Privacy Policy

1. Overview

This Privacy Policy explains how the DDD Learner Improvement Interventions Tracker ("the App," "we," "us") collects, uses, stores, and protects personal information when education officials use the App to record learner improvement interventions across South African districts.

The App is provided as part of the Data Driven Districts (DDD) Programme, operated by Victor Huni in partnership with the National Lotteries Commission (NLC)-funded New Leaders Foundation. The App is intended exclusively for use by pre-registered education officials authorised by the DDD Programme.

We are committed to handling personal information lawfully, fairly, and transparently in accordance with the Protection of Personal Information Act, 2013 (POPIA).

2. Who is responsible for your data

The Responsible Party (Data Controller) under POPIA for personal information collected by the App is:

All privacy-related requests, complaints, and questions about this policy should be directed to the contact above. We aim to respond to all requests within 30 calendar days.

3. Personal information we collect

We collect only the personal information necessary for the App to function and to support the DDD Programme's monitoring, evaluation, research, and learning (MERL) purposes:

3.1 Information about you (the official)

3.2 Information about interventions (your submitted records)

When you record an intervention, the App stores: the school(s) involved, the type of intervention or support activity, the data sources you consulted, what the data showed, the action taken, follow-up plans, and any supporting documents you upload. You should not enter personal information about learners or educators (e.g. names, ID numbers, contact details) into free-text fields. The App is designed to capture programmatic and operational information only.

3.3 Information we do NOT collect

• Learner names, surnames, ID numbers, or other personal identifiers
• Educator personal information beyond what officials choose to mention in operational context
• Health, biometric, religious, political, or other special-category personal information
• Continuous background location (only captured at the single moment you tap Submit)
• Microphone audio (voice transcription happens in real time; audio is not stored)
• Camera images outside of files you intentionally choose to upload

4. How we use your personal information

We process your personal information for the following purposes:

1. To operate the App — authenticate you, save your submissions, send audit copies by email
2. To support programme management — produce aggregate reports, identify trends, evaluate intervention effectiveness
3. To enable accountability — keep an audit trail of who logged what intervention, where and when
4. To improve the App — diagnose technical issues and develop new features based on observed usage patterns
5. To comply with legal obligations — respond to lawful requests from regulators or authorities where required

We do not use your information for marketing, advertising, profiling, or automated decision-making that has legal effects on you.

5. Lawful basis for processing

Under POPIA, we process your personal information based on:

• Consent — you explicitly agree to the App's terms when signing in for the first time
• Performance of a function in the public interest — the DDD Programme supports education improvement, a recognised public interest activity
• Legitimate interests — operating, securing, and improving the App for authorised users

6. How long we keep your information

We retain personal information for a maximum of twelve (12) months from the date of last activity, after which it is permanently deleted, except where:

• Aggregate or anonymised reports have been produced for programme purposes (these may be retained without personal identifiers)
• We are required by law to retain it for longer
• You have an active account, in which case retention continues for the duration of your participation in the Programme plus the 12-month period above

You can request earlier deletion at any time (see Section 9).

7. Who has access to your information

Access to your personal information is strictly limited to:

• You — full access to your own records and dashboard
• The Responsible Party (Victor Huni, DDD Interventions Manager) — for programme management
• Tagged colleagues — when you explicitly tag another official in a support need or comment, that official receives a notification with the relevant context
• Authorised programme staff at the New Leaders Foundation — for monitoring, evaluation, and reporting purposes

We do not sell, rent, or trade your personal information to third parties.

8. Service providers (Operators under POPIA)

The App relies on the following third-party service providers, each bound by their own POPIA-equivalent privacy obligations:

Each provider acts only on our instructions and within their published privacy commitments. Some of these providers store data outside South Africa. By using the App, you acknowledge and consent to this cross-border transfer in accordance with Section 72 of POPIA.

9. Your rights under POPIA

You have the following rights regarding your personal information:

• Right of access — to know what personal information we hold about you
• Right to correction — to have inaccurate information corrected
• Right to deletion — to request that we delete your personal information (subject to legal retention requirements)
• Right to object — to object to processing on grounds relating to your particular situation
• Right to withdraw consent — at any time, without affecting the lawfulness of past processing
• Right to lodge a complaint — with the Information Regulator (see Section 12)

To exercise any of these rights, contact us at victor@newleaders.co.za. We will respond within 30 calendar days.

10. Security

We take reasonable and appropriate technical and organisational measures to protect your personal information:

• All connections between the App and our servers are encrypted using HTTPS/TLS
• Authentication uses industry-standard token-based session management
• PINs are hashed and never stored or transmitted in plain text
• Access to the underlying database is restricted to authorised personnel using multi-factor authentication
• The App captures location only when you submit a record, and only with your explicit Android permission
• Backup copies of programme data are encrypted at rest

If we become aware of a security incident affecting your personal information, we will notify you and the Information Regulator without undue delay, as required by Section 22 of POPIA.

11. Children's data

The App is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. The App is designed for use by adult education officials only.

12. Information Regulator

You have the right to lodge a complaint with South Africa's Information Regulator:

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App's update notification system and update the "Last updated" date above. Continued use of the App after a change indicates acceptance of the updated policy.

14. Contact us

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal information: