Privacy Policy and POPIA Notice

HOW WE COLLECT, USE AND PROTECT PERSONAL INFORMATION

Academic Connect (Pty) Ltd, trading as Septa · Reference SEPTA-02 · Version 1.6

Effective 28 September 2026 · Next review 28 September 2027

About This Notice

This notice explains how Septa collects, uses, shares, and protects personal information, and what rights you have over it. It is our notification to you in terms of section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”), and it also serves as our Privacy Policy.

Septa is used by school learners, by university students, and by tutors who are often students themselves. Many people here are under 18, on both sides of a session. POPIA treats a person under 18 as a child, and sections 34 and 35 of the Act prohibit processing a child’s personal information unless a specific ground applies. This notice sets out the ground we rely on and the safeguards we apply. The sections headed Children’s Personal Information, What a Parent or Guardian Can Do, When a Learner Turns 18 and Schools deal with this directly, and the section headed In Plain Language, for Learners says the same things without the legal vocabulary.

This notice forms part of, and should be read with, our Terms of Use.

If anything here is unclear, write to us. We would rather explain it than have you agree to something you do not understand.

Who We Are and How to Reach Us

Academic Connect (Pty) Ltd, trading as Septa, is the responsible party for the personal information described in this notice. That means we decide why and how it is processed, and we are accountable for it.

Our Information Officer is responsible for compliance with POPIA and for dealing with requests made under the Promotion of Access to Information Act 2 of 2000. How to make a request under that Act is set out in our PAIA Manual at septa.co.za/paia.

Definitions

The following terms are used throughout this notice and carry the same meaning in our Terms of Use.

• “Child” means a person under the age of 18, as defined in the Children’s Act 38 of 2005 and POPIA.
• “Competent person” means a person legally competent to consent to a Child’s personal information being processed, ordinarily a parent or legal guardian.
• “Learner” means a user registered as a school-going or prospective tertiary student.
• “Operator” means a third party that processes personal information on our behalf and on our instructions, as defined in POPIA.
• “Personal information” has the meaning given in POPIA: information relating to an identifiable living person, and to an identifiable existing juristic person.
• “Service” means the Septa website, mobile application, and related services.
• “Tutor” means a user who offers tutoring or academic support through the Service.
• “We”, “us” and “our” mean Academic Connect (Pty) Ltd, trading as Septa.

Who This Notice Covers

This notice applies to learners and students, parents and guardians who consent to a Child's account, and tutors.

It does not apply to what another organisation does with your information after you choose to share it with them. If you apply for a bursary through an opportunity posted on Septa, the bursary provider becomes responsible for the information you send them, under their own privacy notice.

What We Collect

Information you give us directly:

• Account details: name, username, email address, telephone number, school or institution, grade or year, profile photograph. We ask whether you are 18 or older. If you are not, we also ask the month and year you were born, never the full date.
• Password: stored only as a one-way hash. We never see it and cannot recover it.
• Profile content: academic interests, achievements, subjects, extracurricular activities, skills, career interests, and anything else you choose to add.
• Messages: what you send to other users through the Service, and your correspondence with our support team.
• Parent or guardian details, where a Child’s account requires consent: name, contact details, relationship to the learner, and the record of consent itself.
• Payment details, once paid tutoring is available: billing name, and a payment method handled by a payment provider. We never receive or store a full card number.
• Tutor banking details, where a tutor is paid through the Service: bank name and account number, stored encrypted and shown back only in masked form.
• Verification documents, where a tutor supplies proof of qualification or identity.
• A tutor’s parent or guardian email address, where the tutor is under 18, and the record of that permission.
• A record of which tutors a parent or guardian has agreed to, where both the learner and the tutor are under 18.

Information we collect automatically:

• Usage: which features you use, what you interact with, and when.
• Technical: IP address, device identifiers, operating system, browser, log-in times, and crash reports.
• Approximate location, derived from IP address, and only if your device permits it. We do not track precise location.

Information from other people:

• From a parent or guardian, when they consent to a Child’s account.

We do not ask for special personal information, as POPIA defines it, and we do not require it to register. If you choose to put something sensitive in a profile or a message, it is processed as ordinary content of the Service, and we would encourage you not to.

Why We Process It, and on What Basis

Every use of personal information needs a purpose and a lawful basis. The table below sets out ours. Retention periods are set out under How Long We Keep It.

Where we rely on legitimate interest, we have weighed it against your privacy and concluded it does not override your rights. We never rely on legitimate interest to market to a Child, to profile a Child, or to process a Child's information beyond what this notice describes.

Where the Information Is Kept

Our database and application are hosted in the United States, in Amazon Web Services' Northern Virginia region, through Replit's managed PostgreSQL service, which is provided by Neon.

This means personal information described in this notice, including information about children, is stored outside South Africa. Sending Information Outside South Africa explains what that means and what protects it.

We did not select that location; it is the region in which our hosting platform provisions databases. We say so plainly because you are entitled to know where your information is, and to weigh that for yourself.

Children’s Personal Information

This is the part of the notice that matters most, because most of our users are children.

Age. We ask at sign-up whether you are 18 or older, and if you are not, the month and year you were born. We use that month and year for one thing: messaging opens in the month a learner turns 16. We do not verify what we are told, and we do not claim to. Where we are told, or it is reported to us, that an account belongs to someone too young to be using the Service safely, we act on it.

Consent. A learner under 18 gives us a parent or guardian’s email address at sign-up. We write to that address with a link that is signed and expires, explain what the Service does, and record the permission and the date it was given when the link is used. The account exists in the meantime but cannot book a session or send messages until the permission is recorded. We do not independently verify that the address belongs to a parent, and we do not claim to; what we can say is that someone with access to that inbox gave permission.

What the parent is agreeing to. That the learner may hold an account; that the learner will interact with other users, including adults acting as tutors; that the processing described in this notice will take place; and that consent can be withdrawn at any time.

Withdrawal. Consent can be withdrawn at any time by writing to hello@septa.co.za. We deactivate the account on withdrawal and, on request, delete the information, subject to Deleting Your Account.

Least data, most privacy. We collect only what the Service needs. A parent or guardian may ask us at any time what privacy settings apply to their child’s account and ask us to change them.

Messaging. A learner under 18 cannot message anyone until the month they turn 16 and their parent or guardian has approved the account. From then on they can message other learners under 18. Nobody under 18 can exchange private messages with an adult on Septa, and people search shows a learner under 18 only other learners under 18.

Profiles. A learner under 18 starts with their full profile, which shows their school, grade and other details, visible only to people they have accepted as friends; everyone else sees their name and photo. The learner can change this in settings. An adult on Septa never sees more of a learner under 18 than their name and photo, whatever the setting. Posts and comments are visible to other people on Septa, and learners under 18 can find each other in search by name and school.

Contact by tutors. Tutors and learners cannot message each other privately on Septa, at any age. A tutor's contact with a learner is through public comments on the tutor's content and through the video sessions the learner books. Taking a learner off the platform, or asking a learner for a personal phone number, social media handle or address, is a breach of our Terms of Use and one we act on firmly.

No marketing. We do not send marketing at all at present. The only email we send is about your account, your sessions, or a permission we need. If we ever send marketing, we will not send it to a Child’s account and we will not use a Child’s information to market anything.

No profiling, no advertising. We run no advertising, no behavioural profiling, and no cross-site tracking on a Child’s account.

Tutors under 18. A tutor may be under 18. Their own parent or guardian gives permission before the profile goes live, and we check their identity and qualification documents ourselves. Where a learner under 18 books a tutor who is also under 18, we tell the learner’s parent or guardian the tutor’s age and ask them to agree to that tutor before any session is arranged.

Each booking. Once a parent or guardian has approved the account, we email them each time the learner's booking is confirmed, with the tutor's name, the subject, the date and time, and the length of the session.

No screen recording. We do not record what is on your screen. We do not use session replay or any similar technology anywhere on the Service.

What a Parent or Guardian Can Do

A parent or guardian who has consented to a learner’s account may:

• ask what personal information we hold about the learner, and receive a copy;
• ask us to correct anything inaccurate;
• ask for a summary of the learner’s connections, privacy settings, and any reports involving the account;
• change the learner’s privacy settings, or ask us to;
• withdraw consent, which deactivates the account; and
• ask us to delete the learner’s information.

We respond within 30 days. We may ask for proof that you are the parent or guardian linked to the account before we act, because handing a learner’s information to the wrong adult is its own harm.

There are limits. We will not hand over the content of a learner’s private messages with third parties where that would expose another person’s personal information, and we will not act on a request that appears to place the learner at risk. Where we refuse, we say why.

When a Learner Turns 18

Parental consent is the basis on which a Child’s account is processed. When a learner turns 18 that basis falls away, and processing continues on their own consent and our contract with them.

We hold only a month and year of birth, and we do not change an account on our own when a learner turns 18. A learner who has turned 18 may tell us at support@septa.co.za and we will record it, remove the parental oversight rights described under What a Parent or Guardian Can Do, and tell the parent or guardian that we have done so. Privacy settings are not loosened automatically; the learner may change them if they choose.

Schools

A learner tells us the name of their school when they register. That is all. We have no arrangement with any school, we receive nothing from any school, and no school administers accounts or consent on our behalf.

If that ever changes it will be under a written data sharing agreement, we will say so here before it starts, and a school’s involvement would never replace a parent or guardian’s consent.

Who We Share Information With

We do not sell personal information. We have never sold it, and the business does not depend on selling it.

We share it in these circumstances:

• With other users, according to your privacy settings and, for a Child’s account, the restricted defaults described under Children’s Personal Information.
• With operators who process information on our behalf and on our instructions, under the written contracts section 21 of POPIA requires. Our Operators describes what they do; Schedule A names them.
• With a tutor, limited to what is needed to arrange and run a session the learner has booked.
• With a bursary provider or university: never by us. Septa does not send them your information. If you follow a link to apply, what you give them you give them yourself.
• With law enforcement or a regulator, where the law requires it or where it is necessary to protect someone’s safety. Where a child’s safety is involved we may act without prior notice.
• With a purchaser of the business, if Septa is ever sold, on condition that the same protections continue to apply.

Our Operators

An operator is a company that processes personal information for us, on our instructions. We use operators for the following:

Each operator is bound by a written agreement requiring it to process information only on our instructions, to keep it secure, and not to use it for its own purposes. Schedule A names the current providers. We update Schedule A when a provider changes, without reissuing this notice.

Sending Information Outside South Africa

Some of our operators are outside South Africa, and our database is in the United States. Section 72 of POPIA allows this where the recipient is bound by an agreement giving protection substantially similar to POPIA, including limits on passing the information on again. Our operator agreements do that.

In practical terms:

• Our application and database are hosted in the United States.
• Technical error data is processed in Germany, and is filtered before it is sent: cookies, authorisation headers, request bodies, query strings and user identifiers are stripped, so what leaves is the error, the route, and the technical stack.
• Other operators are listed in Schedule A with their location.

We do not transfer a Child’s personal information to any operator that is not bound by those protections.

How We Protect It

No system is perfectly secure, and anyone who says otherwise is selling something. These are the specific measures we take:

• Traffic between your device and the Service is encrypted in transit.
• Passwords are stored as one-way hashes, never in readable form. We cannot see your password and cannot recover it.
• Tutor bank account numbers are encrypted at rest under a dedicated key, and shown back only in masked form.
• Development and production use entirely separate signing keys, so a credential from one is useless against the other.
• A content security policy restricts what may execute in your browser, limiting the damage an injected script could do.
• Access to production data is limited to those who need it.
• Simultaneous connections to a single account are capped, which limits automated abuse.
• We review security regularly and fix what we find.

If Something Goes Wrong

If personal information is accessed or disclosed without authorisation, section 22 of POPIA requires us to notify the Information Regulator and the people affected.

We will investigate and contain the incident, notify the Regulator as soon as reasonably possible after establishing what happened, and notify affected users directly. We tell you what happened, what information was involved, what we have done, and what you can do. Where a Child’s information is involved we notify the linked parent or guardian as well.

We will not delay telling you in order to finish an investigation. If we know enough for the notice to be useful, we send it.

How Long We Keep It

We keep personal information only as long as we need it, or as long as the law requires. Section 14 of POPIA does not permit keeping it indefinitely.

An account not used for three years is deleted. We email the account holder, and any linked parent or guardian, at 30 months and again at 35 months before that happens.

Deleting Your Account

You can close your account at any time from your settings page. There are two routes, and you choose:

• A deletion request schedules deletion 30 days ahead. You can cancel it at any point in those 30 days from the same page. This runs automatically; it does not wait on anyone.
• Immediate deletion removes your account and your information straight away, and cannot be undone.

What deletion removes: your profile, posts, comments, likes, connections, messages, activity, and the account itself.

What survives, and why: financial records of payments, with your identifiers stripped out, because the Revenue Service requires five years of them; anything relating to a report of unlawful conduct or a child-safety investigation; and anything a law requires us to keep. Messages you have already sent remain in the recipient’s account, in the way a posted letter does.

Before you close your account you can export a copy of your information from the same settings page.

Withdrawal of parental consent has the same effect as a deletion request for that learner’s account.

Cookies and Similar Technologies

A cookie is a small file a site stores in your browser. We use as few as the Service can work with, and we list them rather than describe them in general terms.

Both are strictly necessary: without them you cannot stay signed in. None is used to track you, and none is shared with anybody.

Your browser also keeps a few things locally that are not cookies: a note that you are signed in (never the sign-in token itself, which stays in the cookie above), a tutor’s own account number, the answer you gave in the cookie banner, your recent searches, whether you have dismissed a notice, and where you had reached in a reel. None of it is used to track you. Clearing your browsing data removes all of it.

Another company sets a cookie only when the part of the Service it provides is actually in use. The payment provider’s script is fetched when you begin a payment and on no other page. The video provider’s runs during a session. Our error reporting starts only if you accept in the banner, and does not start at all if you decline.

Everything that is not strictly necessary runs only if you accept it, and that choice is enforced in the software rather than merely recorded: nothing non-essential starts until you actively accept, and declining stops it immediately.

We operate no behavioural analytics. We use no advertising or cross-site tracking technology, and none of it ever on a Child’s account.

Marketing

Service messages are part of running your account: security alerts, booking confirmations, consent records, account notices. They are not marketing, and they continue while your account is active.

Marketing is separate. We send it only where the law allows and, where consent is required, only with it. Every marketing message carries a way to unsubscribe, and you can withdraw at any time from there or by writing to support@septa.co.za.

We do not send marketing to a Child’s account.

Automated Decisions

Some features work automatically: the APS calculator, bursary eligibility matching, course suggestions, and the order of content in feeds and search.

These are informational. None of them makes a decision that has legal consequences for you, and none decides whether an institution admits you or a provider awards you a bursary. Those decisions belong to the institution or the provider.

If you think an automated feature has produced a wrong result that affects you, write to support@septa.co.za and a person will review it. This is provided having regard to section 71 of POPIA.

Your Rights

POPIA gives you the following rights over your personal information. Where the user is a Child, a parent or guardian may exercise them on the learner’s behalf.

Making a Request

Write to hello@septa.co.za, or use the tools in your settings page where they cover what you need.

So that we do not hand your information to somebody else, we confirm who you are before acting. For a learner’s account we may also confirm that the person asking is the linked parent or guardian.

We respond within 30 days. If a request is complex and we need longer, we tell you before the 30 days are up, explain why, and give a date.

Requests are free. If one is clearly excessive or repetitive we may charge a reasonable fee, and we will tell you the amount before doing any work.

If we refuse a request we tell you why, and tell you that you may complain to the Information Regulator.

Formal requests for access to records may also be made under the Promotion of Access to Information Act 2 of 2000, on the prescribed form, to our Information Officer.

Complaints

If you are unhappy with how we have handled your personal information, tell us first at hello@septa.co.za. We acknowledge within 5 business days and aim to resolve it within 15.

You may complain to the Information Regulator at any time, whether or not you have raised it with us first.

What We Do Not Do

It is worth being explicit about what we do not do, because a notice that lists only permissions is hard to weigh.

• We do not sell personal information.
• We do not record your screen, and we run no session replay.
• We do not use your content to train artificial intelligence models.
• We do not run advertising on the Service.
• We do not profile children.
• We do not market to children.
• We do not track you across other websites.
• We do not give your information to anyone for their own marketing.
• We do not ask for identity numbers or precise location.

Changes to This Notice

We may update this notice. Where a change materially affects how we handle your information, we tell you through the Service or by email at least 14 days before it takes effect, and we update the version and date on the cover page.

Where a change affects a Child’s account we notify the linked parent or guardian and, where the law requires it, seek consent again.

We keep previous versions and will provide one on request.

In Plain Language, for Learners

This section is a summary. The rest of the notice is what counts legally, but this is the short version.

What we know about you. Your name, school, grade, subjects, whatever you put on your profile, who you connect with, and the messages you send. If you are under 18, the month and year you were born, so that messaging can open when you turn 16. If you pay for tutoring we know that you paid, but not your card number.

Who can see it. Your posts and comments can be seen by other people on Septa. Your full profile, with your school and grade, is shown only to people you have accepted as friends, and everyone else sees your name and photo. Adults on Septa never see more than your name and photo. Other learners under 18 can find you in search by your name and school. You can change who sees your profile in settings.

What your parent can see. They can ask us for a copy of your information, see who you are connected to, see your privacy settings, and see whether anything has been reported about your account. They get an email each time you book a session. They cannot read your private messages with other people.

What we never do. We never sell your information. We never record your screen. We never show you ads. We never use what you write to train an AI.

If somebody is bothering you. Report it in the app or email support@septa.co.za. Anything involving a learner’s safety is looked at within 24 hours. You do not need a parent’s permission to report something.

If you want it gone. Go to settings. You can download everything we hold about you, and you can delete your account. If you ask us to delete it, you have 30 days to change your mind.

If you are worried about something we have done. Email hello@septa.co.za. If our answer does not satisfy you, you can complain to the Information Regulator, and you do not need a lawyer to do it.

Schedule A: Our Service Providers

This schedule lists the operators we currently use. We update it when a provider changes, without reissuing the notice.

We do not process payments through the Service at this time, and no payment provider has been appointed. When one is, it will be named in this Schedule before the first transaction is taken.

Schedule A last updated: 15 September 2026.