Privacy Policy

1 Information We Collect

We may collect the following categories of personal information:

• Identity information: full name, date of birth, and identification details
• Contact information: phone number, email address, and physical address
• Learner information: age, grade, academic level, learning needs, and progress records
• Payment and billing information — processed securely via third-party payment gateways; TRSH does not store raw card details
• Information submitted through forms, surveys, assessments, or communications with us
• Website interaction data collected via cookies or analytics tools (see Section 6)

We collect only the minimum information necessary for the specific purpose it is collected for (the principle of data minimisation). Anonymised or aggregated data that cannot be linked to any individual may be retained for service improvement and analytics.

2 Purpose of Collection

We collect and process your personal information only for specific, explicitly defined, and lawful purposes, including:

• Providing, monitoring, and improving our tutoring services
• Conducting assessments and tracking learner progress
• Communicating updates, scheduling information, and account management
• Processing payments and verifying identity
• Fulfilling contractual, legal, or regulatory obligations
• Sending service-related marketing communications — you may opt out at any time by contacting us (see Section 12)

We will not use your personal information for any purpose incompatible with those listed above without obtaining your prior consent. Internal analytics using anonymised data do not require additional consent.

3 Data Sharing & Third-Party Operators

TRSH does not sell your personal information. We may share your information only in the following circumstances:

• With trusted service providers ("operators" under POPIA) such as payment gateways and IT tools, who are contractually bound to process data only on our instructions and to maintain appropriate security standards
• With regulatory or legal bodies when required by law, a court order, or other legal obligation
• With successors in the event of a sale, merger, or business restructuring — in which case you will be notified in advance

Where we share your data with third-party operators, we remain accountable for ensuring those operators provide adequate protection. We require written data processing agreements with all operators who handle your personal information on our behalf.

4 Data Protection & Breach Notification

TRSH implements reasonable and industry-standard technical and organisational measures to protect your personal information against unauthorised access, loss, disclosure, destruction, or unlawful processing. These measures include:

• Restricted access to personal data on a need-to-know basis
• Use of reputable, secure platforms for data storage and communication
• Regular review of data handling practices

While no system can be guaranteed absolutely secure, TRSH will take all reasonably practicable steps to prevent and detect security compromises.

Breach Notification

In accordance with Section 22 of POPIA, where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person, TRSH will notify:

• The Information Regulator as soon as reasonably possible after becoming aware of the security compromise; and
• You (or, in the case of a learner, the parent or guardian) as soon as reasonably possible in writing, including details of the compromise, the information affected, and the steps being taken to address it,

taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of our information systems. We may only delay notification to the data subject if a public body responsible for the prevention, detection or investigation of offences, or the Regulator, determines that such notification will impede a criminal investigation.

5 Your Rights & How to Exercise Them

Under POPIA, you have the following rights regarding your personal information:

• Right of access: to request confirmation of whether we hold your information and to obtain a copy
• Right to correction or deletion: to request that inaccurate, irrelevant, or outdated information be corrected or deleted
• Right to object: to object to the processing of your personal information on reasonable grounds
• Right to withdraw consent: to withdraw consent at any time, subject to legal or contractual limitations (note: withdrawal may result in termination of services)
• Right to complain: to lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please submit a written request to our Information Officer (see Section 12). Requests may be subject to identity verification. We will respond within a reasonable period and in accordance with POPIA.

If you wish to lodge a complaint with the Information Regulator:

• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email: [email protected]
• Website: www.justice.gov.za/inforeg

6 Cookies and Tracking

Our website uses cookies for functionality, analytics, and marketing purposes. Cookies are small text files stored on your device to help us improve your browsing experience.

By continuing to use our website after being presented with our cookie notice, you consent to our use of cookies. You may withdraw this consent and manage or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

We do not use cookies to collect sensitive personal information. Analytics data collected via cookies is processed in anonymised or aggregated form wherever possible.

7 Data Retention

We retain your personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. Specifically:

• Active learner and account data is retained for the duration of the tutoring relationship
• Payment and billing records are retained for a minimum of 5 years in accordance with applicable South African tax and financial record-keeping obligations
• Correspondence and communications are retained for 3 years from the date of the last interaction
• Data required to defend legal claims is retained for the duration of any relevant legal proceedings

Once data is no longer needed, it is securely deleted or irreversibly de-identified. We do not retain identifiable personal information indefinitely. Anonymised or aggregated data that cannot be linked to any individual may be retained for longer periods for business analytics and service improvement.

8 Protection of Learner (Minor) Personal Information

TRSH recognises that the personal information of learners (persons under the age of 18) requires heightened protection under POPIA. We process such information only with the prior consent of a competent person and in accordance with all applicable legal requirements.

8.1 Consent Requirement

TRSH does not process the personal information of a child without the prior, written consent of a competent person — meaning a parent, legal guardian, or any person legally authorised to act on behalf of the child under South African law.

8.2 What We Collect and Why

For the sole purpose of delivering effective tutoring services, we may collect:

• Full name and age/grade level
• Contact details (provided by the parent or guardian only)
• Academic records, assessments, and progress notes
• Special educational needs, where voluntarily disclosed by the parent or guardian

This information will not be used for any purpose other than delivering tutoring services and communicating with the responsible adult.

8.3 Confirmation of Authority to Submit

By enrolling a learner and submitting their personal information to TRSH, the person completing enrolment expressly confirms that they are:

• The biological parent, legal guardian, or a competent person legally authorised to act on behalf of the child; AND
• Authorised to grant consent for the collection, storage, and use of the child's personal information as described in this policy

TRSH reserves the right to request documentary proof of this authority at any time. Where such proof cannot be provided, TRSH will immediately cease processing the child's personal information.

8.4 Withdrawal of Consent

A competent person may withdraw consent for the processing of a child's personal information at any time by submitting a written request to our Information Officer (see Section 12). Upon receipt, TRSH will cease processing and securely delete or de-identify the relevant information within a reasonable period, unless retention is required by law.

8.5 Security of Learner Data

Learner information is never shared with unauthorised third parties, disclosed in open communications platforms, or stored in unprotected formats. TRSH will notify the parent or guardian of any security compromise affecting a child’s personal information as required by Section 22 of POPIA.

9 Third-Party Links

Our website may contain links to external platforms or services. TRSH is not responsible for the content, privacy practices, or data security of third-party websites. We recommend reviewing the privacy policy of any third-party site before submitting personal information.

10 Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Where changes are material — particularly changes that affect how we process your personal information or your rights — we will notify you by email or via a prominent notice on our website at least 14 days before the changes take effect.

Continued use of our services after notification constitutes acceptance of the updated policy. We encourage you to review this page periodically. The effective date at the top of this document reflects the date of the most recent update.

11 Limitation of Liability

To the fullest extent permitted by South African law:

• TRSH shall not be liable for any indirect, incidental, or consequential damages arising from the use of our services or website
• TRSH shall not be liable for data breaches or losses that occur despite reasonable and appropriate security measures being in place

Nothing in this policy limits any rights you have under POPIA or any other applicable legislation. Any limitation of liability applies only to the extent permitted by law and does not override your statutory rights.