Privacy Notice - Handova

1. Who is responsible for what

The institution decides what information to hold about the children and families in its care. Handova holds and processes it on the institution’s instructions.

In data-protection terms the institution is the controller and Handova is the processor. If you are a parent asking what is held about your child, ask your school first - they decide, and they can act immediately.

2. What we collect

About staff

Name, work email, phone number.
Which schools they can access and their role at each.
A record of the actions they take: approvals, rejections, verified pickups.

About parents and guardians

Name, email address, phone number.
Which children they are linked to.
The pickup authorisations they create.

About children

Name, class or group, date of birth, enrolment date.
Who is authorised to collect them, and when.
A record of completed pickups and flagged attempts.

About pickup people

Name, relationship to the child, contact details.
Any supporting documents a parent submits.

Technical

Sign-in times, IP address and browser, to keep accounts secure and warn you about a sign-in from a new device.
A random device identifier your browser keeps for Handova, so we can recognise your own phone or computer. It is not built from your device’s hardware, and clearing this site’s data resets it.
If you add a passkey, its public key only. Your fingerprint, face or PIN never leaves your device.
Basic error and performance information.

3. Children’s information

This is the most sensitive information Handova holds, and it is treated that way.

A child’s record is visible only to staff at that child’s school and to their linked guardians.
A group with several schools does not mean staff see every child - access is per school.
Children have no accounts and cannot sign in.
We do not use children’s information for anything other than running the pickup service.
Identity document contents are not displayed in the interface. Staff see the type, who submitted it and when - enough to make a decision without exposing an ID number.

4. Why we hold it

To let a parent record who may collect their child, to let staff check that at the door, and to keep a record of what happened. That is the whole purpose.

We do not sell personal information. We do not use it for advertising. We do not use it to train machine-learning models.

5. Who can see it

Staff at the child’s school, according to their role.
Linked guardians, for their own children only.
Service providers that host or send email for us, under contract and only as needed.
Authorities, where the law requires it - and we will tell the institution unless we are prohibited from doing so.

Institutions are separated from each other. No organisation can see another organisation’s records.

6. How long we keep it

Authorisation history is append-only while the account is open - changes are kept, not overwritten, because the record is the point.
Pickup records are kept for as long as the institution needs them, and the institution sets that period.
Supporting documents are deleted when the authorisation they belong to is deleted.
Handover photos and signatures are deleted after the period the institution sets (12 months unless it chooses otherwise). The pickup record itself stays.
Sign-in records (times, IP address, browser, device identifier) are deleted after 12 months.
Notifications are deleted after 12 months, and records of the emails and messages we sent after 90 days.
The IP address and browser recorded with an enquiry from this website are removed after 6 months.
Encrypted backups are kept for 30 days, then deleted. Anyone erased before a backup is restored stays erased.
Everything is deleted 30 days after an account closes, except what we must keep by law.

These deletions run automatically every night.

7. Your rights

Depending on where you live you may have the right to access, correct, delete, export or object to the use of your information.

Ask your institution first - they control the record and can act straight away. If you would rather come to us, write to privacy@handova.mphahleleunlimited.co.za. We will pass the request to the institution and support them in answering it, normally within 30 days.

8. Cookies

We keep this short because our use of cookies is short.

Essential - keeping you signed in and remembering which school you are viewing. These cannot be switched off without breaking the product.
Preferences - small choices such as a dismissed banner.
Analytics - anonymous counts of which pages are used, only if you accept. Declining changes nothing about how the product works.

There are no advertising cookies and no third-party trackers. You can change your choice at any time from the link in the footer, or by clearing site data in your browser.

9. Contact

Privacy questions: privacy@handova.mphahleleunlimited.co.za
Anything else: our contact form

If you are not satisfied with our response you can complain to your local data protection authority.