Privacy Policy

1.1 About this Policy

2.1 Information you give us

2.2 Information we collect automatically

When you use the Platform, certain information is collected automatically:

• Technical information: IP address, device type, operating system, browser type and version, screen resolution
• Usage data: pages viewed, features used, time spent, click patterns, search queries, lessons booked, AI Tutor usage; Beyond attendance timestamps, the Data Engine also records question-level interaction and behavioral signals for subscribed Students. Clause 3 sets this out in full, so that the disclosure here is complete.
• Performance data: ratings given and received, reviews, completion of lessons, feedback forms, gamification XP and tier
• Cookies and similar technologies (see clause 11)
• Session attendance data: video-call join and leave timestamps (used to verify attendance per BR-BKG-010 of the Functional Requirements). The substantive content of video sessions is not recorded by default.

2.3 Information from third parties

• Payment processor (Paystack): payment confirmations, settlement details, fraud-screening flags.
• Identity verification (where used in future for enhanced KYC): identity-confirmation results
• Google (where you use "Sign in with Google"): your name, email, and profile photo
• Calendar integration (Gmail/Google Calendar, from Phase 1): event metadata necessary to create and update calendar entries.

2.4 Special personal information

Special personal information (as defined in section 26 of POPIA) includes information about religion, race, health, biometrics, sex life, and the like. We do not seek to collect special personal information, save where: (a) it is voluntarily provided by you (for example, an academic accommodation request that mentions a disability); or (b) it is unavoidable as part of identity verification (e.g. the photograph on a South African ID document is a biometric identifier under section 1 of POPIA). Where we process special personal information, we rely on a lawful basis under section 27 of POPIA, including (where relevant) your express consent.

In plain words: we do not ask for things like your religion, race or health. If you tell us anyway, we only use it for the reason you gave it to us.

The Data Engine may also infer engagement, difficulty and learning-style signals about a Student. These inferences are not special personal information, they are used only to deliver the educational service, they are never used for direct marketing, and a parent may object to or restrict this profiling at any time.

2.5 Children’s personal information

Where the Student is a Minor (under 18), we treat all of the Student's personal information with heightened care. We rely on the verifiable consent of the Parent or legal guardian as the lawful basis under section 35 of POPIA. A Minor cannot grant consent for him- or herself. If we discover that we have collected the personal information of a Minor without verifiable parental consent, we will delete that information without undue delay.

4.1 Other Users of the platform

• A Tutor's profile (name, photo, subjects, grades, ratings, biography, hourly rate) is visible to Parents and Students browsing the Platform;
• A Parent or Student's first name (and grade for Students) is visible to a Tutor with whom they have a Booking; When you book a Tutor, that Tutor can see the student’s session card, which for subscribed Students includes the Learner Index, weak areas, recent activity and any notes you add. This is shared only with the Tutor(s) you book and only to prepare and deliver the lesson.
• In the school beta, a student’s assigned schoolteacher sees the weekly report, Learner Index and weak areas for learners in their own class only. The school as an institution receives grouped, anonymous numbers only, for example how the grade is doing overall. It never sees one child's report unless you ask us to share it.
• Reviews and ratings are visible to other Users in connection with the Tutor profile.

4.2 Operators (processors)

We engage trusted Operators who process personal information on our behalf, under written agreements that require POPIA-compliant processing. Our principal Operators are:

4.3 Other recipients

• Professional advisors (lawyers, auditors, accountants), under duties of confidentiality;
• Regulators, courts, and law-enforcement authorities, where required by law or court order, including the Information Regulator, the National Consumer Commission, the South African Revenue Service, and the South African Police Service;
• In the event of a corporate transaction (sale, merger, restructuring), to the prospective acquirer under appropriate confidentiality undertakings;
• Any party with your specific consent.

4.4 Cross-border Transfers

Our principal user database and content storage is located in AWS af-south-1 (Cape Town). Some of our Operators (such as our AI provider, Sentry, and Google) process data outside South Africa. Our engineering and technical-support personnel, including contractors located outside South Africa and our CTO, may access limited personal information to build, operate and support the Platform. Such access is governed by data-processing agreements and the POPIA s72 safeguards listed above.

In each case, we ensure compliance with section 72 of POPIA by relying on at least one of the following:

• the recipient is bound by binding corporate rules or by law that provides a level of protection substantially similar to POPIA;
• we have entered into Standard Contractual Clauses or equivalent contractual safeguards;
• you have consented to the transfer; or
• the transfer is necessary for the performance of a contract with you.

6.1 Technical measures

• encryption in transit (TLS 1.2 or higher) and at rest for sensitive data (including ID documents and payment information);
• hashing of passwords using industry-standard salted hashing algorithms;
• two-factor authentication available for all Accounts;
• network segmentation, firewalls, and intrusion detection;
• ID documents stored in private, access-controlled object storage with pre-signed URLs and virus scanning before storage;
• automated security monitoring and alerting (Sentry / equivalent);
• data residency on AWS af-south-1 (Cape Town);
• regular automated and offsite backups.

6.2 Organizational measures

• Role-based access control: staff and contractors are granted access only to the data they need for their function;
• written confidentiality undertakings from all staff and contractors;
• staff training on data protection and information security;
• Data Processing Agreements with all Operators;
• periodic privacy impact assessments before significant new processing activities;
• Data breach notification measures – as specified below.

6.3 Data breach notification

If we have reasonable grounds to believe that the personal information of any data subject has been accessed or acquired by an unauthorized person, we will notify:

• the Information Regulator in accordance with section 22 of POPIA, as soon as reasonably possible after discovery; and
• affected data subjects, by email and (where appropriate) in-Platform notification, as soon as reasonably possible, with sufficient information to enable you to take protective measures, unless the identity of the affected persons cannot reasonably be established or such notification will jeopardise an investigation.
• We also set ourselves an internal target of 72 hours from the moment we confirm a reportable breach. This is our own target only. The section 22 standard in POPIA is the one that governs, and it always comes first.

No system is completely secure. Despite our reasonable safeguards, no method of electronic transmission or storage is 100% secure. We cannot warrant absolute security, but we will deal with any breach in a transparent and lawful manner with the necessary exigency.

7.1 Right to be notified (§ 18)

To be informed that personal information about you is being collected. This Policy serves that purpose.

7.2 Right of access (§ 23)

To request confirmation that we hold personal information about you and to receive a copy of that information. The first request in any 12-month period is free of charge; thereafter, a reasonable fee may apply.

We will respond within the timeframes prescribed by POPIA and PAIA, and we aim to respond within 30 days. Where a request is complex we will tell you and give a revised timeframe.

7.3 Right to correction or deletion (§ 24)

To request that we correct inaccurate, irrelevant, excessive, outdated, or misleading personal information, or that we delete information that is no longer required.

7.4 Right to object to processing (§ 11(3))

To object, on reasonable grounds, to the processing of your personal information for direct marketing or for any processing based on legitimate interest. You may object at any time, free of charge, by emailing hareet@tutornexus.co.za.

7.5 Right to withdraw consent (§ 11(2)(b))

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7.6 Right not to be subject to automated decision-making (§ 71)

Not to be subject to a decision based solely on automated processing that has legal effects on you or significantly affects you. As noted, we do not engage in such automated decision-making.

7.7 Right to data portability

Although POPIA does not have an express portability right, we will provide your personal information in a structured, commonly used, machine-readable format on request, where technically feasible.

7.8 Right to lodge a complaint

To lodge a complaint with the Information Regulator (see clause 12.2). You also have the right to institute civil proceedings under section 99 of POPIA.

7.9 How to exercise your rights

To exercise any of these rights, please email hareet@tutornexus.co.za, with the subject line "POPIA Request". We may ask you to verify your identity (typically by requesting identification matching the Account on file) before processing the request, in order to protect against unauthorized disclosure. Where the request relates to a Minor, the Parent or legal guardian must make the request on the Minor's behalf.

7.10 Tools in the Platform

Many of these rights can be exercised directly within the Platform through your Account dashboard, including the ability to:

• view, correct, or update your profile information;
• download your data export (where available);
• delete a student profile or close your Account;
• manage marketing preferences and notification settings;
• review and re-accept consent records.

10.1 Our School Beta (from 6 October 2026)

From 6 October 2026 we are running a beta with two partner schools, Pearson High School and Theodor Herzl High School, for Grade 10 Mathematics learners. Here is what that means, in plain words:

• Your child joins with a school code. The code only tells us which school and class they are in.
• Every Sunday at 09:00 we send a report. You get your own child's report. Your child's assigned maths teacher gets a report for their class only. A Tutor you book gets a report for that learner only.
• The school itself only sees grouped numbers, like how the whole grade is doing. It never sees one child's report unless you ask us to share it.
• Teachers do not sign up themselves. The school sends us a staff list, and we set up their profiles for them.
• You tick a box when you register to allow this sharing, and you assign the teacher and Tutor yourself. That is your consent under section 35 of POPIA.
• You can change your mind at any time. Email info@tutornexus.co.za and we switch teacher sharing off. Your child keeps using everything else.
• Joining the parent WhatsApp group is optional and is not needed to use the Platform.
• When the beta ends, your Account data follows the normal rules in clause 5. School codes and class lists are deleted 12 months after the school partnership ends.

12.1 Information Officer

Our Information Officer, appointed in terms of section 56 of POPIA, is:

• Name: Hareet Shah
• Role: Chief Executive Officer and Information Officer
• Email: hareet@tutornexus.co.za
• General support: info@tutornexus.co.za
• Postal Address: P O BOX 21174, The Fig Tree, 6033
• The Information Officer is responsible for implementing and monitoring our POPIA compliance, dealing with data-subject requests, and liaising with the Information Regulator.

12.2 The Information Regulator

If you are dissatisfied with our handling of your personal information, you may lodge a complaint with the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Email (POPIA complaints): POPIAComplaints@inforegulator.org.za
• Email (general enquiries): enquiries@inforegulator.org.za
• Toll-free: 0800 017 160
• Telephone: +27 (0)10 023 5200

These contact details were checked on inforegulator.org.za on 11 October 2026.

We would, however, appreciate the opportunity to address any concerns first. Please contact our Information Officer before approaching the Regulator.