Privacy & data residency

Who we are

ClassPulse is the responsible party (data controller) for the personal information collected through the marketing site at classpulse.co.za. When your school uses ClassPulse to manage attendance and student records, ClassPulse acts as an operator (data processor) on the school's instructions — the school itself is the responsible party for that data.

What we collect

From your school's ClassPulse tenant we process:

• Teacher and admin names, email addresses, and sign-in events.
• Student names, student codes, dates of birth, grade, house membership, and guardian email addresses.
• Attendance marks (present / absent / late) and structured absence reasons.
• Audit log entries — who did what, when, and the before/after diff for every mutation.

We do not collect biometric data, payment information from students, or device location.

Where your data lives

Application data is hosted in the European Union (Frankfurt, Germany) on Render's managed infrastructure. Backups are kept in the same region. We do not move customer data out of the EU except as described under "Cross-border transfer" below.

POPIA & cross-border transfer

For South African customers, the transfer of personal information from South Africa to the European Union for processing is covered by section 72(1)(a) of POPIA: the recipient jurisdiction (the EU under the General Data Protection Regulation) provides a level of protection that is substantially similar to POPIA, including binding corporate rules and enforceable rights for data subjects.

Where the school's privacy notice to parents requires explicit consent (e.g. for processing the personal information of a child under section 35 of POPIA), that consent is collected by the school as the responsible party. ClassPulse only processes data on the school's documented instructions.

Children's data (POPIA s.35)

Personal information of children is treated as a special category. ClassPulse:

• Limits access to authenticated, role-permitted users of the relevant school tenant.
• Does not use children's personal information for marketing.
• Does not share or sell children's personal information.
• Records every read and mutation in the audit log so abuse is discoverable after the fact.

How long we keep it

Active tenant data is retained for the duration of the school's subscription plus 12 months. If a school cancels, we retain the data in cold storage for 12 months to allow recovery, then delete it permanently. Audit logs follow the same lifecycle.

For prospective customers contacting us through the marketing site, we retain the conversation for up to 24 months unless you ask us to delete it sooner.

Your rights under POPIA

You have the right to:

• Be notified that we are collecting your personal information.
• Access the personal information we hold about you.
• Request correction or deletion of inaccurate or incomplete information.
• Object, on reasonable grounds, to the processing of your personal information.
• Lodge a complaint with the Information Regulator (South Africa).

To exercise any of these rights, email hello@classpulse.co.za with "POPIA request" in the subject line. We respond within 30 calendar days.

Security

Authentication is passwordless — email magic links and WebAuthn passkeys only. Tenants are isolated at the database layer. Email credentials, when stored per-school, are encrypted at rest using Fernet symmetric encryption.

Information Regulator (South Africa)

If you believe we have not adequately addressed a privacy concern, you may lodge a complaint with the Information Regulator:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg
inforegulator.org.za

Changes to this policy

We will post material changes here and email registered customers at least 30 days before the change takes effect.