Privacy & processing notice

To enrol and care for your child and run the school’s fees, we collect: the child’s details and class; guardians’ contact details (to send statements and gentle reminders); and, with your consent, medical details to keep your child safe. We collect only what we need (§10).

Enrolment, billing and emergency-care information is processed to fulfil the enrolment agreement and meet legal duties (§11(1)(b)/(c)), these are required to keep your child enrolled. Photos & media and storing medical details are processed only with your consent (§11(1)(a)), which you can withdraw at any time by asking the school.

Children’s information (§34) and health information (§26/§27) get extra care: medical details are kept separate, access is limited to authorised school staff, and they are never used to train or feed any AI system. In a medical emergency we may act in your child’s vital interest (§27(1)(d)).

We use trusted operators under data-processing agreements: Supabase (database & storage), Vercel (hosting), Resend (email), and, for optional assistant features. Anthropic, with training on your data disabled. Data is hosted in the EU (Frankfurt); this cross-border processing is disclosed under §72 and protected by those agreements.

We keep enrolment and billing records for as long as your child is enrolled and as the law requires afterwards. Applications that aren’t accepted are redacted within six months, their sensitive details (ID numbers, medical and contact information) are removed, leaving only a minimal record. We minimise what we retain and remove sensitive details once they’re no longer needed.

You may ask to see, correct, or delete your information, object to processing, or withdraw an optional consent, contact your school or our Information Officer. You may also complain to the Information Regulator of South Africa.

Inus de Bruin · via your school or kidnett.com. We’ll respond as POPIA requires.