POPIA processing notice
Last updated 29 August 2026 · Version 1.0
This is the notice section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA") requires us to give you when we collect your personal information. It sits alongside our Privacy Policy, which covers the same ground in ordinary language; this page maps it to the Act.
1. The responsible party
- Responsible party
- Ellermon Holdings (Pty) Ltd
- Registration number
- 2026/561599/07
- Registered office
- 4 Westminster Avenue
Bryanston
Johannesburg
Gauteng, 2191
South Africa - Information Officer
- Michael Ian Rolle, Director
- admin@ellermon.com
Our Information Officer is appointed under section 55 of POPIA and is whose registration with the Information Regulator is in progress.
2. The information we collect, and from whom
| Data subject | Personal information | Source |
|---|---|---|
| Guardians (our users) | Email address, account identifier, display name, notification preferences, achievement scale settings, support correspondence | Directly from you |
| Learners (children) | First and last name, date of birth, school grade, school name, display colour, subjects, assessments and marks, calendar events and notes | Entered by the guardian, not collected from the child |
| Website visitors | None. This website sets no cookies and runs no analytics. | — |
| Correspondents | Name, email address, and the contents of your message | Directly from you |
Providing this information is voluntary, but GradeLens cannot work without it. If you do not want to provide a learner's details, you cannot track that learner's marks — there is no version of the app that does the job without the data.
3. Special personal information: children
Under section 34 of POPIA, personal information about a child is special personal information and may not be processed unless an exemption in section 35 applies. We rely on section 35(1)(a): processing carried out with the prior consent of a competent person. The guardian who creates the account is that competent person, and confirms this when adding each learner.
We process no other category of special personal information. We do not collect religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour.
A child's information is used only to show their own guardian their own child's progress. It is never used for advertising, profiling, marketing, or training machine learning models, and it is never sold. See our child safety standards.
4. Why we process it
To operate GradeLens: to authenticate you, store what you enter, calculate averages and projected term marks, show the family calendar, send the reminders you have asked for, keep the service secure and available, answer your requests, and meet our legal obligations. The full breakdown is in the Privacy Policy.
5. Our lawful justification
- Section 11(1)(a) — your consent, and section 35(1)(a) for children's information
- Section 11(1)(b) — necessary to perform our contract with you
- Section 11(1)(c) — compliance with a legal obligation
- Section 11(1)(f) — our legitimate interests in a secure, working service
6. Recipients
We do not sell personal information and we do not share it for anyone else's marketing. It is shared only with the operators who run our infrastructure, each bound by contract to process it solely on our instructions and to secure it: Amazon Web Services (AWS) for hosting and identity, and Apple and Google for app distribution and push delivery. We also disclose information where compelled by law. Full detail is in the Privacy Policy.
7. Cross-border transfers
Personal information is stored in the AWS Africa (Cape Town) region (af-south-1) — that is, in South Africa. We do not routinely transfer it out of the Republic.
Where a transfer does occur — push notification delivery through Apple's and Google's international networks, and email correspondence — we rely on section 72, on the basis that the transfer is necessary to perform the contract with you, that you have consented, or that the recipient is subject to laws or binding rules providing an adequate level of protection. A push notification carries only short reminder text; it never carries a mark.
8. Security safeguards
As section 19 requires, we secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures: encryption in transit and at rest, OAuth 2.0 with PKCE and secure token storage on the device, per-request authorisation checks, least-privilege access to production systems, logging, and automated dependency auditing. Our operators are bound by section 21 written contracts. Details are in the Privacy Policy and on our security page.
9. Retention
As section 14 requires, we keep personal information only as long as we need it. Your data lives until you delete it or your account becomes inactive for 24 months. Deletion is completed within 30 days, backups roll over within 35 days, and logs are kept for up to 90 days. The full table is in the Privacy Policy.
10. Your rights
Sections 23, 24 and 11(3) give you the right to:
- Be told whether we hold personal information about you, and to be given a copy
- Be told who has had access to it
- Have inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained information corrected or deleted
- Object, on reasonable grounds, to processing based on legitimate interests
- Object at any time to processing for direct marketing purposes
- Withdraw consent, without affecting processing that already lawfully occurred
- Not be subject to a decision based solely on automated processing that has legal consequences — we make no such decisions
- Complain to the Regulator, and to institute civil proceedings
To exercise any of these, see making a data request, or use the controls in the app.
11. Direct marketing
We do not send unsolicited electronic marketing. The only messages GradeLens sends are the reminders you switched on, and service messages such as a security notice or a change to these policies — which section 69 does not treat as direct marketing. You can turn reminders off in the app at any time.
12. Complaints
Please raise a concern with our Information Officer first, at admin@ellermon.com. You are entitled to go straight to the Regulator instead.
- Regulator
- Information Regulator (South Africa)
- Address
- JD House, 27 Stiemens Street
Braamfontein, Johannesburg, 2001
P.O Box 31533, Braamfontein, Johannesburg, 2017 - POPIA complaints
- POPIAComplaints@inforegulator.org.za
- General enquiries
- inforeg@inforegulator.org.za
- Website
- https://inforegulator.org.za