Privacy Policy

1. Introduction

EduSpec Solutions (Pty) Ltd ("EduSpec", "we", "our", or "us") is committed to protecting the privacy and security of personal information.

This Privacy Policy describes how EduSpec collects, processes, stores, protects, and discloses personal information when users access or use our software platforms, websites, and related services (collectively referred to as the "Services").

EduSpec provides technology solutions primarily for educational institutions, including systems used for:

• School fee exemption management
• Debt management
• Reporting and analytics
• Communication with parents and guardians

EduSpec processes personal information in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and, where applicable, aligns with international data protection best practices.

2. Scope of this Policy

This Privacy Policy applies to:

• Users of the EduSpec website
• Schools and institutions using EduSpec software
• Administrators and staff of client institutions
• Parents or guardians whose information is processed within the EduSpec platform

In most cases, schools remain the responsible party for personal information processed within the EduSpec system.

EduSpec acts as an operator by providing the technology platform and processing information on documented instructions from client institutions.

3. Categories of Personal Information Collected

EduSpec may process the following categories of personal information depending on how the Services are used.

3.1 Identity Information

• Full names
• National identification numbers
• Date of birth
• Gender

3.2 Contact Information

• Email addresses
• Telephone numbers
• Residential addresses
• Postal addresses

3.3 Student Information

Information relating to learners enrolled at client institutions, which may include:

• Student names
• Student numbers
• Class or grade information
• Guardian relationships

3.4 Financial Information

Information related to school accounts, including:

• Fee balances
• Payment history
• Exemption application data
• Financial documentation submitted during exemption processes

3.5 Institutional Data

• School configuration settings
• Institutional financial records
• Reporting data

3.6 Technical and Usage Information

When accessing our website or software platform, we may collect:

• IP address
• Browser type
• Operating system
• Device identifiers
• Log files
• Usage statistics
• Authentication data

4. Lawful Basis for Processing

EduSpec processes personal information on the following lawful bases where applicable:

• Performance of contractual obligations with educational institutions
• Compliance with legal obligations
• Legitimate business interests such as platform security and service improvement
• Instructions provided by client institutions acting as responsible parties

Where required by law, consent will be obtained by the responsible party, being the relevant educational institution.

5. How We Use Personal Information

EduSpec processes personal information strictly for defined, lawful, and legitimate operational purposes, including:

• Providing and maintaining the EduSpec platform
• Processing school exemption applications
• Managing financial account records
• Generating reports for schools
• Facilitating communication between schools and parents
• Sending system-generated messages, notifications, and alerts via integrated communication platforms such as email, SMS, or WhatsApp
• Ensuring platform security and fraud prevention
• Improving system performance and functionality
• Providing technical support to client institutions
• Complying with applicable legal requirements

EduSpec limits the collection and processing of personal information to what is necessary for the purposes described in this policy.

EduSpec does not use personal information for advertising, commercial resale, or sale to third parties.

6. Data Processing on Behalf of Educational Institutions

EduSpec primarily processes personal information on behalf of schools and educational institutions.

In these cases:

• The institution determines the purpose and means of processing personal information.
• EduSpec processes such information strictly according to the institution's instructions.
• EduSpec implements appropriate security safeguards to protect the information.
• Schools are responsible for ensuring that they have obtained appropriate consent or other legal authority to process personal information within the EduSpec platform.

7. Data Security

EduSpec maintains a comprehensive information security program designed to protect personal information from unauthorized access, alteration, disclosure, or destruction.

Security measures include, but are not limited to:

• Role-based access control
• Secure authentication systems
• Encrypted communications (HTTPS/TLS)
• System activity logging and monitoring
• Secure hosting infrastructure
• Network firewalls and intrusion detection
• Regular system updates and patch management
• Password policies and session management controls

Access to personal information is restricted to authorized personnel who require access for operational purposes.

EduSpec maintains audit logs of relevant system access and processing activities and may provide reasonable audit-related information to client institutions where appropriate.

8. Data Storage and Hosting

EduSpec systems may be hosted using reputable third-party infrastructure providers.

Personal information may be stored on secure servers located within South Africa or in other jurisdictions that maintain appropriate data protection safeguards.

Where personal information is transferred outside of South Africa, EduSpec will take reasonable steps to ensure that:

• The recipient is subject to laws, binding rules, or agreements that provide an adequate level of data protection; or
• The transfer is otherwise permitted under applicable law; or
• Any required authorisation or consent has been obtained.

9. Data Retention

EduSpec retains personal information only for as long as necessary to:

• Fulfil the purposes described in this Privacy Policy
• Provide contracted services to educational institutions
• Comply with legal and regulatory obligations
• Maintain appropriate system backups and audit records

Retention periods may also be determined by client institutions who control the data.

Personal information may be retained in secure backups for a limited period for disaster recovery, continuity, and audit purposes.

10. Disclosure of Personal Information

10.1 To Client Institutions

Information may be accessed by authorized staff of the school or educational institution using the EduSpec platform.

10.2 Service Providers

We may engage trusted service providers to assist with:

• Cloud infrastructure
• Email delivery services
• Messaging services
• System monitoring

These providers are contractually obligated to maintain appropriate confidentiality and security protections.

EduSpec ensures that approved sub-processors or service providers are subject to written agreements that impose appropriate confidentiality, security, and data protection obligations.

10.3 Legal Requirements

EduSpec may disclose information when required by law, regulation, legal process, or court order.

10.4 Protection of Rights

Information may be disclosed where necessary to protect the rights, property, or safety of EduSpec, its clients, or others.

11. Cookies and Website Technologies

EduSpec websites may use cookies or similar technologies to:

• Maintain secure login sessions
• Improve website performance
• Analyze website usage
• Support security, authentication, and service functionality

Users may manage cookie preferences through their browser settings.

12. Children's Information

EduSpec systems may process information relating to minors as part of the services provided to schools.

Such processing occurs under the authority of the relevant educational institution and in accordance with applicable laws and parental consent requirements.

EduSpec does not knowingly collect personal information directly from children through its public website.

13. Data Subject Rights

Subject to applicable law, individuals may have the right to:

• Request access to personal information
• Request correction of inaccurate information
• Request deletion of information where legally permissible
• Object to certain types of processing
• Lodge a complaint with a regulatory authority

Where EduSpec acts as an operator on behalf of a school, such requests should normally be directed to the relevant institution.

Requests may also be submitted using the contact details below. EduSpec may require reasonable verification of identity before processing any request.

14. Incident Response and Data Breaches

EduSpec maintains internal procedures for detecting, responding to, and managing potential data security incidents.

Where required by law, EduSpec will notify affected institutions and regulatory authorities of material data breaches in accordance with POPIA and other applicable legal requirements.

15. Changes to this Privacy Policy

EduSpec may update this Privacy Policy from time to time to reflect:

• Changes in legal requirements
• Improvements to our services
• Updates to security practices

The updated policy will be published on our website with a revised effective date.

16. Contact Information

We will respond to reasonable privacy-related enquiries and requests in accordance with applicable data protection laws.

17. Communication Services (Including WhatsApp and Meta Platforms)

EduSpec may provide communication functionality through third-party platforms such as WhatsApp and other Meta services.

When users communicate with educational institutions through these channels:

• Messages may include personal information such as names, contact details, account references, and communication content.
• Such information is processed to facilitate communication between schools and parents or guardians.
• EduSpec does not access or use message content for advertising or unrelated marketing purposes.

These communication services are provided through third-party platforms, including Meta Platforms technologies, which may independently process personal information in accordance with their own privacy policies and terms.

Users are encouraged to review Meta's privacy information at Meta Privacy Policy.

EduSpec only processes messaging data as necessary to deliver its services and in accordance with instructions from client institutions.

Where a user initiates communication through supported channels such as WhatsApp, that user acknowledges that their information may be processed in order to receive, manage, and respond to such communication.