Privacy Policy

1Who we are and what this policy covers

This policy is issued by FundiSynced (Pty) Ltd ("the Company", "we", "us"), registration number 2026/258179/07, of 37 Viking Villas, Viking Drive, Kraaifontein, Cape Town, Western Cape, 7570, South Africa. We trade as FundiSyncEd and FundiOS. It explains how we collect, use, share, store and protect Personal Information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, for individuals in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). See clauses 13 and 14.

1.1 What it covers. This website; our waitlist; your portal account; and the FundiOS platform when you use it as a parent or guardian, an independent tutor or another direct user. The platform comprises modules such as GradebookPro, AnalyticsPro, MeritTracker, TeacherStudio, ParentHub and LearningCanvas, and any successor, renamed or new module that processes Personal Information for the purposes described here.

1.2 Our role depends on the situation. We are not always the party that decides why information is processed.

1.3 This policy applies in full to the first and third situations. For the second, the institution's own privacy notice and our Data Processing Agreement ("DPA") with the institution govern, and this policy applies only as stated in clause 15.

1.4 "Personal Information" has the meaning in section 1 of POPIA: information about an identifiable, living person (and, where applicable, an existing juristic person), such as a name, email address, IP address or student mark.

2Information we collect

We collect the following categories. We collect most of it directly from you; where a school, teacher or parent supplies it, we say so.

2.1 Special Personal Information. Please do not record a child's health, religion, race, sex life, biometric data, criminal behaviour or similar special personal information (POPIA section 26) in free-text fields. Behavioural Data is entered by school staff, and we do not use it for product analytics or marketing.

2.2 Why we need it. Each category is used only for the purposes in clause 3. Where supplying information is optional, we say so on the form. If you do not supply required information, we may be unable to add you to the waitlist, open your account or deliver the service.

2.3 No other sources. We do not buy Personal Information or combine it with data from data brokers.

3Why we use your information and our lawful grounds

We process Personal Information only where a lawful condition under section 11 of POPIA applies (and, for UAE users, a lawful basis under the PDPL). We process a purpose only if it appears in this table.

3.1 New purposes. If we want to use Personal Information for a new purpose, we will update this policy and, where the law requires, ask for consent first (clause 16). A new product or feature does not on its own allow a new use.

3.2 We do not sell Personal Information, and we do not use children's information for advertising or for our own product analytics.

4AI, profiling and automated processing

4.1 Parts of the platform use automated tools, including Large Language Model (LLM) AI systems, to generate lesson frameworks, performance forecasts and remediation or trajectory reports. These outputs are estimates and are advisory only.

4.2 Human review. Our terms require a teacher to review and approve any parent-facing report, forecast or trajectory before it is released. We do not take decisions that have legal consequences for a person, or that substantially affect them, based solely on automated processing (POPIA section 71).

4.3 Your right to human review. You may ask for human review of any automated output about you or your child, by contacting your school or our Information Officer. We will explain in plain terms what information the output is based on.

4.4 What reaches AI providers. Where we send content to an AI provider, we remove or pseudonymise student names and identifiers where practicable. Our agreements with AI providers restrict them from using that content to train their public models. Providers may keep content for a limited period for abuse monitoring, as set out in their terms.

4.5 Please do not type a child's sensitive details into open AI prompts. Use the structured fields the platform provides.

5Who we share information with

We share Personal Information only with the parties below, only as needed for the purposes in clause 3. Where a provider acts for us, we require by written contract that it applies safeguards substantially similar to POPIA's conditions (and, for UAE data, the PDPL), and that it uses the information only on our instructions.

5.1 Other recipients. We may also share information with: (a) professional advisers, auditors and insurers under confidentiality duties; (b) courts, regulators or law-enforcement bodies where the law requires or permits; (c) a buyer or successor if we sell or restructure the business, who must honour this policy; and (d) the school, parent or tutor responsible for the learner, where the platform is designed to show them the information.

5.2 Sub-processor list. We keep this list up to date. We give institutions advance notice, as set out in the DPA, before adding a sub-processor that will process their data.

6Transfers outside South Africa

6.1 Some providers in clause 5 process information outside South Africa. We transfer Personal Information abroad only if (POPIA section 72): the recipient is bound by law, binding rules or a written agreement that gives protection substantially similar to POPIA's conditions; or you consent; or the transfer is necessary to perform a contract with you or at your request; or another ground in section 72 applies.

6.2 Where we are an Operator, we transfer an institution's data only in line with the DPA and the institution's instructions.

6.3 UAE data. Transfers of UAE users' Personal Information outside the UAE are made only in line with the PDPL's transfer rules (clause 13).

6.4 Other countries. If you are in another country and its law gives you additional rights over transfers, we will honour them where they apply to us (clause 14).

7How long we keep information

We keep Personal Information only as long as needed for the purposes in clause 3, or as the law requires.

When a period ends, we delete or de-identify the information. Where the law requires us to keep it longer, we restrict its use to that legal purpose.

8Security and breach notification

8.1 Safeguards. As POPIA section 19 requires, we take appropriate, reasonable technical and organisational measures to protect Personal Information. They include encryption in transit and at rest, secure vault services for credentials, role-based access control, encrypted off-site backups, hashed passwords, rate limiting on sign-in, and encryption of data cached on your device for offline use. The DPA (Annexure B) sets out further measures for institutions. No system is completely secure, so please also protect your own password and device.

8.2 Where we are the Responsible Party. If we have reasonable grounds to believe that an unauthorised person has accessed or acquired your Personal Information, we will notify the Information Regulator and you as soon as reasonably possible after discovery (POPIA section 22), with enough information for you to take protective steps.

8.3 Where we are an Operator. We will notify the institution without undue delay, and in any event within 24 hours of becoming aware of a compromise affecting its data, so that it can meet its own duties.

8.4 UAE. For UAE users, we will notify the competent UAE authority and affected individuals where the PDPL requires it.

9Direct marketing

We send promotional messages about new features or offers only with your prior opt-in consent, in line with section 69 of POPIA and the Electronic Communications and Transactions Act 25 of 2002. Joining the waitlist does not by itself opt you in to general marketing. We will use your details to tell you about pilot access and your sign-up. You can withdraw consent at any time using the unsubscribe link in any marketing message, without affecting essential service notices. We do not send marketing to children.

10Cookies, local storage and similar technologies

10.1 This website does not set advertising or analytics cookies, and does not use tracking pixels or session-replay tools. It uses the following, all of which are strictly necessary for the portal to work:

10.2 Fonts. Our pages load typefaces from Google Fonts. This sends your IP address and browser details to Google, as described in clause 5.

10.3 Changes. If we add analytics or any non-essential technology, we will update this policy first and ask for your consent before using it where the law requires.

11Children's Personal Information

11.1 A "child" is any person under 18.

11.2 This website is for adults. You must be 18 or over to join the waitlist or open an account. We do not knowingly collect Personal Information directly from a child, and we do not allow a child to create an account independently of a parent, guardian or institution. If you believe a child has given us information, contact us and we will delete it.

11.3 School-supplied students. Where an institution enrols a student under its MSA, the institution, as Responsible Party, must obtain any parental or guardian consent required before submitting that student's information. We act as Operator and process the information only on the institution's instructions.

11.4 Parent-created accounts. Where a parent or guardian creates a ParentHub or direct account, we treat that person as the competent person consenting on the child's behalf. We may ask for evidence of that authority.

11.5 Independent tutors. An independent tutor who enters learner information is the Responsible Party and must hold any consent required by POPIA sections 34 and 35 (or the equivalent UAE requirement). We process it as Operator.

11.6 Reviewing and withdrawing consent. A parent or guardian may ask to see, correct or delete their child's information, or withdraw consent, by contacting the school or our Information Officer. Withdrawal does not affect processing already done, and the child may no longer be able to use some features.

11.7 Our commitments. We do not use children's information for advertising or for our own product analytics, and we ask schools to keep Behavioural Data to what is necessary for educational and pastoral purposes.

12Your rights and how to use them

Under POPIA you have the right to:

• ask whether we hold Personal Information about you, and to access it (POPIA section 23);
• ask us to correct inaccurate, outdated or incomplete information, or to delete or destroy it where we are no longer entitled to keep it (section 24), including from backups on the overwrite cycle in clause 7;
• object to processing based on legitimate interests (section 11(3)) and to direct marketing (section 11(3) and section 69);
• withdraw consent at any time, without affecting processing already done;
• ask for human review of automated outputs (clause 4.3); and
• complain to the Information Regulator if you believe we have processed your information unlawfully.

12.1 How to ask. Email our Information Officer at admin@fundisynced.com. We may ask you to verify your identity first. We will respond within 30 days. Where the law allows a fee, we will tell you before we charge it. If your request concerns student information supplied by a school, we may refer it to the school as Responsible Party and will help it respond.

12.2 Parents and guardians may exercise these rights for a child (clause 11.6).

12.3 Records requests. Requests for access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA) can be sent to the same address.

12.4 Complaints. You may complain to the Information Regulator (South Africa): inforegulator.org.za, complaints email complaints.IR@justice.gov.za. We would appreciate the chance to resolve your concern first.

13Users in the United Arab Emirates

13.1 This clause applies where we process Personal Information of individuals in the UAE. It sits alongside the rest of this policy. Where the PDPL gives greater protection, the PDPL applies.

13.2 Our roles are as in clause 1.2. UAE institutions remain responsible for their own obligations, including any requirements of the Ministry of Education, ADEK or KHDA that apply to student data.

13.3 We treat a child as any person under 18, consistent with UAE child protection law (Federal Law No. 3 of 2016).

13.4 UAE users have the rights the PDPL gives them, which may include access, correction, erasure, restriction, portability and objection to automated decisions. We transfer UAE users' Personal Information outside the UAE only as the PDPL permits.

13.5 UAE users may raise a concern with our Information Officer or with the UAE Data Office or other competent UAE authority.

14Users in other countries

We are a South African company and apply POPIA across our services. If you are in another country, for example in the European Economic Area or the United Kingdom, and the data protection law there gives you additional rights that apply to our processing, we will honour them. You can use the contact details in clause 17. By joining the waitlist from outside South Africa you understand that your information will be processed in South Africa and by the providers in clause 5.

15How this policy relates to our other terms

15.1 This policy is incorporated into, and forms part of, our terms: the Website Terms for this website, and the Terms of Service for the platform. A term defined there (such as "Software", "Subscription" or "Institution") has the same meaning here. "Institution" means a school or other organisation that has an MSA with us. "DPA" means the Data Processing Agreement that forms Schedule A to the MSA.

15.2 For information an institution supplies about its students and staff, the DPA prevails over this policy on data protection matters. This policy is a notice for website, ParentHub and direct users. It does not itself create contractual terms for institutions.

16Changes to this policy

We may update this policy. We will post the new version with its date and, for material changes, notify you by email or in the platform at least 30 days beforehand. If a change adds a new purpose for children's information, we will ask for fresh consent where the law requires it. Earlier versions are available on request.

17Governing law and contact

This policy is governed by the laws of the Republic of South Africa, without limiting any mandatory rights you have under the law of your country, including UAE law for UAE users. Disputes are dealt with under the applicable terms.