TeachFirst (Pty) Ltd — Privacy Policy

Introduction

This Privacy Policy is issued by TeachFirst (Pty) Ltd (“TeachFirst”, “we”, “us”) and governs the Processing of Personal Information through the App, in compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). Capitalised terms used in this Policy have the meaning given in the Definitions Schedule.

Information Officer

• Information Officer: Lesego Mailula
• Registered Entity: TeachFirst (Pty) Ltd
• Registration Number: 2026/413627/07
• Contact Email: privacy@teachfirst.co.za

The Information Officer is designated in accordance with section 55 of POPIA and is responsible for encouraging compliance with this Policy and the Act.

Scope

This Policy applies to Personal Information processed through the App: (a) Teacher Account information, and (b) Learner Records entered by Teachers. By using the App, you acknowledge that you have read and understood this Policy. The App is designed for use by registered educators; it is not intended for direct use by children as Account holders.

Information We Collect

4.1 Teacher (Account Holder) Information

• Google account identity, via OAuth, for authentication only
• Full name, school name, grade/classroom designation, number of learners
• Subscription and payment status (see Clause 10 — TeachFirst never receives full card details)

4.2 Learner Records

Teachers may record: Learner first name and surname, date of birth, attendance records, academic and assessment records (baseline, continuous/CASS, diagnostic), and, where the incident-book feature is used, incident records relevant to learner safety and conduct. Learner Records are Personal Information — and, given Learners are children, Personal Information of Children — under POPIA. The Teacher (and their school, where applicable) is the Responsible Party for this information; TeachFirst acts as Operator. See Clause 8 (Children’s Information) and the POPIA Operator Agreement for the full allocation of responsibility.

4.3 Technical and Usage Data

The App does not collect behavioural analytics or usage profiling. Limited technical information (e.g. error logs, security event logs) is generated as described in Clause 13 (Security) — this exists to keep the Service secure and running, not to observe your activity.

Cookies and Similar Technologies

The App uses only strictly necessary technologies required for it to function — principally an authenticated session token created when you log in via Google OAuth, which keeps you signed in and secures your session. We do not use cookies, pixels, or similar technologies for advertising, cross-site tracking, behavioural profiling, or analytics of any kind, and no such technology may be introduced without this Policy being updated first and, where the technology is not strictly necessary, your prior consent being obtained. Because this processing is limited to what is strictly necessary to operate the Service, no separate cookie-consent banner is used; this clause is the notice POPIA section 18 requires for that processing.

Purpose and Lawful Basis

We process Personal Information to: authenticate Teachers via Google OAuth; provide the Teacher profile and classroom administration features; enable Learner record-keeping within a Teacher’s private environment; process Subscription payments; facilitate Teacher-initiated Google Drive export; and respond to support requests. Processing is carried out under contract (to provide the Service the Teacher subscribed to) and, for Learner Records, on the Teacher’s mandate as Responsible Party. We do not use Personal Information for direct marketing, automated decision-making, or profiling.

Minimality

We collect only the information necessary for the purposes above. We do not ask Teachers to enter Learner Records beyond what a Foundation Phase administrative record requires, and the Prohibited Data list in the Acceptable Use & Data Entry Policy sets out categories of information Teachers must not enter into the App.

Children’s Information

TeachFirst does not directly solicit information from children, and Learners are not Account holders. Learner Records are entered by the Teacher in a professional capacity. Because this is Personal Information of Children, TeachFirst applies additional safeguards: Learner Records are limited to the fields listed in Clause 4.2, the Prohibited Data list applies in full, and the incident-book feature is append-only and designed around the Children’s Act’s mandatory-reporting framework rather than general-purpose note-taking. The Teacher remains responsible for the lawful basis for capturing each Learner’s information (see Clause 13 of the POPIA Operator Agreement) — TeachFirst does not verify parental consent or school authorisation, and the App is not a substitute for a school’s own consent processes.

Google Account Integration and Google Drive Export

TeachFirst uses Google OAuth 2.0 for authentication, requesting only the minimum permissions necessary to verify identity. We do not access Gmail, Calendar, Contacts, or any other Google service. Your Google password is never transmitted to or stored by TeachFirst. Google Drive export is Teacher-initiated: you grant the App permission to write to a folder you choose, and TeachFirst writes only to that folder — it does not read, alter, or access any other Drive content. We recommend regular exports as an independent backup; see the Data Retention & Destruction Schedule for what this does and does not guarantee.

Payment Processing and Security

Subscription payments are processed by Paystack, a PCI-DSS-compliant payment gateway, via a direct server-to-server integration from the TeachFirst backend, over an encrypted (TLS) connection. TeachFirst does not receive, store, or have access to full card numbers, CVV, or expiry dates — Paystack returns only a transaction/subscription status reference, which we retain as described in the Data Retention & Destruction Schedule. You may request details of what payment-related information we hold by contacting the Information Officer (Clause 2). See the Sub-Processor Register for Paystack’s role and data categories.

Third-Party Service Providers

TeachFirst relies on Third-Party Service Providers to operate the App — currently including Firebase (hosting, database, authentication infrastructure, africa-south1 region), Paystack (payments), and Google (OAuth and Drive). The categories of provider, function, and data categories processed are listed in full in the Sub-Processor Register, which we update as our infrastructure changes. TeachFirst does not control these providers’ independent privacy practices, but each is engaged under contractual security obligations consistent with POPIA’s operator framework — see the POPIA Operator Agreement.

Cross-Border Transfers

Our primary infrastructure (Firebase) is hosted on the africa-south1 (Johannesburg) region specifically to keep Learner Records within South Africa at rest. Some Third-Party Service Providers — including elements of Google’s global infrastructure used for OAuth and Drive — may process limited data on servers outside South Africa in the course of providing their service. Where this occurs, TeachFirst relies on POPIA section 72 (the receiving party being subject to laws, binding corporate rules, or agreements that provide an adequate level of protection) as the mechanism for transfer. The Sub-Processor Register identifies which providers may process information outside South Africa. We do not represent that all data at all times remains exclusively in South Africa — only that our primary storage architecture is configured to keep it there.

Data Storage, Security and Access Architecture

TeachFirst is built on a zero access model for Learner Records and Teacher Account data: no TeachFirst employee, director, developer, contractor, or agent has the technical capability — through the Firebase console, internal admin tooling, or support workflows — to view, retrieve, alter, or export a Teacher’s Learner Records. This is achieved through per-account authenticated access control, encryption of data at rest and in transit, and the deliberate absence of any administrative override, backdoor, or bulk-read pathway into Learner data in our application architecture.

This commitment means no TeachFirst person can access your data — it describes human access, not every automated process the Service relies on. It does not extend to: encrypted infrastructure-level backups managed by Firebase/Google Cloud (which TeachFirst does not read but which exist for disaster recovery), or technical error logs that may reference an Account identifier without exposing Learner Record content. These exceptions are described in full in the Security & Incident Response Policy, the Data Retention & Destruction Schedule, and the Sub-Processor Register.

No digital system can guarantee absolute security. In the event of a Security Compromise affecting Personal Information, we will notify affected Teachers in accordance with section 22 of POPIA within the required timeframe, and will follow the process set out in the Security & Incident Response Policy.

Sharing and Disclosure

We do not sell, rent, trade, or share Personal Information or Learner Records for commercial, marketing, or research purposes. We may disclose information only: where compelled by valid legal process under South African law; where necessary to protect the vital interests of a person (for example, a credible child-safety concern); or where you have given explicit written consent to a specific disclosure. Beyond these narrow exceptions, and beyond the Third-Party Service Providers listed in Clause 11, no Learner Record is shared by TeachFirst.

Data Subject Rights

Under POPIA, you have the right to: be notified that your Personal Information is being processed; request access to information we hold about you; request correction of inaccurate, incomplete, or outdated information; request deletion or destruction of your information, subject to the Data Retention & Destruction Schedule and any legal retention obligation; object to processing; and lodge a complaint with the Information Regulator. To exercise these rights, contact the Information Officer (Clause 2). We will respond within a reasonable period in accordance with POPIA.

Information Regulator of South Africa: www.inforegulator.org.za | inforeg@justice.gov.za | +27 (0) 10 023 5200

Access, Correction and Deletion

Requests to access, correct, or delete Personal Information should be directed to the Information Officer. Because of TeachFirst’s zero-access architecture, most access and correction can be performed directly by the Teacher within the App; requests requiring TeachFirst’s involvement (e.g. full account deletion) are processed as described in the Data Retention & Destruction Schedule.

Retention

Personal Information is retained only as long as necessary for the purposes in Clause 6, or as required by law. The specific retention periods for each category of data (Teacher accounts, Learner Records, payment records, support tickets, security logs, consent records, and backups) are set out in the Data Retention & Destruction Schedule, which forms part of this Policy.

Direct Marketing

TeachFirst does not currently send direct marketing communications. If we introduce direct marketing in future, we will do so only with your consent (opt-in) as required by POPIA section 69 and ECTA section 45, and every marketing communication will identify us as the sender, state the source of your information, and include a clear, working option to unsubscribe or object at no cost. You may withdraw consent to direct marketing at any time by contacting the Information Officer or using the unsubscribe option provided.

Complaints and Changes

If you believe your rights have been infringed and our response is unsatisfactory, you may lodge a complaint with the Information Regulator (contact details in Clause 15). We may update this Policy from time to time; material changes — including any change to Clause 5 (Cookies) or Clause 18 (Direct Marketing) that would introduce new tracking or marketing — will be communicated at least fourteen (14) days before taking effect, via email or in-App notification. Continued use of the App after that date constitutes acceptance of the revised Policy.