Privacy Policy

1. Introduction

High Scholar (Pty) Ltd ('High Scholar', 'we', 'us', or 'our') operates the High Scholar platform, which includes the Teachers web application, the Learners mobile application, and the Parents mobile application. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African legislation.

2. Information we collect

• Account information: names, email addresses, phone numbers, and role (teacher, learner, or parent) provided at registration.
• School information: grade, class, subjects, timetable entries, and academic records uploaded or generated within the platform.
• Usage data: pages visited, features used, session duration, and device identifiers collected automatically via cookies and server logs.
• Communications: messages sent through the in-app chat, announcements, and discussion threads.
• Payment information: billing contact details and transaction references. Full card numbers are handled exclusively by our PCI-compliant payment processor and are never stored on our servers.

3. How we use your information

• To provide, maintain, and improve the High Scholar platform.
• To personalise the experience for each user role.
• To send transactional notifications (assignment reminders, class updates, attendance alerts).
• To generate anonymised, aggregated analytics that help schools understand learner progress.
• To comply with legal obligations and respond to lawful requests from public authorities.

4. Sharing of personal information

We do not sell, rent, or trade personal information with third parties for their marketing purposes. We share information only with: (a) the school at which the user is enrolled, in accordance with the school's mandate; (b) service providers operating under binding data processing agreements (e.g. cloud hosting, email delivery); and (c) regulatory bodies when required by law.

5. Data storage and transfers

All personal information is stored on servers located within the Republic of South Africa. We do not transfer personal information outside South Africa without first ensuring adequate data protection safeguards are in place, consistent with POPIA.

6. Data retention

We retain personal information for as long as the account remains active, or as long as required to fulfil the purposes described in this policy. Upon account termination, data is deleted or anonymised within 90 days, unless a longer retention period is required by law or the institution's records management policy.

7. Security measures

We implement appropriate technical and organisational measures to protect personal information against accidental loss, destruction, alteration, and unauthorised access. These include AES-256 encryption at rest, TLS 1.3 in transit, multi-factor authentication options, and annual penetration testing.

8. Your rights

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information.
• Deletion: request erasure of your information, subject to legal retention obligations.
• Objection: object to certain processing activities.
• Complaint: lodge a complaint with the Information Regulator of South Africa (inforeg.org.za).

9. Cookies

We use strictly necessary cookies to operate the platform and optional analytics cookies to improve it. You can manage cookie preferences through the cookie banner displayed on your first visit or via your browser settings. See our Cookie Policy for full details.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users by email and by displaying a prominent notice in the platform at least 14 days before any material changes take effect.