This Data Processing Agreement ("DPA") is entered into between the school ("School" or "Data Responsible Party") and CronKode (Pty) Ltd ("CronKode" or "Data Operator"), in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).
This DPA governs the processing of personal information by CronKode on behalf of the School through the Learnr platform. CronKode processes personal information solely for the purpose of providing the Learnr school management service, on documented instructions from the School, and in accordance with POPIA.
| Category | Examples |
|---|---|
| Learner identity | Full name, student number, grade, class group |
| Academic records | Marks, assessments, homework, attendance |
| Behaviour records | Incidents, commendations, observations |
| Financial records | Fee accounts, payment records, bursary status |
| Parent/guardian information | Name, contact details, relationship to learner |
| Staff information | Name, role, contact details, teaching assignments |
The School agrees to: obtain informed consent from parents/guardians before entering learner data; inform data subjects about how their information is processed; ensure only authorised personnel have access; maintain a register of information processed as required by POPIA Section 17; and not instruct CronKode to process personal information in violation of POPIA.
CronKode agrees to: process personal information only on the School's documented instructions; implement appropriate security measures including TLS encryption, row-level security, and role-based access control; not transfer personal information outside of adequately protected jurisdictions; notify the School within 72 hours of any personal information breach; and assist the School in responding to data subject requests.
| Sub-Processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | Ireland, EU (eu-west-1) |
| Vercel Inc. | Web application hosting | International CDN |
| Google LLC (FCM) | Push notification delivery | International |
| Data Type | Retention Period | Reason |
|---|---|---|
| Learner academic records | 7 years after learner leaves | DBE requirement |
| Financial transaction records | 7 years from transaction date | SA legal requirement |
| Behaviour records | 7 years after learner leaves | Legal record |
| Staff and parent accounts | Duration of Agreement + 1 year | Operational |
| Technical logs | 90 days | Security monitoring |
Note: Financial transaction records are immutable by design — this is a deliberate technical and legal safeguard and cannot be overridden.
CronKode will assist the School in responding to data subject requests under POPIA within 30 days. Financial records, behaviour records and audit logs are exempt from deletion due to legal requirements.
CronKode Information Officer: Refiloe Seutloali
hello@learnr.co.za · Free State, South Africa
Information Regulator: inforegulator.org.za