Information Regulator or other regulators, where legally required.
• Courts and law enforcement, pursuant to a lawful order.
• Auditors and professional advisers bound by duties of confidentiality.

Operators / Processors engaged by the school or by Skoolara include:

• Teleios IT Consulting (Pty) Ltd (trading as Skoolara) — platform operator.
• Local infrastructure — all application hosting, database services and document storage are maintained on encrypted local servers within South Africa, operated by Teleios IT Consulting (Pty) Ltd under a written operator agreement as required by POPIA s21. Transactional email and push-notification delivery may involve third-party service providers engaged under written data-processing terms.

Skoolara does not process school-fee payments; fee information in the application is a bookkeeping record only. A complete and current list of the specific sub-processors engaged is maintained in the Operator Agreement between the school and Skoolara and is available from the school on request.

8. Where your information is stored

Personal information processed through Skoolara is encrypted and stored on local servers within the Republic of South Africa. Skoolara does not use offshore cloud hosting for the storage of personal information.

The only routine cross-border element is the delivery of push notifications to mobile devices, which relies on a global messaging service. Those notifications are data-minimised: they contain only an opaque device identifier and a generic, non-personal message — never a learner's name, marks or message content. The application fetches the actual content via an authenticated request, served from within South Africa, when the user opens the notification. To the extent this involves any transfer of personal information outside the Republic, Skoolara relies on POPIA s72(1)(a): the recipient service provider is subject to a binding agreement that provides an adequate level of protection substantially similar to the conditions for lawful processing under POPIA, including provisions relating to onward transfers.

9. How long we keep personal information

We keep personal information only for as long as necessary for the purposes for which it was collected, or as required by law. The following are default retention periods; a school may configure retention in line with its own policies and applicable regulations. A detailed retention schedule is maintained by Skoolara and is available from the school on request.

At the end of the retention period, personal information is securely deleted or irreversibly anonymised.

10. Your rights

POPIA gives you rights in relation to your (or your child's) personal information, including:

• Access (POPIA s23) — to request confirmation, free of charge, whether we hold your personal information, and to request a copy of that information.
• Correction or deletion (POPIA s24) — to request correction of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained information, or deletion where we are no longer authorised to retain it.
• Destruction of records (POPIA s24(1)(b)) — to request destruction or deletion of a record that we are no longer authorised to retain under POPIA s14.
• Objection (POPIA s11(3)) — to object, on reasonable grounds relating to your particular situation, to processing based on legitimate interests (s11(1)(d)–(f)). If you validly object, we must stop processing the personal information concerned (s11(4)).
• Restriction (POPIA s14(6)) — to request restriction of processing where accuracy is contested, where we no longer need the information but it must be maintained for proof, where processing is unlawful and you oppose deletion, or where you request transmission to another system.
• Transmission (POPIA s14(6)(d)) — to request the transmission of your personal information to another automated processing system.
• Withdraw consent (POPIA s11(2)(b)) — where processing is based on consent, you may withdraw it at any time.
• Lodge a complaint with the Information Regulator of South Africa (see section 14 below).

Access requests are processed in the manner prescribed by POPIA s25, read with sections 18 and 53 of the Promotion of Access to Information Act, 2000 (PAIA). We aim to respond to requests within 30 days. Complex requests may take longer, in which case we will tell you why and keep you informed.

11. How to request access, deletion or correction

You may exercise your rights by:

• emailing your school's Information Officer (contact details are in your enrolment pack and the Skoolara application);
• using the "Privacy requests" screen in the Skoolara application (Settings → Privacy → Request access / deletion / correction); or
• writing to the school at the address in section 1.

Please tell us clearly what you are asking for and provide enough information for us to verify your identity. If you are asking on behalf of a child, we may confirm that you are their parent or legal guardian.

In terms of POPIA s25, access requests are processed in the manner set out in sections 18 and 53 of the Promotion of Access to Information Act, 2000 (PAIA). Each school, as a private or public body, is required to maintain a PAIA Manual (under PAIA s14 or s51) describing the categories of records held, the purpose of processing, and the procedure for requesting access. A copy of the school's PAIA Manual is available from the school's Information Officer and, where applicable, on the school's website. Skoolara's own PAIA Manual is available at https://skoolara.co.za or by request to privacy@skoolara.co.za.

12. Security

We take the security of personal information seriously. Measures include:

• Encryption in transit using TLS 1.2 or higher.
• Encryption at rest for databases, backups and document storage.
• Role-based access control in the staff dashboard.
• Audit logging of sensitive actions (access to learner records, exports, deletions).
• Regular backups with tested restoration procedures.
• Vulnerability management and security testing of the platform.
• Staff training on privacy and information security.

No system is perfectly secure. We continually improve our controls and respond promptly to identified risks.

13. Breach notification

If there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person (a security compromise), we will act in accordance with POPIA s22:

• Skoolara (as Operator) will notify the school's Information Officer immediately where there are reasonable grounds to believe that personal information has been compromised, in accordance with POPIA s21(2).
• The Information Regulator will be notified as soon as reasonably possible after discovery of the compromise, as required by POPIA s22(1)(a).
• Affected data subjects (parents, guardians, staff) will be notified as soon as reasonably possible after discovery, unless the identity of the data subjects cannot be established (POPIA s22(1)(b)).
• Notifications will include: (a) a description of the possible consequences of the compromise; (b) a description of the measures taken or proposed to address the compromise; (c) a recommendation of measures data subjects may take to mitigate adverse effects; and (d) if known, the identity of the unauthorised person, as required by POPIA s22(5).

We maintain standard breach-notification procedures and templates internally so that any required notification is made promptly and consistently.

14. Complaints

If you are concerned about how your (or your child's) personal information has been handled, you can:

1. Contact your school's Information Officer (details in your enrolment pack and the Skoolara application).
2. Contact Skoolara at privacy@skoolara.co.za.
3. Lodge a complaint with the Information Regulator (South Africa): - Information Regulator (South Africa) - JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 - P.O. Box 31533, Braamfontein, 2017 - Complaints email: POPIAComplaints@inforegulator.org.za - General email: inforeg@justice.gov.za - Website: https://inforegulator.org.za

15. Changes to this notice

We may update this notice from time to time. When we do, we will:

• update the version: and last_reviewed: fields;
• post the new version on the Skoolara platform; and
• for material changes, notify parents, guardians and staff by email or in-app message and, where required, re-obtain consent.

16. Contact

Your school (Responsible Party) Contact your school's designated Information Officer first — their contact details are in your enrolment pack and in the Skoolara application.

Skoolara operator contact Teleios IT Consulting (Pty) Ltd (trading as Skoolara) Information Officer: Sachen Govender (Information Regulator registration 2026-005741) Email: privacy@skoolara.co.za

End of Privacy Notice.