Brainline POPI Act Policy and Standards

Introduction

The POPI Act stipulates eight conditions for the lawful processing of data. This includes:

1. Accountability
2. Processing limitation
3. Purpose specification
4. Further processing limitation
5. Information quality
6. Openness
7. Security safeguards
8. Data subject participation

This document outlines the process followed by Brainline to ensure compliance with the POPI Act.

Condition 1: Accountability

It is of our utmost concern that the personal information of our clients is protected. Should you want to report any concerns on how your personal information is handled, you may send us an email to [email protected].

Condition 2: Processing Limitation

The second condition handles the processing of data on the system. This includes processing data in such a way that it doesn’t risk the subject’s privacy, that only relevant data is processed, and that the subject gives consent for this data to be used. Proof of this consent must be kept on the system and the subject should be able to withdraw this consent at any given time.
The following data is processed on Brainline’s systems:

General website at www.brainline.com

Where the user completes a contact form, the information may be used to contact the user for marketing reasons with the purpose of assisting them to choose the correct product.
This data is stored on Mailchimp’s servers, and access is restricted to Brainline’s marketing administrators.
The following information may be requested:

• Name
• Surname
• Contact number
• Email address

Enrolment on www.mybrainline.com

Only relevant personal information, which is required for identification purposes, is asked from the user upon enrolling with Brainline on www.mybrainline.com:

Personal details:

• Name
• Surname
• ID/Passport number (including identification document)
• Language
• Brainline branch at which enrolment is taking place

Contact details:

• Work, home, and cell numbers (of both parents/guardians)
• Two email addresses
• Student internet access/ not

Address details:

• Physical and postal addresses
• Whether you reside outside SA/ not

Student details:

• Name
• Surname
• Email address
• ID Number
• Photo of student (if they wish to upload)
• Copy of certified ID document (proof of student’s existence)
• Citizenship
• Home Language
• Gender
• Disability status: Medical/Physical (to assist with academic queries)
• Date of birth
• Cell number
• Academic history: Previous academic report
• Financial documents: Debit order agreement, which includes proof of income as well as banking details (where disclosed on not opting to pay via EFT)
• In the case of application for accommodation through the IEB:
  • Report from an educational psychologist, which includes tests pertaining to spelling, reading, or the results of these
  • Medical reports
  • Psychological reports as and where applicable
  • Immigrant status where exemption is applied for the Afrikaans language

General:
All communication and/or correspondence are logged on www.mybrainline.com (the enrolment platform):

• Records of phone calls
• Changes to the enrolment database
• Emails/SMSs sent or received by client
• Approved / Lead / Block / Suspension of services
• Details of dispatch of documents/items/reports (any items or documents dispatched)

Learning platform on www.brainonline.com

Automatic Internet usage information is logged on the system, such as Internet Protocol address (IP address), browsing habits, click patterns, cookie preferences, JavaScript enablement, the content and pages that are accessed on the website, and the dates and times of individuals’ website visits, paths taken, and time spent on sites and pages within the website (usage information).

Cookies

Small text files called ‘cookies’ are put on the user’s device when they visit the site. These files do contain a personal identifier allowing Brainline to associate personal data with a certain device. These files ensure the tailoring of the website’s functionality to the user’s personal preferences, e.g. allowing quick access links to most recently used areas of the site.

Privacy Policy Agreement

All users must accept a privacy policy when logging in the first time and thereby giving consent for personal data to be processed and used in order to complete services rendered by Brainline.

A copy of the user agreements (proof of acceptance of policy) is kept on the system.

The user can withdraw this consent at any time. See following example:

Condition 3: Purpose Specification

Condition 3 details the reasons for collecting data and specifies that this data should only be kept on the system for as long as necessary to process what the users do on the system.

Two aspects are relevant in this regard. First, the student must be identified, and proof of this identity must be uploaded to the system. The second aspect is that Brainline is an online learning system whereby users on the system complete learning activities and records of these activities are linked to the users. The law requires that this information be kept for 5 years.

Certain information is required by governing bodies, e.g. Umalusi and the IEB.

All history data is archived on an annual basis, and can only be accessed by special request and authorisation. Only system administrators have access to archived data.

Such information is stored where there are academic queries on student profiles.

Use of personal information:

• Data on brainonline.com is used for academic purposes, enabling teachers and students to complete their academic years. This data is drawn from www.mybrainline.com, where the parent and/or legal guardian and/or student disclosed the required personal information.
• Data on mybrainline.com may be used for marketing purposes, informing those with an intent to register (those on a Lead/Enrolling status) about available product options, ensuring that they make the best product selection for their needs.
• Data on brainline.com may be used for marketing purposes, informing those who completed a contact form on the website about available product options, and ensuring that they make the best product selection for their needs.

Condition 4: Further Processing Limitation

The following measures are put in place to ensure a user’s privacy.

On the learning platform, www.brainonline.com:

There are three options available on the Brainline system when it comes to users’ information:

• Not visible: Student cannot view own personal information but it is visible to brainonline.com system administrators.
• Visible to the user: Student can view own personal information, and it is visible to Brainline authorised users of the system – teachers, system administrators)
• Visible to everyone (visible to all users on brainonline.com)

All data fields are set to “Visible to user” on www.brainonline.com, so that personal information is only visible to system administrators and the user to who this data belongs.

The following personal information fields are an exception, and set to “Visible” for teachers on www.brainonline.com:

• Name
• Surname
• Grade
• Language preference
• Email address

This is to enable the teacher to communicate with the students.

Email display default is set to hidden.

On the enrolment platform, www.mybrainline.com:

Each user’s personal information is protected by a username and password that is generated internally, that meet industry-standard password complexity requirements.

These passwords may only be reset on a formal request from the account holder with Brainline, which is then actioned by a Brainline system administrator.

Only authorised Brainline personnel have access to the enrolment platform via the same password complexity rules.

Condition 5: Information Quality

When a user signs up, proof of ID is required. Therefore, along with personal information entered on the system, a verified proof of ID should also be uploaded to the system. The user receives a username and password, which is used to log in to the Brainline systems.

Condition 6: Openness

Brainline will take reasonably practicable steps to ensure that learners are made aware of:

• the information being collected and if not directly from the data subject, the source from which it is collected
• the name and address of Brainline
• the purpose for which the information is being collected (Available in Annexure A)
• whether or not the supply of this information by the data subject is voluntary or mandatory
• the consequences of failure to provide such information
• any particular law which authorizes or requires the collection of the information
• any further information necessary to enable processing in respect of the learner to be reasonable, taking into account the specific circumstances in which the information is to be (or not to be). For example:
• recipient or category of recipients of the information
• nature or category of the information
• existence of the right of access to and right to rectify the personal information collected
• the existence of the right to object to the processing of the information
• the right to lodge a complaint to the Information Regulator

The learner should be made aware of the above information prior to collection or in the instance where the information is collected from a source other than the data subject, as soon as reasonably practicable after the personal information is collected.

Condition 7: Security Safeguards

The following domains are considered:

• General website: brainline.com
• Learning platform: brainonline.com
• Enrolment platform: mybrainline.com

All of these domains reside on separate servers. These servers are managed by our hosting providers and protected by industry-standard security and disaster-recovery protocols.

Each user’s personal information is protected by a username and password, which is generated internally, that meet industry-standard password complexity requirements.

These passwords may only be reset on a formal request from the account holder with Brainline, which is then actioned by a Brainline system administrator.

Data Request SOP

You have the right to object to the processing of your personal information. However, kindly note that this may negatively influence our ability to fulfil our obligations towards you as a Brainline Parent/ legal guardian or learner.  

When a Brainline learner submits a request for their information to be removed, the following process is followed:

1. The account holder must log a ticket with the Brainline support desk at [email protected].
2. Since the account must be kept for academic purposes and data archiving, the account holder is notified that such a request may result in deregistration, as certain personal information is required to assist with academic requirements.
3. Brainline resolves the ticket after discussions with the account holder, and actions the required steps based on the agreement reached.
4. Brainline confirms the action with the requesting user.

Annexure A: Profile Fields And Data Collection Reason – Brainonline.com

Below is a list of all the profile fields and the reason for collecting the data: