Privacy Policy: Isibonelo High School Kiosk

1.1 Purpose of this Policy

Isibonelo High School (the “School”) and its School Governing Body (SGB) are committed to protecting the privacy and personal information of all individuals who interact with the Isibonelo High School Kiosk (the “Kiosk”). This Privacy Policy explains how personal information is collected, used, stored, shared, and protected in connection with the Kiosk, in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and the Promotion of Access to Information Act 2 of 2000 (PAIA).

1.2 Legal Framework

This Policy is drafted in compliance with:

• The Constitution of the Republic of South Africa, 1996 – Section 14 (Right to Privacy);
• The Protection of Personal Information Act 4 of 2013 (POPIA);
• The Promotion of Access to Information Act 2 of 2000 (PAIA);
• Applicable regulations issued by the Information Regulator of South Africa.

1.3 Who This Policy Applies To

This Policy applies to all data subjects whose personal information may be processed through the Kiosk, including:

• Learners of Isibonelo High School;
• Parents, legal guardians, and caregivers of learners;
• Staff and educators of Isibonelo High School;
• Members of the School Governing Body;
• Volunteers and service providers;
• Members of the public who interact with the Kiosk.

1.4 Authority and Governance

Isibonelo High School and its School Governing Body (SGB) are the ultimate authority for the Isibonelo High School Kiosk and bear the primary responsibility for this Privacy Policy and its implementation. The School, as a responsible party under POPIA, determines the purpose and means for processing personal information collected through the Kiosk.

The Greytown Collaborative Education Initiative (GCEI), an NGO/NPC, facilitates this programme and takes custodianship of the Kiosk from an operational point of view. GCEI contracts with various providers and deploys different technologies to support the Kiosk’s operations. GCEI acts as an operator under POPIA, processing personal information on behalf of the School in accordance with this Policy and applicable data processing agreements.

1.5 The Kiosk as a Fundraising Initiative

The Isibonelo High School Kiosk is a fundraising initiative intended to help raise money for the School through the sale of retail goods and services. As part of its operations, the Kiosk may collect and process personal information from customers, learners, parents, and service providers to facilitate transactions, communicate about products and services, and support the School’s fundraising objectives.

3.1 Appointment of Information Officer

In accordance with Section 55 of POPIA, the School Principal of Isibonelo High School acts as the School’s Information Officer and fulfils the duties and responsibilities prescribed by the Act.

3.2 Responsibilities of the Information Officer

The Information Officer is responsible for:

• Ensuring the School’s compliance with POPIA;
• Registering the School with the Information Regulator;
• Responding to requests for access to information in terms of PAIA;
• Overseeing the implementation of this Privacy Policy;
• Ensuring that staff, volunteers, and operators are trained on POPIA compliance;
• Handling data subject inquiries, complaints, and access requests.

3.3 Deputy Information Officer

The School may, from time to time, designate a Deputy Information Officer to assist the Information Officer. GCEI, in its capacity as operator, shall designate a contact person to liaise with the Information Officer on operational matters relating to the Kiosk.

4.1 Types of Personal Information Collected

Through the Kiosk, the School may collect the following categories of personal information:

4.1.1 Learner Information

• Full names and surnames;
• Grade and class assignments;
• Learner identification numbers.

4.1.2 Parent and Guardian Information

• Full names and surnames;
• Contact details (email addresses, telephone numbers, physical addresses);
• Financial information (for payment processing).

4.1.3 Customer and User Information

• Names and contact details of individuals purchasing goods or services from the Kiosk;
• Transaction records and purchase history;
• Payment information (processed securely through payment gateways).

4.1.4 Staff and Volunteer Information

• Names, contact details, and identification information of staff and volunteers operating the Kiosk.

4.1.5 Technical Information

• IP addresses and device information (where the Kiosk operates online);
• Cookies and similar tracking technologies (where applicable).

4.2 Special Personal Information

POPIA provides enhanced protection for “special personal information,” including information concerning a person’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, or sex life. The School does not intentionally collect special personal information through the Kiosk, except where it is reasonably necessary and authorised by law.

The School collects personal information through the Kiosk in the following ways:

1. Direct collection – when individuals voluntarily provide their information when making purchases, registering for services, or communicating with the Kiosk.
2. Through service providers and technology platforms – GCEI and its contracted providers may collect information as part of the Kiosk’s operational systems (e.g., point-of-sale systems, online ordering platforms).
3. Through enrolment and school records – where the Kiosk requires verification of learner or parent status for eligible transactions.
4. Through photographs or images – where the Kiosk captures images for promotional or operational purposes (subject to separate consent).

The School processes personal information through the Kiosk only on one or more of the following lawful bases:

6.1 Consent

Where the School relies on consent, such consent must be:

• Explicit – clearly and unmistakably given;
• Informed – the data subject must understand what they are consenting to;
• Voluntary – freely given without coercion.

For children under the age of 18, consent must be obtained from a parent or legal guardian (a competent person).

6.2 Contractual Necessity

Personal information may be processed where necessary for the performance of a contract to which the data subject is a party, including processing payments and fulfilling orders placed through the Kiosk.

6.3 Legal Obligation

Personal information may be processed where required by law or regulatory obligation.

6.4 Legitimate Interest

The School may process personal information where it is necessary for the School’s legitimate interests, provided that such interests are not overridden by the data subject’s privacy rights.

The School processes personal information through the Kiosk for the following specific, explicitly defined, and legitimate purposes:

7.1 Core Kiosk Operations

• Facilitating the sale of retail goods and services;
• Processing payments and issuing receipts;
• Managing inventory and stock control;
• Maintaining transaction records for financial reporting.

7.2 Fundraising and School Support

• Tracking funds raised for the School;
• Reporting to the School Governing Body on fundraising performance;
• Identifying opportunities for further fundraising initiatives.

7.3 Communication

• Communicating with customers about orders, products, and services;
• Sending marketing communications about the Kiosk and School fundraising activities (only with consent);
• Responding to inquiries and complaints.

7.4 Operational Management

• Managing staff and volunteer schedules;
• Training staff and volunteers on Kiosk operations;
• Ensuring security and preventing fraud.

7.5 Compliance and Reporting

• Complying with legal and regulatory obligations;
• Reporting to the School Governing Body and relevant authorities;
• Maintaining records for audit and accountability purposes.

The School will not process personal information for any purpose other than those stated above without first obtaining the data subject’s consent or another lawful basis.

8.1 With Whom We Share Information

The School may share personal information collected through the Kiosk with the following parties:

1. The Greytown Collaborative Education Initiative (GCEI) – as the operator facilitating the Kiosk programme, GCEI processes personal information on behalf of the School in accordance with a data processing agreement.
2. Service Providers and Technology Partners – GCEI contracts with various providers and deploys different technologies to support the Kiosk’s operations. These may include payment processing providers, point-of-sale system providers, inventory and stock management providers, and communication and marketing platforms.
3. The School Governing Body – for reporting and oversight purposes.
4. Regulatory and Law Enforcement Authorities – where required by law or where necessary to protect the rights, property, or safety of the School, its learners, staff, or the public.

8.2 Conditions for Sharing

Personal information will only be shared with third parties:

• Where the data subject has provided consent;
• Where necessary for the performance of a contract;
• Where required by law;
• Where the third party has agreed to comply with POPIA and this Privacy Policy.

No personal information will be shared with third parties for their own marketing purposes without the explicit consent of the data subject.

8.3 Cross-Border Transfers

The School does not intend to transfer personal information outside the borders of South Africa. Should any cross-border transfer become necessary, the School will ensure that the recipient jurisdiction provides an adequate level of protection for personal information, or that appropriate safeguards are in place, as required by Section 72 of POPIA.

9.1 Security Measures

The School, in collaboration with GCEI, implements appropriate technical and organisational measures to protect personal information from loss, damage, unauthorised access, disclosure, alteration, or destruction. These include:

9.1.1 Technical Safeguards

• Access controls and password protection;
• Encryption of sensitive data (including payment information);
• Firewalls and secure networks;
• Regular security audits and vulnerability assessments.

9.1.2 Organisational Safeguards

• POPIA awareness training for all staff and volunteers involved in the Kiosk;
• Clear policies and procedures for handling personal information;
• Restriction of access to personal information on a need-to-know basis;
• Regular review and updating of security measures.

9.2 Staff and Volunteer Obligations

All staff, volunteers, and contractors involved in the Kiosk are required to:

• Handle personal information confidentially and with care;
• Access personal information only as necessary for their duties;
• Report any suspected security breaches immediately to the Information Officer.

9.3 Security Breach Notification

In the event of a security breach that compromises personal information, the School will:

1. Notify the Information Regulator within 72 hours of becoming aware of the breach;
2. Notify affected data subjects where the breach is likely to adversely affect their privacy;
3. Take immediate steps to contain and remediate the breach;
4. Investigate the cause of the breach and implement measures to prevent recurrence.

10.1 Retention Period

The School will retain personal information collected through the Kiosk only for as long as is necessary to achieve the purpose for which it was collected, or as required by law.

10.2 Retention Periods by Category

10.3 Destruction of Information

Once personal information is no longer needed for the purpose for which it was collected and no legal obligation requires its retention, the School will:

• Permanently delete or destroy the information;
• Ensure that any service providers or operators holding the information also delete or destroy it;
• Maintain records of destruction for accountability purposes.

Under POPIA, data subjects have the following rights regarding their personal information:

11.1 Right to Access

Data subjects have the right to request access to their personal information held by the School. Requests for access must be made in writing to the Information Officer and will be handled in accordance with PAIA.

11.2 Right to Correction

Data subjects have the right to request that inaccurate or outdated personal information be corrected or updated.

11.3 Right to Object

Data subjects have the right to object to the processing of their personal information on reasonable grounds, unless the processing is required by law.

11.4 Right to Withdraw Consent

Where processing is based on consent, data subjects have the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

11.5 Right to Complain

Data subjects have the right to lodge a complaint with the Information Regulator of South Africa if they believe their personal information has been processed unlawfully.

11.6 How to Exercise These Rights

To exercise any of these rights, data subjects should contact the Information Officer using the contact details provided in Section 14 of this Policy.

12.1 Obtaining Consent

The School will obtain explicit, informed, and voluntary consent from data subjects (or competent persons, where the data subject is a child) before collecting, processing, or sharing personal information through the Kiosk.

12.2 Consent for Children

Where the data subject is a child under the age of 18, the School will obtain consent from a parent or legal guardian (a competent person). The School takes its obligation to protect children’s privacy seriously and will process children’s personal information only where sufficient guarantees are provided to ensure that the processing does not adversely affect the individual privacy of the child.

12.3 Consent for Photographs and Images

The use of photographs or images of learners, parents, staff, or visitors for promotional purposes (including marketing the Kiosk or fundraising activities) requires separate, explicit consent and must be obtained through a dedicated consent form.

12.4 Withdrawal of Consent

Consent may be withdrawn at any time by contacting the Information Officer. Upon withdrawal, the School will cease processing the relevant personal information, except where processing is required by law or for the performance of a contract.

13.1 GCEI as Operator

The Greytown Collaborative Education Initiative (GCEI), as an NGO/NPC, facilitates the Isibonelo High School Kiosk programme and takes custodianship of the programme from an operational point of view. GCEI contracts with various providers and deploys different technologies to support the Kiosk’s operations.

In this capacity, GCEI acts as an operator under POPIA, processing personal information on behalf of the School in accordance with:

• This Privacy Policy;
• A written data processing agreement between GCEI and the School;
• POPIA’s requirements for operators.

13.2 GCEI’s Obligations

As operator, GCEI is obligated to:

• Process personal information only on the documented instructions of the School;
• Implement appropriate security measures to protect personal information;
• Ensure that any subcontractors or service providers comply with POPIA;
• Assist the School in responding to data subject requests;
• Notify the School of any security breaches;
• Delete or return personal information to the School at the end of the contract.

13.3 Technology and Service Providers

GCEI contracts with various providers and deploys different technologies to support the Kiosk’s operations. All such providers are subject to appropriate contractual obligations to ensure compliance with POPIA and this Privacy Policy.

14.1 Information Officer

The Information Officer for Isibonelo High School is the School Principal.

14.2 Deputy Information Officer / GCEI Contact

For operational matters relating to the Kiosk, data subjects may also contact:

14.3 Information Regulator of South Africa

Data subjects who wish to lodge a complaint regarding the processing of their personal information may contact the Information Regulator:

The School reserves the right to amend this Privacy Policy from time to time. Data subjects will be notified of any material changes through:

• The School’s website (if applicable);
• Notice boards at the School;
• Direct communication where appropriate.

The date of the most recent revision will be indicated at the top of this Policy.

This Privacy Policy is adopted by Isibonelo High School and its School Governing Body (SGB) as the ultimate authority for the Isibonelo High School Kiosk.