POPIA

1. What POPIA is

The Protection of Personal Information Act, 4 of 2013 (POPIA) is South Africa’s law on how personal information may be collected, used, stored and shared. It applies to Handova because we process personal information about staff, parents, pickup people and children on behalf of institutions in South Africa.

This page sits alongside our Privacy Notice rather than replacing it: the Privacy Notice says what we collect and why in plain language; this page maps that against POPIA specifically, for anyone who wants that detail.

2. Responsible party and operator

POPIA’s terms for this are responsible party and operator - the same relationship our Privacy Notice calls controller and processor.

• The institution (the school or group that holds an account) is the responsible party. It decides what information to hold about the children and families in its care, and why.
• Handova is the operator. We process that information on the institution’s instructions, under a written agreement, and only for the purpose of running the product.

If you are a parent asking what is held about your child, ask your school first - as the responsible party, they decide and can act immediately.

3. The eight conditions

POPIA sets eight conditions for processing personal information lawfully. Here is how each one shapes Handova, in the order the Act lists them.

• Accountability. The institution is accountable as the responsible party; we are accountable to them for how we handle what they give us, under a written agreement.
• Processing limitation. We collect what running the pickup service actually needs - who a child is, who may collect them, and what happened - and nothing beyond that.
• Purpose specification. Information is collected for one stated purpose: pickup authorization and verification. See why we hold it in the Privacy Notice.
• Further processing limitation. We do not repurpose information for anything unrelated to that - not advertising, not selling it, not training machine-learning models on it.
• Information quality. A parent or a staff member can correct their own details, and a school can correct a child’s record, so what is held stays accurate and current.
• Openness. This page and the Privacy Notice are how we are open about what we hold, and an institution knows this because it is the one that entered the information.
• Security safeguards. Access is scoped by school and by role, identity document contents are never displayed in the interface, and every administrative action is written to an append-only audit log. See services/api’s own documentation for the technical detail.
• Data subject participation. See your rights below - access, correction and objection are not abstract; the interface is built so an institution can act on a request the same day.

4. Children’s information

POPIA treats a child’s personal information as a special case: processing it is generally prohibited unless an exception applies. The one Handova relies on is consent given by a competent person - a parent or legal guardian - which is the same person who creates and manages the record in the parent portal.

• A child has no account and cannot sign in.
• A child’s record is visible only to staff at that child’s school and to their linked guardians - never to another institution, and not to every member of staff at a group with several schools.
• Identity document contents are not displayed in the interface. Staff see the type, who submitted it and when - enough to make a decision without exposing an ID number.
• A child’s information is used for nothing other than running the pickup service.

5. Your rights as a data subject

Under POPIA you may have the right to:

• Be told what personal information is held about you and why.
• Access the personal information held about you.
• Have incorrect, outdated or incomplete information corrected.
• Request that information be deleted or destroyed once there is no longer a lawful reason to keep it.
• Object to processing that is based on legitimate interest, and to direct marketing at any time.

Ask your institution first - as the responsible party they hold the record and can act straight away. If you would rather come to us, write to privacy@handova.mphahleleunlimited.co.za; we will pass the request to the institution and support them in answering it, normally within 30 days.

6. Direct marketing and automated decisions

We do not send direct marketing based on information collected to run the pickup service, and we do not use that information to make an automated decision that would have a legal or similarly significant effect on anyone - no algorithm decides whether a person may collect a child. A staff member checks and decides, every time.

7. Sending information outside South Africa

Handova is built and operated for South African institutions. Where a service we rely on to run the product (hosting, or sending email once that exists) involves a cross-border transfer, POPIA requires that the receiving party be subject to a comparable standard of protection, or that another basis in the Act applies. Hosting has not been finalised while the product is still in development; this section will name the actual arrangement, not a general promise, once it is decided.

8. Information Officer

POPIA requires every responsible party and operator to have an Information Officer, registered with the Information Regulator, responsible for compliance. Handova has not yet appointed and registered one - the product has not launched. Until that registration exists, direct any POPIA question to privacy@handova.mphahleleunlimited.co.za, and this section will be updated with the registered Information Officer’s details before launch.

9. Complaining to the Information Regulator

If you believe your personal information has been processed unlawfully and are not satisfied with how an institution or Handova has responded, you may complain to South Africa’s Information Regulator, the body POPIA establishes to enforce it. Their website, inforegulator.org.za, has their current contact details and complaint process - named here rather than a phone number or address we might let go out of date.

10. Contact

POPIA and privacy questions: privacy@handova.mphahleleunlimited.co.za
The fuller picture of what we collect: Privacy Notice
Anything else: our contact form