← Back to MarkTrack

Operator Agreement

Version ยท Supplier: (registration no. )

Draft. This document is a starting point and must be checked by a South African attorney before schools rely on it.

This agreement is between the school that registers on MarkTrack (the "school", the responsible party) and (the "operator"), as required by sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 (POPIA). It is accepted by the staff member who registers the school, who confirms that the principal has authorised them to do so.

1. What is processed and why

Learners' names, surnames, classes and marks, and notes staff add about learners at risk, uploaded by the school's staff, processed only to calculate results, show them to authorised staff and produce reports and downloads for the school.

2. Operator's duties

  1. Process the information only with the school's knowledge and authorisation and for the purpose above, and never for its own purposes (s20).
  2. Treat it as confidential and allow only people who need it to provide the service to access it (s20(b)).
  3. Maintain appropriate, reasonable technical and organisational security measures (s19 and s21), including access control per school and per role, encryption, and storage of the marks database in South Africa.
  4. Notify the school immediately where there are reasonable grounds to believe the information has been accessed or acquired by an unauthorised person (s21(2)), and help the school with its own notifications under s22.
  5. Use Google (Firebase) as a sub-operator for hosting, on terms that protect the information at least as well as this agreement; tell the school before adding other sub-operators.
  6. Help the school respond to requests from learners, parents or the Information Regulator.
  7. At the end of the agreement, delete the school's learner information within 90 days, after giving the school the chance to download it.

3. School's duties

  1. Make sure it is lawful for the school to process the information and to use an operator, and that learners and parents are informed as the school's policies require.
  2. Upload only the information needed, keep staff accounts current (remove staff who leave) and keep downloaded files secure.
  3. Tell the operator promptly about any suspected unauthorised access through a staff account.

4. Term

This agreement applies from registration for as long as the school uses the service, and clause 2.7 continues after it ends.

Contact

, . Email , phone . Information Officer: .