Privacy & POPIA Policy

Out of the Blocks (Pty) Ltd ("Out of the Blocks", "we", "us") is committed to handling personal information responsibly and in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

This policy applies to our website, enquiries, individual programme purchases, school and organisational relationships, our mailing list, learning-platform accounts, customer support and related services.

1.1 When we are the responsible party

We are the responsible party — meaning we decide why and how information is processed — for:

• enquiries made to us through any channel;
• individual purchases made through our online checkout;
• accounts held by adult users (educators, parents, caregivers, homeschool families, school staff);
• our mailing list and marketing communications;
• website analytics and technical information;
• our own business, accounting and support records.

1.2 Schools and organisations

We sell programme access to schools and organisations for use by authorised adult staff members. We collect and process information about the organisation, its purchasing contact and its authorised adult users. Our services do not create learner accounts or child profiles, and schools and organisations do not need to provide us with personal information about learners in order to purchase or use a programme.

Depending on how you interact with us, we may collect:

• your name, surname, email address and telephone number;
• your school or organisation and your role, where relevant and where you provide those details;
• billing, transaction and payment-status information;
• account and programme enrolment information;
• the programme and language option you select;
• information contained in enquiries or support requests;
• mailing-list preferences and communication history;
• records of consents, acknowledgements and acceptances captured at checkout;
• technical information such as browser type, device information, IP address and website activity collected through our systems or analytics tools.

We collect only information reasonably necessary for the purpose for which it is used.

We use personal information to:

• respond to enquiries and communicate with you;
• process purchases and confirm transactions;
• create and manage programme access and learning-platform accounts;
• administer school licences, seats and user access;
• provide customer and technical support;
• send service-related emails and account communications;
• send a fixed-term expiry notice where the Consumer Protection Act requires one;
• send marketing communications where section 69 of POPIA permits us to do so;
• improve our website, programmes and customer experience;
• prevent misuse, fraud and security incidents;
• meet legal, regulatory, accounting and record-keeping obligations.

We process personal information only where POPIA permits it — because processing is necessary to conclude or perform an agreement with you, because we are complying with a legal obligation, because we or a third party have a legitimate interest that does not override your rights, or because you have given consent where consent is required.

Our online checkout is provided through CheckoutJoy, and online payments are processed by PayFast. CheckoutJoy sends the transaction, price and customer details needed to initiate the payment to PayFast and directs the customer to PayFast's checkout environment to complete it.

We may receive transaction information such as the purchaser's name, email address, amount paid, selected programme, payment status and transaction reference.

Full payment-card details are entered into and handled in PayFast's secure payment environment and are not stored on an Out of the Blocks system. PayFast states that it is PCI DSS Level 1 compliant and supports 3D Secure for card payments.

A successful purchase may result in your name, email address and programme selection being shared with the learning platform in order to create or update your account and give you access to the programme you purchased.

Section 69 of POPIA restricts unsolicited electronic direct marketing. We apply it as follows.

If you are an existing customer, we may send you marketing about our own similar programmes and services using contact details you gave us during the sale. We offer you a free opt-out at the point we collect your details and in every message we send.

If you are not a customer, we will only send you electronic marketing if you have given us consent. Where we ask for that consent we do so once only, in the prescribed manner, and we will not ask again if you decline or do not respond.

Signing up to our mailing list is a deliberate, separate action. We do not pre-tick consent boxes and we do not bundle marketing consent into the checkout or an enquiry form.

You can withdraw consent or unsubscribe at any time using the link in any message or by emailing us. Service communications necessary to administer an account, purchase, enquiry or school relationship are not marketing and cannot be unsubscribed from while the relationship is active.

Our website, checkout and programmes are intended for adults, including parents, caregivers, educators, school staff and organisational customers. We sell programme access only to adults and organisations. The adults use the programme material to teach or support children.

We do not create accounts or profiles for children and do not ask customers to provide children's names, dates of birth, contact details, images, videos, class lists, assessment results or other information that identifies a child. Programme activities, observations and assessment tools are used by adults in their own settings; Out of the Blocks does not receive or store child-level observations, results or outputs and, through the ordinary use of its services, cannot identify the children with whom customers use the material.

Customers must not include personal information about a child in an enquiry, support request, account field or other communication with us. If we receive identifiable child information inadvertently, we will limit its use, restrict access to it and delete or de-identify it as soon as reasonably practicable, subject to any legal obligation requiring retention.

Our website may use cookies and similar technologies that are necessary for security, login, session management, checkout and other core functionality.

If we use non-essential preference, analytics or marketing technologies, we identify them in the applicable cookie notice and obtain consent where the law requires it. Where a cookie-settings tool is available, you can use it to change or withdraw your choice.

You can also control cookies through your browser. Disabling certain technologies may affect website functionality.

We do not sell personal information.

We share information with service providers who help us operate Out of the Blocks, in the following categories:

• website hosting and content management;
• our online learning platform, for account creation and enrolment;
• databases and enquiry storage;
• email delivery and mailing-list management;
• checkout and payment processing;
• analytics, security and technical support;
• professional, accounting and legal advisers.

Where a service provider processes personal information as our operator, we require a written agreement that addresses the requirements of POPIA, including confidentiality, appropriate security safeguards and notification of suspected unauthorised access.

You may request a list of the specific providers we currently use by emailing our privacy and access-to-information contact.

We may also disclose information where required by law, regulation, legal process or a competent authority, or where reasonably necessary to establish, exercise or defend a legal claim or to protect our rights, systems or users.

Some technology providers may process or store information outside South Africa. Provider locations depend on the services actually in use and may change over time. You may request information about the current provider categories and relevant processing locations from our privacy and access-to-information contact.

Where we transfer personal information outside South Africa, we rely on section 72 of POPIA and do so only where at least one of the following applies:

• the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA and includes provisions for onward transfers;
• the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in response to your request;
• the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party; or
• you have consented to the transfer.

Where required, we put appropriate contractual safeguards in place and assess the applicable ground in section 72 before personal information is transferred outside South Africa.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, accounting, dispute-resolution and evidential requirements.

• Enquiry and support records are kept for as long as needed to respond, manage reasonable follow-up and deal with any related dispute or legal claim.
• Account and programme-access records are kept for the access period and for a reasonable period afterwards where needed for support, security, accounting or legal claims.
• Company accounting records that must be kept under the Companies Act are retained for at least seven years. Tax supporting records are generally retained for at least five years from the relevant return, and longer where a return is outstanding or an audit, investigation, objection or appeal is in progress.
• Mailing-list records are kept until you unsubscribe, after which we may retain a suppression record so that we can respect the opt-out.
• Consent and acceptance logs are kept for as long as reasonably necessary to demonstrate the applicable consent, acknowledgement or transaction and to meet legal or evidential requirements.

Where the law requires a longer period, or where information is needed to establish, exercise or defend a legal claim, we retain it for that period.

When information is no longer required, we take reasonable steps to delete, destroy or de-identify it.

We take reasonable technical and organisational steps to protect personal information against loss, unauthorised access, misuse, alteration and disclosure. We assess appropriate safeguards with regard to generally accepted information-security practices, the risks presented by the processing and the nature of the information concerned.

No online system can be guaranteed to be completely secure.

If a security compromise occurs, section 22 of POPIA requires us to notify the Information Regulator and every affected data subject as soon as reasonably possible after we become aware of it, unless the identity of affected data subjects cannot be established. Our notification will describe what happened, the likely consequences, the measures we have taken or intend to take, and what you can do to protect yourself.

We do not make decisions about you that have legal consequences or substantially affect you based solely on automated processing.

Our learning platform may score quizzes or track programme completion automatically. These are teaching and progress tools; they do not produce a decision about a person's suitability, conduct or entitlements. If this ever changes, we will update this policy and provide the safeguards required by section 71 of POPIA.

Subject to applicable law, you have the right to:

• ask whether we hold personal information about you;
• request access to personal information we hold about you;
• ask us to correct or update inaccurate, irrelevant, excessive, misleading or unlawfully obtained information;
• request deletion or destruction where the law permits;
• object, on reasonable grounds, to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• opt out of direct marketing at any time;
• lodge a complaint with the Information Regulator.

How to exercise a right. Email our privacy and access-to-information contact at the address in clause 15. A request for access to a record is made using PAIA Form 2. An objection to processing is made using POPIA Form 1, and a request to correct or delete personal information is made using POPIA Form 2. A complaint to the Information Regulator is made using POPIA Form 5. The current forms are available on the Information Regulator's website, and we will send them to you on request.

We may need to verify your identity before acting on a request. We respond within the periods set by PAIA and POPIA. A fee may apply to an access request as prescribed by PAIA.

Out of the Blocks does not yet have a manual under section 51 of the Promotion of Access to Information Act 2 of 2000.

Our current privacy and access-to-information contact is:

Ansu Human
Out of the Blocks (Pty) Ltd
ansuhuman@outoftheblocks.co.za
+27 83 389 2153

If you believe your personal information has been processed in a way that does not comply with POPIA, you may complain to:

Complaints must be in writing. The Regulator also operates an eServices portal for lodging complaints online.

We would appreciate the opportunity to resolve your concern first, but you are not required to contact us before approaching the Regulator.

We may update this policy when our services, systems or legal obligations change. The current version is always published on our website with its version number and effective date. Where a change materially affects how we use information you have already given us, we will take reasonable steps to notify you.