Privacy Policy
Clear information about using S'gelaHub and how we handle personal information.
1. POPIA governance
S'gelaHub treats the protection of personal information as a governance responsibility. The platform seeks to apply POPIA's conditions for lawful processing, including accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data-subject participation. S'gelaHub will maintain appropriate internal policies, records, access rules and responsible-person oversight as the platform grows.
2. Who this policy applies to
This policy applies to visitors, applicants, principals, school administrators, teachers, parents, learners, Affiliate Partners and other people whose information is processed through S'gelaHub.
3. Information we may collect
Depending on use, this may include identity and contact details, school and role information, account and login data, learner and academic information, class and assessment information, parent or guardian contacts, subscription and payment-related records, support communications, application records and verification documents.
Affiliate applications may include a CV, certified identification and proof of address. These are verification documents and are subject to enhanced access restrictions.
4. Learners and children
S'gelaHub may process learner information. Schools, parents and authorised adults must have the authority required to provide information and grant access. Learner records are subject to role-based access and are not intended for unrestricted public or guest use.
5. Purposes and lawful processing
Information is used to provide and secure the platform, manage accounts and school relationships, deliver lessons and assessments, support learning, administer subscriptions and payments, review Affiliate applications, provide support, prevent abuse and fraud, maintain reliability, and comply with legal obligations. The applicable lawful basis depends on the activity and may include performance of an agreement, legal obligation, legitimate interests, consent or another lawful basis permitted by law.
6. Data-subject requests
Data subjects may submit appropriate requests concerning access to their personal information, correction or updating, deletion where lawful, objection or restriction of processing where applicable, withdrawal of consent where consent is the lawful basis, and information about processing. Requests should be sent to admin@sgelahub.co.za with enough information to identify the request without unnecessarily sending sensitive information by email. S'gelaHub may verify identity and may apply lawful exceptions or limits.
7. PAIA and access to records
PAIA governs access to records held by private bodies subject to the Act. S'gelaHub maintains a PAIA Manual explaining the access-request route, applicable exclusions and the responsible contact channel.
8. Third-party processors and operators
S'gelaHub may use third-party service providers for hosting, infrastructure, payments, messaging, email, analytics, security and AI functionality. Where a provider acts as an operator processing personal information on S'gelaHub's behalf, S'gelaHub will use written operator/data-processing terms requiring confidentiality, security safeguards, purpose limitation, access controls, incident notification and appropriate deletion or return of information at the end of the service. Providers acting independently as their own responsible parties may have their own privacy terms.
Supplier onboarding and Education Store participation may involve business contact, payment and fulfilment information as described in the School Store Supplier Partnership Terms.
10. Cross-border processing
Some providers may process information outside South Africa. Where cross-border processing occurs, S'gelaHub will apply the requirements and safeguards applicable to such transfers, including appropriate contractual or other lawful protections.
11. Security controls and access controls
S'gelaHub uses reasonable technical and organisational controls appropriate to the risks, including authenticated access, role-based authorisation, least-privilege principles, nonce/request protections where applicable, secure password handling, server-side authorisation checks, protected verification-document storage, audit-oriented records, backups and controlled service-provider access. Controls are reviewed and updated as risks and the platform change.
Verification documents are not intended to be publicly accessible. Administrative access is restricted to authorised personnel with a legitimate need.
12. Security compromise and breach procedure
Suspected compromise must be identified, contained and investigated; affected systems and evidence must be preserved where appropriate; risks must be assessed and mitigated; and responsible personnel must be notified. Where POPIA notification is required, S'gelaHub will notify the Information Regulator and affected data subjects in accordance with the applicable process. Operators must promptly notify S'gelaHub of a compromise affecting information processed on its behalf.
13. Retention and deletion
Information is retained only as long as reasonably necessary for its stated purpose, legitimate operational records, dispute resolution, security, or legal obligations. Retention periods are determined by record type. When the retention basis ends, S'gelaHub will securely delete, destroy or anonymise the information, subject to lawful preservation requirements. Verification documents receive particular attention because they can contain identity information.
14. Sharing
S'gelaHub does not sell personal information. Information may be disclosed to authorised schools and users according to their role and entitlement, service providers where necessary, regulators or authorities where legally required, and other parties where the data subject has lawfully requested or authorised the disclosure.
15. AI-assisted processing
Where AI features are enabled, information included in an AI request may be processed by the configured AI provider. Access boundaries and purpose restrictions apply, and users must not submit information to AI features unless authorised to do so.
16. Cookies, browser storage and offline learning
S'gelaHub may use cookies, browser storage and IndexedDB to authenticate users, preserve preferences, support offline learning and queue work for synchronisation. Offline learning data remains subject to the same access and security expectations as the online service. Queued work is synchronised when connectivity returns and is removed from the queue only after server acceptance.
17. Updates
This Privacy Policy may be updated when the service, integrations, processing activities or legal obligations change. The effective date will be published with the current version.
18. Complaints
Privacy requests and complaints can be sent to admin@sgelahub.co.za. A data subject may also approach the Information Regulator of South Africa where appropriate.