Privacy Policy
This policy explains how handles personal information in MarkTrack, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Two kinds of information
- Staff accounts (name, email address, teacher code, role, sign-in records). We are the responsible party for this information and use it to run accounts, keep the service secure and contact schools about their subscription.
- Learners' marks (learner name, surname, class, marks per task and term, and notes staff add about learners at risk). The school is the responsible party; we process this only as the school's operator, under the Operator Agreement and only to provide the service. Learners are children, so this information is handled with extra care.
2. What we do not collect
We do not store learner ID or CEMIS numbers, contact details or the uploaded files themselves. We do not sell information, use it for advertising, or use learners' information for any purpose of our own.
3. Where it is stored and who can see it
- Marks and reports are stored in Google Cloud Firestore in the Johannesburg region (africa-south1). Sign-in (Firebase Authentication, a Google service) may store staff email addresses and sign-in records outside South Africa; Google is bound by data-protection terms that offer protection comparable to POPIA (section 72).
- Teachers see only their own marksheets; school admins see their school's information. As the platform operator we can see school names and billing details, not learners' marks; we access school data only if the school asks us to for support, or the law requires it.
4. Security
Access requires a confirmed email address and password; data is encrypted in transit and at rest; database rules on Google's servers keep each school's information separate; sessions end when the browser closes or after a period without activity.
5. How long we keep it
We keep a school's information while it uses the service. When it asks, or 90 days after its access ends, we delete its learners' information. Billing records are kept for as long as tax law requires (generally five years).
6. Your rights
Staff may ask to see, correct or delete their account information. Parents and learners should direct requests about marks to the school, which controls that information; we will help the school respond. You may complain to the Information Regulator (inforegulator.org.za).
7. Breaches
If we believe personal information has been accessed without authority, we will tell the affected school immediately so that it can notify the Information Regulator and the people affected (POPIA section 22), and we will notify the Regulator about staff account information ourselves.
Contact
, . Email , phone . Information Officer: .