Privacy policy

 

1. Policy purpose

This Privacy Policy outlines how Thuma Mina Teaching (“TMT”, “we”, “our”, “us”) collects, uses, stores, and protects personal information.

As a South African non-profit EdTech organisation (Registration No. K2020/187250/08), Thuma Mina Teaching is committed to improving access to quality education while upholding the highest standards of privacy and data protection.

The purpose of this policy is to:

• Promote transparency in how we manage and protect personal information in line with the Protection of Personal Information Act (POPIA).
• Inform users, educators, donors, and partners of their rights and choices regarding personal data.
• Demonstrate TMT’s ongoing commitment to ethical, responsible, and secure data management across all programmes and platforms.

2. Who we are

Thuma Mina Teaching develops and distributes free, CAPS-aligned video lessons and teacher-training resources. Our registered office is in the Western Cape, South Africa, and our website is www.tmteaching.co.za.

Our Information Officer is Leopold van Velden (CEO). All privacy-related requests and enquiries may be directed to him at connect@tmteaching.co.za.

3. Information we collect

We collect personal information only when it is necessary to operate our programmes and platforms. We collect information from the following groups of people:

Teachers and school staff:
When a teacher registers on LearnLab, we collect: first name, surname, email address, school name, province, and a teacher declaration confirming their role and consent to our processing their information in accordance with POPIA.

Parents and guardians:
When a parent or guardian registers on LearnLab on behalf of their child, we collect: the parent’s first name, surname, email address, and cell phone number; and the child’s first name, school, and grade. A parental consent declaration is completed at registration.

Learners (minors aged 12–15):
TMT collects limited learner information only after parental or school consent has been confirmed. This includes the learner’s first name, surname, school, and grade. Learners never self-register on LearnLab. Learner accounts are created either by a parent registering directly on LearnLab on the child’s behalf and completing the parental consent declaration, or by a TMT administrator via bulk upload — but only after TMT holds confirmed parental consent for each learner, either through parent direct registration or signed parental consent forms provided by the teacher to TMT before any account is created.

Newsletter subscribers:
Teachers may opt in to receive TMT’s newsletter via our website. We collect email address only. Newsletter subscription is for teachers and adults only.

Website visitors:
We collect usage data including pages visited, device type, browser type, approximate location, and IP address. Essential cookies required for website functionality are placed automatically. Analytics data is collected via Google Analytics (GA4) only after you have actively consented to analytics cookies via our cookie consent banner.

Donors and partners:
When you make a donation or enter into a partnership with TMT, we collect your name, email address, and transaction or correspondence reference as required for financial record-keeping and communication.

4. How we collect information

We collect personal information in the following ways:

• Teacher and parent self-registration on LearnLab (learn.tmteaching.co.za).
• Administrator-created learner accounts via CSV bulk upload, following execution of a written Data-Sharing Agreement with the learner’s school.
• Newsletter opt-in form on the TMT website (teachers only).
• Direct email or written correspondence.

5. How we use your information

We use personal information to:

• Respond to enquiries or requests for collaboration.
• Manage participation in training programmes, surveys and events.
• Send relevant updates or newsletters (only if you opt in).
• Improve our content, website and learning tools through aggregated analytics.
• Comply with legal or regulatory obligations applicable to a registered NPC and PBO.
• To provide registered teachers and learners with access to CAPS-aligned learning content on LearnLab.
• To verify teacher and parent registrations before activating accounts on LearnLab.
• To administer school-based learner enrolment under written Data-Sharing Agreements with participating schools.

Teachers: processing necessary for the performance of the registration agreement (section 11(1)(b)).

Parents and guardians: processing necessary for the performance of the registration agreement (section 11(1)(b)).

Learners via parent registration: processing with the prior consent of a competent person — parent or guardian (section 35(1)(a)).

Learners via school enrolment: processing with the prior consent of a competent person — parent or guardian — confirmed through either parent direct registration on LearnLab or signed parental consent forms provided to TMT before any account is created (section 35(1)(a)).

Newsletter subscribers: consent given at opt-in (section 11(1)(a)).

Donors: processing necessary for compliance with a legal obligation for financial record-keeping (section 11(1)(c)).

Account verification data during the review period: processing necessary for the performance of the registration agreement or legitimate interests of TMT in verifying user identity before granting access to a children’s platform (section 11(1)(b) or section 11(1)(f)).

• Providing personal information to register on LearnLab or subscribe to our newsletter is voluntary. However, without the required information TMT cannot create an account or provide access to the platform or newsletter.
• TMT never sells or rents your personal information.

6. Sharing your information

We share limited personal information only with trusted service providers and partners who help us operate our platforms and programmes. All service providers are required to process personal information only on TMT’s instruction and to maintain appropriate security measures.

Our current service providers are:

AWS (Amazon Web Services), af-south-1, Cape Town, South Africa:

LearnLab Moodle platform hosting. All learner and teacher data stored on LearnLab is held on AWS servers located in South Africa.

YouTube:

Video content hosting. TMT does not share personal data with YouTube directly. Viewing data is subject to Google’s own privacy policy.

Google Analytics (GA4):

Website analytics. Google Analytics processes website usage data (pages visited, device type, browser type, approximate location) to help TMT understand how the website is used. Analytics cookies are placed only after active visitor consent via the cookie consent banner.

Google:
Google OAuth as an optional login method for LearnLab.

Meta (Facebook and Instagram pages):
TMT operates a Facebook page and an Instagram account. When you interact with TMT’s content on these platforms, Meta processes your personal information in accordance with Meta’s own privacy policy. TMT does not directly transfer your personal information to Meta through these channels, but Meta receives data as a result of your interaction with TMT’s pages. Please refer to Meta’s Privacy Policy at www.facebook.com/privacy/policy for full details.

Meta (Facebook OAuth — LearnLab login):
TMT offers Facebook OAuth as an optional login method for LearnLab. If you choose to log in using your Facebook account, Meta will share limited profile information with TMT to create or access your account. This involves a transfer of personal information to Meta’s servers, which are located outside South Africa. This transfer is governed by Meta’s Global Data Transfer Addendum, which provides appropriate data protection safeguards. You are not required to use Facebook OAuth — email registration is available as an alternative.

TikTok:
TMT maintains a TikTok account for educational content distribution. TikTok is operated by TikTok Pte. Ltd., with servers located in Singapore, Malaysia, Ireland, and the United States. When you interact with TMT’s TikTok content, TikTok processes your personal information in accordance with TikTok’s own privacy policy, which governs offshore data transfers. TMT does not directly transfer your personal information to TikTok. Please refer to TikTok’s Privacy Policy at www.tiktok.com/legal/privacy-policy for full details.

Brevo:
Email newsletter distribution to opted-in teachers only.

WP Rocket

Website performance and caching. WP Rocket processes website visitor data as part of performance optimisation on the TMT website.

Afrihost and WordPress:
TMT’s public website (www.tmteaching.co.za) is hosted on Afrihost using WordPress.

PayFast:
Online donation processing. PayFast complies with international Payment Card Industry Data Security Standards (PCI DSS). TMT receives only confirmation of your donation and does not store card details.

School Data-Sharing Agreements:
Where a school enrols learners on LearnLab, the process requires two instruments. First, the teacher and school sign a written Data-Sharing Agreement with TMT. Second, TMT requires confirmed parental consent for each individual learner before any account is created.

This is satisfied through one of two methods:

The preferred method is for the teacher to direct each parent to register directly on LearnLab, where the parent completes the parental consent declaration themselves. TMT holds the consent record directly.

Where direct parent registration is not practicable, the teacher obtains a signed parental consent form from each parent specifically authorising TMT to process their child’s data on LearnLab. The teacher provides these signed forms to TMT before any learner account is created. TMT holds copies as documentary proof of consent.

No learner account is created until TMT holds confirmed evidence of parental consent through one of these two methods. The school’s general enrolment consent is not treated as sufficient proof of parental consent for LearnLab processing.

Parents of learners enrolled through a school should direct rights requests — including access, correction, and deletion — to their school in the first instance, as the school is a party to the Data-Sharing Agreement governing that enrolment. TMT will cooperate fully with schools in fulfilling such requests.

While TMT’s primary data storage is in South Africa, certain third-party processors used by TMT operate servers outside South Africa. TMT relies on section 72(1)(b) of POPIA for these transfers, as the relevant processors are subject to data protection laws that provide a level of protection substantially equivalent to POPIA.

The following cross-border transfers occur:

Brevo (newsletter processor) — servers located in the European Union. Transfer ground: section 72(1)(b) — Brevo is subject to the EU General Data Protection Regulation (GDPR).

Meta (Facebook OAuth login on LearnLab) — servers located in the United States and European Union. Transfer ground: Meta’s Global Data Transfer Addendum.

Google (Google OAuth login on LearnLab) — servers located outside South Africa. Transfer ground: section 72(1)(b) — Google is subject to equivalent international data protection frameworks.

Google Analytics (website analytics) — website usage data is processed on Google servers located outside South Africa. Transfer ground: section 72(1)(b) — Google is subject to equivalent international data protection frameworks. Analytics data is only collected after active visitor consent.

WhatsApp (used for communication with adult stakeholders including teachers) — operated by Meta on infrastructure located outside South Africa. Transfer ground: section 72(1)(b) — Meta is subject to the EU GDPR and equivalent frameworks.

TrustBridge (international donor giving channel) — this arrangement is currently under legal review. The Privacy Policy will be updated once the TrustBridge agreement has been assessed to confirm what personal information, if any, transfers across borders and on what ground. Users are directed to the respective privacy policies of each third-party processor for full details of their data transfer arrangements.

If required by law or regulatory authority, we may share information with the relevant authority.

7. Data storage and security

Your personal information is stored on secure, password-protected systems. Access is restricted to authorised TMT staff and contractors who need the information to perform their work. We use SSL encryption and reputable service providers to protect our systems.

LearnLab data is hosted on AWS servers located in Cape Town, South Africa (af-south-1 region). Access to learner data is restricted to authorised TMT administrators only. LearnLab accounts become active immediately upon registration. When a new account is created, TMT receives an email notification and a staff member reviews the registration within one week to confirm it is valid. Where the review identifies a concern—for example, where the account appears to have been created using inaccurate information or by a learner without appropriate parental involvement—TMT may suspend the account, contact the account holder for clarification, and, if the registration remains unverified 30 days after the concern is identified, delete the registration data.

8. Your rights under POPIA

Under POPIA, you have the following rights:

• The right to be notified that TMT holds your personal information.
• The right to access the personal information TMT holds about you.
• The right to request correction or deletion of inaccurate, incomplete, or outdated information.
• The right to object to the processing of your personal information.
• The right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
• The right to lodge a complaint with the Information Regulator at www.inforegulator.org.za.
• Parents and guardians may withdraw consent for their child’s personal information at any time by contacting us at connect@tmteaching.co.za. On withdrawal, the child’s LearnLab account will be deactivated and their personal information deleted within 30 days.
• Learners aged 12 and older have the right to withhold or withdraw their own assent independently of parental consent. If a learner aged 12 or older objects to the processing of their personal information, TMT will not continue processing that learner’s data regardless of parental consent.
• Parents of school-enrolled learners should direct rights requests to their school in the first instance, as the school is the Responsible Party for data collected through the school enrolment channel. TMT will cooperate fully with schools in fulfilling such requests.
• If you registered on LearnLab using Facebook OAuth or Google OAuth and wish to access or delete data held by Meta or Google in connection with that login, please contact those providers directly via their respective privacy policies.

TMT will respond to all rights requests within 30 days of receipt. All requests may be submitted to connect@tmteaching.co.za.

9. Cookies and tracking

TMT’s website uses two categories of cookies:

Essential cookies are required for the website to function correctly and are placed automatically. These cannot be disabled.

Analytics cookies are used by Google Analytics (GA4) to help TMT understand how visitors use the website. These cookies are only placed after you have actively consented via our cookie consent banner when you first visit the website.

Our cookie consent banner allows you to accept or decline analytics cookies. You can change or withdraw your cookie choices at any time via the cookie settings link in the website footer.

Declining analytics cookies does not affect your ability to use the website.

10. Data retention

We keep personal information only for as long as necessary for the purpose for which it was collected. Our specific retention periods are:

Teacher LearnLab accounts: duration of active use, plus 12 months after last login, then deleted.

Learner LearnLab accounts: duration of active school enrolment, deleted within 30 days of enrolment ending or on written request.

Parent registration data: linked to the learner account and deleted at the same time.

Signed parental consent forms (school enrolment channel): retained for the duration of the learner’s LearnLab account plus 12 months after the account is closed, then securely destroyed in a manner that prevents reconstruction.

Newsletter subscriber data: until unsubscribe, then deleted within 30 days.

Donor and financial records: 5 years in line with financial record-keeping obligations.

General correspondence: 3 years.

11. Children’s personal information

TMT operates LearnLab, a learning platform used by learners aged 12–15. We take our obligations regarding children’s personal information seriously under section 35 of POPIA and the Children’s Act 38 of 2005.

TMT processes a child’s personal information only in the following circumstances:

• A parent or legal guardian has registered on LearnLab and provided explicit consent on the child’s behalf; or
• The child’s school has enrolled the child under a written Data-Sharing Agreement, and TMT holds confirmed parental consent for that child through either parent direct registration on LearnLab or a signed parental consent form provided by the teacher to TMT before the account was created.
• Learners never self-register on LearnLab under any circumstances.
• For learners aged 12 and older, the learner must also give their own assent at first login before accessing any content. This is consistent with the Children’s Act 38 of 2005 and TMT’s commitment to the best interests of the child. If a learner aged 12 or older withholds or withdraws assent, TMT will not process that learner’s personal information regardless of parental consent.
• Where learners access LearnLab through their school, TMT requires confirmed parental consent for each learner before any account is created. The school’s general enrolment consent is not treated as sufficient. TMT holds the consent record either directly through parent registration on LearnLab or through signed parental consent forms provided by the teacher.

Parents may withdraw consent at any time by contacting connect@tmteaching.co.za. The child’s account will be deactivated and their personal information deleted within 30 days of withdrawal.

12. Data breach notification

In the event of a security compromise involving personal information held by TMT, we will:

• Immediately contain and secure the affected systems.
• Assess the nature and scope of the compromise.
• Notify the Information Regulator as soon as reasonably possible after discovery, via the Regulator’s eServices Portal at eservices.inforegulator.org.za, in compliance with section 22 of POPIA.
• Notify affected data subjects — including parents of affected learners — as soon as reasonably possible where there is a risk of harm.
• To report a suspected data breach involving TMT, contact us at connect@tmteaching.co.za.

13. Online payments

If you make an online donation:

We process donations through secure, third-party payment gateways such as PayFast. These platforms comply with international Payment Card Industry Data Security Standards (PCI DSS) and ensure that your card details are encrypted and never stored or accessible to Thuma Mina Teaching NPC.

We receive only confirmation of your donation — such as the amount, date, and contact details you choose to share — but we never collect or store your credit or debit card number, CVV, or banking PIN on our systems.

14. Donor information

When you make a donation, we may collect your name, email address, and transaction reference to issue a receipt or Section 18A certificate.

This information is used only for record-keeping, financial auditing, and donor communication (if you have opted in to hear from us).

You may request to remain anonymous, and we will fully respect that preference.

15. Financial data protection

All online transactions are processed using SSL encryption and secure servers. We regularly review our systems and service providers to maintain compliance with applicable data-protection and financial-security standards.

16. Updates to this policy

We may update this Privacy Policy periodically.

The latest version will always be available on our website with an updated effective date.

17. Plan with TMT (Canva App)

Plan with TMT is a Canva sidebar app developed and published by Thuma Mina Teaching NPC (TMT), a South African educational non-profit. The app currently guides Grade 7 and Grade 8 Economic and Management Sciences (EMS) teachers through curriculum-aligned lesson paths, each combining video, slides, a workbook, and a quiz, aligned to the Western Cape Annual Teaching Plan (ATP). Content is fully bilingual, available in both English and Afrikaans. Content is released progressively as it is completed.

Currently available: complete lesson content for Grade 7 (both EMS focus areas) and Grade 8 Financial Literacy. Grade 8 Economics & Entrepreneurship and Grade 9 Financial Literacy and Economics & Entrepreneurship are in active development and will be added as they are finished; their absence does not indicate a fault in the app.

The app does not currently collect, store, or process any personal information from users. It presents read-only educational content and links, and adds pages directly to the teacher’s own Canva design using Canva’s standard design-editing tools. No teacher account details, email address, or authorisation data are collected, stored, or transmitted to TMT through this app.

Should a future version of the app introduce a data collection feature (for example, connecting a teacher’s Canva account name and email address, or saving usage preferences), this Privacy Policy will be updated in advance of that feature’s release to describe what is collected, why, and the lawful basis for processing, and users will be notified through the app listing before the change takes effect.

18. Contact us

For any questions or requests relating to this Privacy Policy or your personal data, please contact our Information Officer:

Information Officer: Leopold van Velden

Email: connect@tmteaching.co.za

Address: Thuma Mina Teaching NPC, 23, Wellington, Western Cape, South Africa

To lodge a complaint with the Information Regulator: www.inforegulator.org.za

To submit a breach notification: eservices.inforegulator.org.za