POPIA and PAIA Manual for  Ubora Online Academy (Pty)(Ltd) (hereinafter ‘Ubora’)

Last updated: 30 October 2024

This manual is designed in compliance with the Promotion of Access to Information Act, 2000 (“PAIA”) and the Protection of Personal Information Act, 2013 (“POPIA”). Ubora is committed to ensuring the confidentiality, integrity, and accessibility of personal information it collects, and to providing access to information as required by law.

• Information Officer: Simla Budhu
• Deputy Information Officer(s): Dheven Govender
• Contact Email: io@ubora-academy.co.za
• Contact Phone: 0825750926
• Physical Address: 2976 Tamarilo Place, Brooklands Lifestyle Estate No. 3 Kosmosdal, Centurion, 0154
• Website:ubor-academy.co.za

This manual aims to:

• Inform stakeholders of the school’s commitment to protecting personal information.
• Guide individuals on how to request access to information held by the school.
• Explain how the school complies with PAIA and POPIA requirements in its data handling and management practices.

Ubora collects and processes personal information, which includes but is not limited to:

• Student Information: Full name, identity number, contact details, educational history, and performance records.
• Parent/Guardian Information: Name, contact details, identity number, and payment information.
• Employee Information: Name, contact details, qualifications, employment history, and bank details.
• Website Visitor Information: IP address, browsing activity, cookies, and device information.

Personal information is collected for purposes that may include:

• Providing educational services and support to students.
• Managing administrative records and processing payments.
• Communicating with parents, guardians, and students.
• Complying with legal and regulatory obligations.
• Marketing (where applicable) with explicit consent.
• Employment Management (contracts, performance agreements, evaluations, payroll, benefits, medical and general HR information).
• Recruitment information such as curriculum vitae, criminal assessment records, competency records.
• Training and Development records, such as, attendance registers, workplace skills files, tracking and reporting of employment equity based training and development.
• Security information.
• Compliance with laws, regulations and policies.
• Travel information.
• General administrative, financial and tax information.
• Product and service development.
• Billing and account management.

Ubora will process personal information in accordance with POPIA, which may include obtaining consent, fulfilling contractual obligations, complying with legal requirements, or protecting legitimate interests. We ensure that:

• Students, parents, and employees understand why their personal information is being collected.
• Consent is obtained where required, and data subjects can withdraw consent at any time.

To protect personal information from loss, damage, or unauthorized access, Ubora will apply reasonable technical and enterprise-wide security and other measures to protect personal information that is processed by it and of its affiliated entities. More specifically, the company implements:

• Physical security controls at its premises (if necessary).
• Encryption and secure access to digital records due to the schools’ online nature.
• Regular audits and assessments of data security practices.
• Training and development to foster a culture of compliance whilst data retention policies govern the term for keeping relevant data for the company’s various purposes.

10.1 Right to Access

In compliance with PAIA, any person may request access to records held by Ubora, provided the information is not restricted from disclosure by law.

10.2 Categories of Records Available

The following records are held by Ubora:

• School Administration Records: School policies, curriculum materials, and schedules.
• Student Records: Registration documents, assessments, and progress reports.
• Financial Records: Payment receipts, billing information, and expense reports.
• Employee Records: Employment contracts, performance reviews, and payroll information.
• Third Part Supplier Records: entities that provide support and maintenance to the Learning Management System, Licenses etc.

10.3 How to Request Access to Records

To request access to records, individuals must:

• Complete a PAIA request form (available at ubora-academy.co.za/ (need to insert additional tab here) or by contacting our Information Officer).
• Submit the form via email or post, along with proof of identity and payment of any applicable fees published at sahrc.org.za unless same has been waived in writing to the requestor.
• Ubora will respond within the legally prescribed timeframes to process requests for records.

10.4 Grounds for Refusal to Access Records

Chapter 4 of PAIA contains several grounds on which a request for access to information must be refused. Ubora may therefore refuse a request for information on the following basis:

10.4.1  The mandatory protection of the privacy of a third party who is a natural person,
                        in order to avoid the unreasonable disclosure of personal information concerning
                        that natural person (including a deceased individual).

10.4.2 The mandatory protection of the commercial information of a third party, if the
            record contains:

                        10.4.2.1            trade secrets of that third party;

10.4.2.2           financial, commercial, scientific or technical information, other

than trade secrets, of a third party, the disclosure of which would
            be likely to cause harm to the commercial or financial interests of
            that third party; or

10.4.2.3           information supplied in confidence by a third party, the disclosure
                                    of which could reasonably be expected:

1. to put that third party at a disadvantage in contractual or other negotiations; or
2. to prejudice that third party in commercial competition.

10.4.3. The mandatory protection of confidential information of third parties if
            disclosure would constitute an action for breach of a duty of confidence owed
            to that third party in terms of an agreement.

10.4.4 The mandatory protection of the safety of individuals and the protection of
           property.

10.4.5 The mandatory protection of records which would be privileged from
           production in legal proceedings.

10.4.6 The protection of the Ubora’s commercial activities including, without
            limitation, records that contain:

1. Ubora’s trade secrets;
2. financial, commercial, registrar, employee, technical information, the disclosure of which would likely cause harm to the Ubora’s commercial or financial interests; or
3. information, the disclosure of which could reasonably be expected to place Ubora at a disadvantage in any negotiations.

10.4.7.  The mandatory protection of research information of Ubora or a third party, if

disclosure would expose the identity of Ubora or the third party, the researcher or the subject matter of the research to serious disadvantage.

10.4.8.  Requests for information that are frivolous or vexatious or which involve an
             unreasonable use of Ubora’s resources.

10.4.9 .  Should the Ubora refuse access to record, the requestor may appeal to Ubora

 within 14 (fourteen) calendar days of being informed of the decision.

10.4.10   If Ubora refuses the appeal, the requester may apply to any court, having
              jurisdiction, for relief within 30 (thirty) days of having been informed of

 Ubora’s decision.

Data subjects have the right to:

• Access, correct, and update personal information.
• Object to the processing of personal information in certain instances per Annexure B hereto.
• Request deletion or destruction of personal information under certain circumstances per Annexure C hereto.
• Lodge a complaint with the Information Regulator in terms of details listed under section 14 hereof.

Ubora retains personal information for as long as necessary to fulfill the purposes outlined in this manual, comply with national legal obligations, and resolve disputes. Retention periods are regularly reviewed to ensure data is not held longer than needed.

This manual may be updated periodically to reflect changes in legal requirements or organizational practices. Any changes will be posted on our website.

If you have concerns regarding the handling of your personal information, please contact the Information Regulator:

• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email: inforeg@justice.gov.za
• Website: https://www.justice.gov.za/inforeg/