Privacy policy

Last updated: 26 May 2026

1. Who we are

TutorPool is the “responsible party” (data controller) for the personal information described in this policy. Our Information Officer registered with the Information Regulator is:

• Name: Success Shibambu
• Role: Information Officer
• Company: TutorPool (Pty) Ltd
• Email: privacy@tutorpool.co.za
• Phone: +27 (0) 11 000 0000
• Address: [Registered office address — update before launch]

2. The personal information we collect

We collect the following categories of personal information:

2.1 From students and parents

• Identity: full name, date of birth, gender (optional), profile photo (optional).
• Contact: email address, mobile number, optional physical address.
• Education: grade, school, subjects you want tutoring in, learning goals, special needs (if you choose to share).
• Payment: card last-4 digits, billing name, billing address. We never see or store full card numbers — Peach Payments handles those directly.
• Usage: pages visited, tutors viewed, bookings made, lesson recordings (if you opt in), in-app messages.
• Technical: IP address, device type, browser, approximate location from IP.

2.2 From tutors

• Everything in 2.1 above, plus:
• ID document or passport (for KYC verification).
• Educational qualifications, degree certificates, references.
• SACE registration number (if applicable).
• Bank account details (for payouts).
• Tax reference number (for SARS reporting).
• Background-check results (where you have consented to one).

2.3 From minors (under 18)

We process personal information of minor learners only with the explicit consent of a competent parent or legal guardian (POPIA Section 35). When a parent adds a child to their TutorPool account, we capture the consent decision with a timestamp, IP address, and a snapshot of this policy version, all of which are stored in our consent log for audit purposes.

3. Why we collect it (purposes)

We use your personal information only for the following specific purposes:

• To match students with suitable tutors (subject, grade, budget, location).
• To process bookings and payments.
• To send booking confirmations, reminders, and lesson outcomes (email, WhatsApp, in-app).
• To enable in-app messaging between students/parents and tutors.
• To verify tutors’ identity, qualifications, and bank details.
• To pay tutors via EFT for completed lessons.
• To respond to support requests, complaints, and refund requests.
• To comply with legal obligations (SARS, FICA, anti-fraud).
• To improve our service, with your consent (analytics).
• To send you marketing communications, only with your consent (which you can withdraw at any time).

4. The lawful basis for processing

Under POPIA Section 11, we rely on the following grounds:

• Consent — for marketing, analytics, optional profile fields, processing minors’ data.
• Performance of a contract — to deliver tutoring services you’ve booked.
• Legal obligation — to comply with FICA, SARS, and other South African laws.
• Legitimate interest — to prevent fraud, secure our systems, and maintain audit trails.

5. Who we share your information with

We share personal information only with the parties below, and only as needed:

All international transfers are protected by either (a) the recipient country having an adequate level of protection comparable to POPIA, or (b) contractually binding data processing agreements (per POPIA Section 72).

We do not sell your personal information to anyone.

6. How long we keep your data

We retain personal information only for as long as we need it:

• Account data: while your account is active, plus 7 years after closure (FICA + SARS requirements).
• Lesson records and invoices: 7 years (Companies Act + tax law).
• Marketing consent: until you withdraw it.
• Cookie consent: 1 year, then we re-prompt.
• KYC documents: 5 years after end of relationship (FICA Section 42).
• Support tickets: 3 years.
• Analytics: aggregated and anonymised after 26 months.

7. Your rights under POPIA

POPIA gives you the following rights. You can exercise any of them by emailing us at privacy@tutorpool.co.za or using our data request form:

• Right of access (Section 23): request a copy of all personal information we hold about you.
• Right to correction (Section 24): ask us to fix inaccurate or outdated information.
• Right to deletion (Section 24): ask us to delete your information, unless we’re legally required to retain it.
• Right to object (Section 11(3)): object to processing on grounds related to your particular situation.
• Right to withdraw consent: where we relied on consent, withdraw it at any time. Withdrawing consent does not affect the lawfulness of prior processing.
• Right to lodge a complaint: with the Information Regulator (see Section 11 below).

We respond to data subject requests within 30 days as required by POPIA Section 23(5). For complex requests we may extend this once, and will tell you in writing.

8. Security

We protect your information with industry-standard security controls:

• All connections to TutorPool use HTTPS (TLS 1.2+).
• Database is encrypted at rest.
• Passwords are hashed with bcrypt — we cannot see your password.
• Payment card numbers never touch our servers.
• Row-level security in our database restricts access to your data based on who you are.
• Sensitive operations (admin access, payouts) require additional authentication.
• We monitor for unusual activity and notify you of suspicious sign-ins.

If we ever discover a security breach affecting your personal information, we will notify you and the Information Regulator without undue delay, as required by POPIA Section 22.

9. Cookies and similar technologies

We use cookies to keep you logged in, remember your preferences, and (with your consent) to measure how the site is used and to show relevant ads. See our Cookie policy for the full list and how to opt out.

10. Children’s privacy

TutorPool is not intended for use by anyone under 18 without parental or guardian supervision. We process minors’ personal information only with the explicit, recorded consent of a competent person (POPIA Section 35), captured at the time the parent or guardian adds the child to their account.

Parents and guardians can withdraw consent at any time by emailing the Information Officer above, which will trigger deletion or anonymisation of the child’s data within 30 days.

11. Complaints

If you believe we have not handled your personal information in line with POPIA, please contact our Information Officer first so we can try to resolve the issue. You always have the right to lodge a complaint directly with the Information Regulator:

• Name: Information Regulator (South Africa)
• Website: https://inforegulator.org.za
• Email: POPIAComplaints@inforegulator.org.za
• Phone: +27 10 023 5200

12. Changes to this policy

We may update this policy from time to time. When we do, we will publish the new version with an updated effective date and ask you to re-accept on your next login (for material changes). Significant changes will also be communicated by email.