Privacy Policy

POPIA Compliance Notice: This Privacy Policy is designed to comply with the Protection of Personal Information Act 4 of 2013 (POPIA). We are committed to protecting your personal information and respecting your privacy rights.

1. Introduction

Smartnote ("we", "us", "our") respects your privacy and is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African data protection laws.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or purchase our educational products.

2. Information Regulator Details

The Information Regulator of South Africa oversees compliance with POPIA. Their contact details are:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
P.O Box 31533, Braamfontein, Johannesburg, 2017
Tel: +27 (0) 10 023 5200
Email: inforeg@justice.gov.za
Website: www.justice.gov.za/inforeg

3. Responsible Party Information

For purposes of POPIA, Smartnote is the Responsible Party in respect of personal information collected through our website and services.

4. What Personal Information We Collect

We collect and process the following categories of personal information:

4.1 Information You Provide Directly

Contact Information: Name, email address, phone number (if provided)
Payment Information: Billing details (processed securely by our payment provider)
Purchase Information: Products purchased, transaction history
Communication Records: Records of correspondence with us, including support inquiries
Account Information: Login credentials if we implement user accounts (currently not applicable)

4.2 Information Collected Automatically

Technical Information: IP address, browser type, device information, operating system
Usage Data: Pages visited, time spent on website, referral source
Cookies and Similar Technologies: Information collected through cookies (see Cookie Policy below)

4.3 Information from Third Parties

Payment Processors: Transaction confirmation and payment status from Paystack
Analytics Providers: Aggregated usage statistics (if applicable)

5. How We Use Your Personal Information

We process your personal information for the following lawful purposes under POPIA:

Purpose	Legal Basis (POPIA)
Processing and fulfilling your orders	Contractual obligation / Consent
Delivering digital products via email	Contractual obligation
Processing payments	Contractual obligation
Providing customer support	Contractual obligation / Legitimate interest
Sending transactional emails (order confirmations, receipts)	Contractual obligation
Sending marketing communications (with consent)	Consent
Improving our website and services	Legitimate interest
Detecting and preventing fraud	Legitimate interest / Legal obligation
Complying with legal obligations	Legal obligation

5.1 Marketing Communications

We will only send you marketing communications if you have given us explicit consent. You can withdraw consent at any time by clicking the "unsubscribe" link in any marketing email.

Note: Unsubscribing from marketing does not affect transactional emails related to your purchases.

6. Legal Basis for Processing (POPIA Conditions)

Under POPIA, we ensure that personal information is:

Processed lawfully and reasonably: Only for specific, explicitly defined purposes
Collected for a specific purpose: We only collect information necessary for our services
Processed with consent: Where required, we obtain your explicit consent
Adequate, relevant, and not excessive: We only collect what is necessary
Accurate and up to date: We take steps to ensure accuracy
Retained appropriately: Not kept longer than necessary
Secured: Protected with appropriate safeguards

7. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

7.1 Service Providers (Operators)

We share information with trusted third-party service providers who assist us in operating our business:

Payment Processors: Paystack (for processing payments securely)
Email Service Providers: For sending order confirmations and communications
Cloud Hosting Providers: For website hosting and data storage
Analytics Services: For understanding website usage (if applicable)

These service providers are contractually bound to protect your information and use it only for the purposes we specify.

7.2 Legal Obligations

We may disclose your information when required by law, court order, or government regulation, or when necessary to:

Comply with legal processes
Protect our rights and property
Prevent fraud or illegal activity
Protect the safety of our users or the public

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred. We will notify you of any such change and provide options regarding your information.

8. International Data Transfers

Some of our service providers may be located outside of South Africa. When we transfer personal information internationally, we ensure that:

The recipient country has adequate data protection laws, or
We have appropriate contractual safeguards in place, or
We have obtained your explicit consent

All international transfers comply with Chapter 9 of POPIA.

9. Data Security

9.1 Security Measures

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, loss, destruction, or alteration, including:

Encryption of data in transit (SSL/TLS)
Secure payment processing through PCI-DSS compliant providers
Access controls and authentication
Regular security assessments
Employee confidentiality agreements

9.2 Data Breach Notification

In accordance with POPIA Section 22, if we become aware of a data breach that poses a risk to your rights and freedoms, we will:

Notify the Information Regulator as soon as reasonably possible
Notify affected data subjects where feasible
Provide details about the nature of the breach and remedial measures

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected:

Transaction Records: Retained for 5 years for accounting and tax purposes (as required by South African law)
Customer Support Records: Retained for 2 years after the last interaction
Marketing Consent Records: Retained until consent is withdrawn, then deleted
Website Usage Data: Typically retained for 12-24 months

After the retention period expires, we securely delete or anonymize your personal information.

11. Your Rights Under POPIA

Under POPIA, you have the following rights regarding your personal information:

11.1 Right of Access

You have the right to request confirmation of whether we hold your personal information and to access that information.

11.2 Right to Correction

You have the right to request correction or deletion of inaccurate, irrelevant, excessive, or outdated personal information.

11.3 Right to Deletion

You have the right to request deletion of your personal information where:

It is no longer necessary for the purpose it was collected
You withdraw consent (where consent was the basis for processing)
You object to processing and there are no overriding legitimate grounds
The information was unlawfully processed

11.4 Right to Object

You have the right to object to the processing of your personal information on reasonable grounds.

11.5 Right to Object to Direct Marketing

You have the right to object to your personal information being used for direct marketing purposes at any time.

11.6 Right to Data Portability

Where technically feasible, you have the right to receive your personal information in a structured, commonly used format.

11.7 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Regulator if you believe your privacy rights have been violated.

11.8 How to Exercise Your Rights

We will respond to your request within 30 days (or as otherwise required by law). We may request verification of your identity before processing certain requests.

12. Cookies and Tracking Technologies

12.1 What Are Cookies

Cookies are small text files stored on your device when you visit our website. They help us provide you with a better browsing experience.

12.2 Types of Cookies We Use

Essential Cookies: Necessary for website functionality (e.g., maintaining session state)
Analytics Cookies: Help us understand how visitors use our website (if applicable)
Marketing Cookies: Used to deliver relevant advertisements (only with your consent)

12.3 Cookie Consent

In compliance with POPIA, we will obtain your consent before using non-essential cookies. You can manage cookie preferences through your browser settings.

12.4 How to Control Cookies

Most browsers allow you to:

View and delete cookies
Block third-party cookies
Block cookies from specific websites
Block all cookies

Note: Blocking cookies may affect website functionality.

13. Children's Privacy

Our services are intended for students and their parents/guardians. While our educational products are designed for students aged 15-18, we do not knowingly collect personal information from children under 18 without parental consent.

Purchases must be made by:

Adults (18 years or older), or
Minors with explicit parental/guardian consent and supervision

If we discover that we have collected personal information from a child without proper consent, we will delete it promptly.

14. Third-Party Websites and Services

Our website may contain links to third-party websites. This Privacy Policy does not apply to those websites. We are not responsible for the privacy practices of third parties.

We recommend reviewing the privacy policies of any third-party websites you visit, including:

Payment processors (Paystack)
Social media platforms
External educational resources

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

Posting the updated policy on our website
Updating the "Last Updated" date
Sending an email notification for significant changes (if we have your email)

Your continued use of our services after changes indicates acceptance of the updated Privacy Policy.

16. Consent

By using our website and providing your personal information, you consent to the collection, use, and processing of your information as described in this Privacy Policy.

You may withdraw your consent at any time, subject to legal and contractual restrictions.

17. Complaints to the Information Regulator

If you believe your privacy rights have been violated, you may lodge a complaint with the Information Regulator:

Information Regulator (South Africa)
Email: inforeg@justice.gov.za
Tel: +27 (0) 10 023 5200
Website: www.justice.gov.za/inforeg

18. Language

This Privacy Policy is provided in English. If translated into other languages, the English version shall prevail in case of any conflict.

19. Governing Law

This Privacy Policy is governed by the laws of the Republic of South Africa, including POPIA and other applicable data protection legislation.