Parental Consent & Data Processing
Document reference: BNA-POPIA-CPF-v1.1 — Effective [add date]
Important notice to parents and legal guardians
Under Section 34/35 of South Africa's Protection of Personal Information Act (POPIA), processing a child's (anyone under 18) personal information requires the consent of a parent or legal guardian. Because every learner on this platform is in Grades 8 to 12, this consent is collected as a mandatory part of every student registration — not as an optional or age-conditional step.
1. Identifying parties
- Responsible party (data controller): BNA STEM Academy
- Operator (data processor): KMHG Web Solutions, the platform's developer and technical maintainer
- Data subject (student): the minor learner (Grades 8–12) using the platform
- Consenting party (guardian): the learner's parent or legal guardian
2. Information we process
| Category | Fields | Purpose |
|---|---|---|
| Learner identity | Full name, date of birth, grade, South African ID number | Account creation, identity verification, grade-appropriate content |
| Learner contact | Email, phone number | Login, session recovery, class notifications |
| Parent/guardian | Full name, ID/passport number, email, phone, relationship to learner | Consent verification and an auditable consent record |
| Academic performance | Subject enrollments, homework, quiz responses and scores, tutor feedback | Tracking progress and delivering tutoring support |
| Technical/security | Login timestamps, IP address, session identifiers | Preventing unauthorized access and keeping accounts isolated from each other |
3. Technical safeguards actually in place
- Password hashing: passwords are hashed with bcrypt at 12 rounds. Raw passwords are never stored.
- Signed sessions: login sessions use cryptographically signed, HTTP-only, SameSite=Lax cookies — signed so a session token can't be forged, and HTTP-only so page scripts can't read them.
- Parameterized database queries: the backend uses PostgreSQL with an ORM that parameterizes every query, preventing SQL injection.
- Role-based route isolation: middleware checks every request to student, tutor, and admin areas, so accounts can't reach data outside their own role.
- Data encrypted at rest: our database provider (Neon) encrypts stored data at rest by default.
4. Data retention and automatic erasure
In line with Section 14 of POPIA, we don't keep personal information longer than necessary:
- Active retention: data stays active for as long as the student is enrolled.
- Automatic erasure:if an account has no login and no active enrollment for 12 consecutive months, an automated job erases that student's homework submissions, quiz history, class attendance records, and personal identifiers (ID number, phone, date of birth). The account is deactivated rather than deleted outright, so administrative records stay consistent, but no identifying personal information about the student or their parent/guardian remains attached to it.
5. Your rights under POPIA
- Right of access: request a copy of everything we hold about your child.
- Right to rectification: request correction of inaccurate information.
- Right to object: object to processing on reasonable grounds.
- Right to erasure: request your child's data be permanently removed.
- Right to withdraw consent: withdraw consent at any time — this ends portal access immediately.
To exercise any of these rights, email support@bnastemacademy.co.za.
6. How consent is given
Consent isn't collected on paper — it's captured digitally as a required step during student registration. A parent or legal guardian must provide their name, ID or passport number, contact details, and relationship to the learner, and explicitly check a consent box before registration can complete. We record the date, time, IP address, and browser used to give consent, as an auditable trail.
Contact
Email: support@bnastemacademy.co.za
Phone: 067 025 1855