Legal
Privacy Policy
Last updated: June 2026
1. Introduction
SproutDesk ("we", "us", "our") is committed to protecting the privacy and personal information of all users of our platform, including school administrators, teachers, and the children and families whose data is managed through our system. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) of the Republic of South Africa.
By using SproutDesk, you acknowledge that you have read and understood this policy. If you have any questions, please contact us at info@sproutdesk.co.za.
2. Who We Are
SproutDesk is an early childhood development (ECD) assessment and management platform designed for South African nursery and pre-primary schools. We act as the Responsible Party in respect of personal information processed through the SproutDesk platform, as contemplated in POPIA. Individual schools that use SproutDesk to manage their learner data act as Operators on behalf of themselves and the families they serve.
3. What Personal Information We Collect
We collect and process the following categories of personal information:
- School administrators and teachers: name, email address, role, and school affiliation.
- Learners (children): first name, surname, date of birth, class group, and developmental assessment results.
- Parents and guardians: name, relationship to child, contact number, email address, residential address, and employer information (where provided).
- Usage data: log-in times, actions taken within the platform, and browser/device information for security and support purposes.
We do not collect financial information directly. Payment processing is handled by a third-party payment provider (PayFast) subject to their own privacy policy.
4. Why We Collect Personal Information
We collect and process personal information for the following purposes:
- To provide and operate the SproutDesk platform and its features.
- To generate developmental progress reports for individual learners.
- To communicate reports and important notices to parents and guardians.
- To manage school accounts, subscriptions, and user access.
- To improve the platform and provide customer support.
- To comply with applicable laws and regulations.
5. Children's Information
SproutDesk processes personal information relating to children, which is considered special personal information under POPIA. We only process children's information as directed by the schools that use our platform, and only for the purposes of developmental assessment and reporting. Schools are responsible for obtaining appropriate consent from parents or legal guardians before entering children's information into the SproutDesk system.
6. How We Store and Protect Your Information
All data is stored securely using Supabase, hosted on Amazon Web Services (AWS) infrastructure in the European Union (Ireland). The EU operates under the General Data Protection Regulation (GDPR), which meets or exceeds the standards required by POPIA for cross-border data transfers.
We employ the following measures to protect your information:
- Encryption of data in transit (TLS/HTTPS) and at rest.
- Row-level security on all database tables, ensuring each school can only access its own data.
- Secure authentication with email and password.
- Access controls restricting data to authorised users only.
- Regular security reviews and updates.
7. Sharing of Personal Information
We do not sell, rent, or trade personal information. We may share personal information only in the following circumstances:
- With the school: school staff with appropriate access roles can view learner and family information for that school only.
- With parents: progress reports are sent to parent email addresses on file, as directed by the school.
- With service providers: we use Supabase (data storage), Resend (email delivery), and PayFast (payment processing). Each is bound by appropriate data processing agreements.
- If required by law: we may disclose information where required by a court order or applicable law.
8. Your Rights Under POPIA
Under POPIA, you have the right to:
- Request access to personal information we hold about you.
- Request correction or deletion of inaccurate or outdated information.
- Object to the processing of your personal information.
- Lodge a complaint with the Information Regulator of South Africa.
To exercise any of these rights, please contact us at info@sproutdesk.co.za. We will respond within a reasonable time and no later than 30 days.
9. Data Retention
We retain personal information for as long as a school maintains an active subscription with SproutDesk, and for a reasonable period thereafter to comply with legal obligations. Schools may request deletion of their data by contacting us at info@sproutdesk.co.za.
10. Cookies
SproutDesk uses essential cookies only — these are required for authentication and to keep you logged in. We do not use tracking, advertising, or analytics cookies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify schools of material changes via email and update the "Last updated" date at the top of this page.
12. Contact Us
For any privacy-related queries or requests, please contact:
SproutDesk
Email: info@sproutdesk.co.za