Operator (Data Processing) Agreement

The school is the responsible party for its learner and guardian personal information and its messaging decisions. SyncPoint acts as the operator, processing that information on the school's behalf to provide the service. This agreement does not apply to processing where SyncPoint acts as a responsible party (for example securing and running the platform, fraud prevention, and billing).

SyncPoint processes school personal information only to provide and support the service and in accordance with the school's documented instructions, which include this agreement, the Privacy Policy, the settings and actions the school takes in the app, and any further lawful written instructions. If we believe an instruction is unlawful, we will inform the school.

Subject matter & duration: delivery of SMS notices for the duration of the school's use of the service. Nature & purpose: storing contact records and transmitting messages (the purpose of processing is school communication). Categories of data subjects: learners and their guardians, and school staff users. Types of data: names, grade/class, optional admission number, guardian phone numbers, message content and delivery status.

SyncPoint keeps school personal information confidential and ensures that personnel authorised to process it are bound by appropriate confidentiality obligations and only access data on a need-to-know basis.

SyncPoint maintains appropriate technical and organisational measures, including:

• per-school data isolation enforced at the database layer (row-level security);
• encryption of data in transit and at rest;
• role-based access with administrator approval and leaked-password protection;
• data minimisation that excludes sensitive learner fields from import;
• audit logging of sensitive administrative actions and data exports; and
• automated tests that verify one school cannot access another school's data.

The school authorises SyncPoint to engage subprocessors to provide the service — currently managed cloud hosting and database providers, and an SMS delivery provider (BulkSMS). SyncPoint imposes data protection obligations on subprocessors consistent with this agreement and remains responsible for their performance. We will give schools reasonable notice of changes to subprocessors.

Taking into account the nature of the processing, SyncPoint will provide reasonable assistance to help the school meet its obligations, including responding to data-subject requests (access, correction, deletion, objection) — the platform includes tools for schools to receive, log and act on such requests — and supporting the school's security and impact-assessment duties.

SyncPoint maintains a documented incident process. On becoming aware of a security compromise affecting a school's personal information, SyncPoint will notify the affected school without undue delay, provide the information reasonably available to help the school assess and meet its own notification obligations, and take reasonable steps to contain and remediate the incident.

SyncPoint retains school personal information for as long as the school uses the service, or for a shorter period where the school instructs deletion, subject to any retention required by law. Retention periods are described in the Privacy Policy.

On termination or account closure, SyncPoint will, at the school's choice and request, provide an export of the school's personal information in a portable format and then delete it from active systems within a reasonable period, except where continued retention is required by law. Backups age out on their normal cycle.

For matters under this agreement, contact SyncPoint Digital Solutions (Pty) Ltd at info@syncpointsolutions.co.za.