POPIA Compliance

Our commitment

High Scholar (Pty) Ltd is fully committed to compliance with the Protection of Personal Information Act 4 of 2013 (POPIA). We recognise that the personal information of learners, parents, and educators is sensitive, and we apply POPIA's eight conditions for lawful processing as foundational requirements — not optional extras.

Accountability

We have appointed a dedicated Information Officer, registered with the Information Regulator of South Africa, who is responsible for overseeing all data protection activities, handling data subject requests, and ensuring that our internal policies remain aligned with POPIA and guidance issued by the Regulator.

Processing limitation

We collect only the personal information that is necessary for the specific, explicitly defined purposes of operating a school management platform. We do not process personal information for secondary purposes incompatible with those stated in our Privacy Policy, and we do not process special personal information (including health and biometric data) without explicit consent or another lawful basis.

Purpose specification

• Academic records are used solely to track and report learner progress to the school.
• Contact information is used for platform communication and account management only.
• Usage analytics are processed in anonymised, aggregated form to improve the platform.
• All purposes are disclosed to users at the time of data collection.

Further processing limitation

Personal information collected for one purpose is not subsequently used for an incompatible purpose. We conduct a compatibility assessment before any new use of existing data and obtain fresh consent where required.

Information quality

We take reasonable steps to ensure that personal information is accurate, complete, and kept up to date. Users can review and correct their own information at any time through the account settings page. Schools can request corrections on behalf of learners through the administrator portal.

Openness

Our Privacy Policy is publicly available and written in plain language. We provide a layered notice at the point of data collection so that users understand what information is being collected and why before they provide it.

Security safeguards

• AES-256 encryption for all data at rest.
• TLS 1.3 for all data in transit.
• Role-based access control limiting data access to authorised personnel.
• Annual third-party penetration testing and quarterly vulnerability assessments.
• A documented incident response plan with mandatory notification to the Information Regulator within 72 hours of discovering a material breach.

Data subject participation

Data subjects (learners, parents, and educators) may request access to, correction of, or deletion of their personal information by contacting our Information Officer at privacy@highscholar.co.za. We will respond to all requests within 30 days as required by POPIA. Complaints may also be lodged with the Information Regulator at inforeg.org.za.

Operator agreements

Where third-party operators process personal information on our behalf (e.g. cloud infrastructure providers), we enter into written operator agreements that impose POPIA-equivalent obligations. We conduct due diligence on all operators before engaging them and review operator compliance annually.

Contact our Information Officer

Information Officer: Thandi Dube. Email: privacy@highscholar.co.za. Postal: High Scholar (Pty) Ltd, 14 Sandton Drive, Sandton, 2196, Gauteng, South Africa.