Privacy policy

Last updated: 13 September 2026

1. Purpose and scope

Study With Sadie respects the privacy of parents, guardians, learners, website

visitors and other people who communicate with us. This Privacy Policy explains

how we collect, use, store, share and protect personal information in accordance

with the Protection of Personal Information Act 4 of 2013 (POPIA).

It applies to the Study With Sadie website, public enquiries,

onboarding and the personal information processed while providing academic

support. A more specific notice or signed agreement may also apply at a later

stage. If so, it should be read with this Policy.

2. Responsible party and Information Officer

The responsible party is Sadie Krueger, trading as Study

With Sadie.

Registration number: Not applicable - sole proprietor

Business address: Hillside Farm, Old Sir Lowry's Pass Road, Helderberg Rural,

South Africa

Address for service of legal documents: Hillside Farm, Old Sir Lowry's Pass Road, Helderberg Rural, South Africa

Information Officer: Sadie Kruger

Email: info@studywithsadie.co.za

Telephone: +27 76 540 0692

The Information Officer deals with privacy questions, objections, requests for

access or correction and complaints about our processing.

3. Whose information we process

We may process personal information relating to:

• parents, guardians and other competent persons;

• prospective and enrolled learners, including children under 18;

• adult learners;

• website visitors and people who contact us;

• authorised staff, tutors, contractors and service providers; and

• another person whose information is lawfully supplied for a defined purpose.

The public enquiry form is intended for a competent adult and should not be

completed directly by a child.

4. Information we collect

Depending on the stage of the relationship and what is necessary, we may

collect:

Website and enquiry information

• your name and email address, which are required to respond to an enquiry;

• an optional telephone number and message of up to 180 characters;

• your consent to using these details to respond to the enquiry;

• IP address, browser/device information, security events and website usage;

and

• information processed by embedded Google Maps, as described in the Cookie Policy. No analytics service is installed.

Later intake and service information

If an enquiry progresses and the information is necessary, we may separately

collect:

• learner name, date of birth or exact age and parent/guardian relationship;

• contact, attendance, scheduling and emergency-contact information;

• education history, curriculum, goals, assessments, progress, tutor feedback

and support plans;

• parent agreements, application or indemnity records and consent evidence;

• billing, payment and transaction records; and

• communications about the learner and service; and

• photographs, video, learner work or testimonials only where a separate,

appropriate permission exists for the intended use.

Sensitive and special personal information

Information about health, disability, neurodivergence, learning needs or an

academic report may reveal sensitive or special personal information. It must

not be submitted through the public enquiry form.

We will request such information later only if it is genuinely necessary to

assess or provide appropriate support, after giving a specific notice and

establishing an appropriate lawful basis. Access will be restricted and the

information treated as confidential.

5. Sources of information

We normally collect information directly from the person concerned or, for a

child, from the parent, guardian or other competent person. We may also create

records while providing the service, such as attendance, assessments and

progress notes.

Where appropriate and authorised, information may come from the learner, an

education provider, a professional, an educational platform or another person

identified by the parent or guardian. We will take reasonable steps to ensure

the source and collection are lawful and transparent.

6. Children's personal information

POPIA generally prohibits processing a child's personal information unless an

authorisation in section 35 applies. Where we rely on consent, Study With Sadie

will obtain prior consent from a competent person who is legally able to make

the relevant decision for the child.

The public form collects the adult submitter’s contact details and privacy consent; it does not verify parental authority or obtain consent to process a child’s sensitive information. Authority and any required child-specific consent must be established separately before later intake. Consent

must be voluntary, specific and informed and may be withdrawn, although

withdrawal does not invalidate earlier lawful processing. We may rely on

another lawful authorisation where legislation permits or requires it and will

document that basis.

For a learner who is legally able to make the relevant decision, including an

adult learner, we will obtain information and consent from that learner where

appropriate.

7. Why we process information and our lawful bases

We process personal information only where adequate, relevant and not excessive

for a defined purpose. Purposes may include:

• responding to and administering enquiries;

• verifying the parent or guardian before collecting additional child

information;

• assessing whether a programme may be suitable and available;

• completing onboarding and entering into or performing a service agreement;

• preparing lessons, assessments, support plans and progress feedback;

• communicating with parents, guardians and learners;

• publishing an identifiable learner image, work or testimonial only for the

specific use covered by separate consent;

• scheduling, billing, accounting and record keeping;

• protecting learners, users, systems and information;

• preventing spam, fraud, misuse and security incidents;

• complying with legal and regulatory obligations and responding to lawful

requests; and

• sending marketing only where consent exists or the communication is otherwise

permitted by law.

Depending on the processing, our lawful basis may be consent; prior consent of

a competent person for child information; steps requested before entering into

or performing a contract; compliance with a legal obligation; protection of a

legitimate interest of the learner or another person; or pursuit of a legitimate

interest of Study With Sadie or a third party where the person's privacy rights

do not override that interest.

8. Required and voluntary information

Public-form fields marked as required are needed to respond to or assess the

enquiry. Other fields are voluntary. If required information is not supplied,

we may be unable to respond, assess suitability, complete onboarding or provide

the requested service.

We will explain any later field that is required by law or contract and the

consequence of not providing it. Please do not provide information that we have

not requested or that is not relevant to the stated purpose.

9. Sharing and operators

We do not sell personal information.

We may share only what is necessary with:

• authorised Study With Sadie staff, tutors and contractors;

• Hetzner infrastructure managed through Coolify for this website;

• hosting and website-security services used to operate the site; technical request data may be processed by the hosting infrastructure;

• Google Maps, which loads automatically on the homepage and may process IP addresses, browser information and cookies;

• Resend for delivering enquiry emails to Study With Sadie;

• Cloudflare Turnstile for spam protection on the enquiry form;

• educational, communications, scheduling, payment or document services chosen

for an agreed service workflow;

• accountants, legal advisers and other professional advisers subject to

appropriate confidentiality obligations;

• a regulator, court, law-enforcement body or other authority where disclosure

is required or permitted by law; and

• another party where the competent person or data subject has authorised the

disclosure.

Where a service provider processes information for us as an operator, we will

require appropriate confidentiality and security safeguards. A provider may

not use the information for an unrelated purpose merely because it has access.

10. Cross-border processing

Some technology providers may process or support information from countries

outside South Africa. We will transfer personal information across borders only

where section 72 of POPIA permits it, for example where the recipient is subject

to an adequate protection requirement, an appropriate agreement protects the

information, consent has been obtained, or the transfer is otherwise necessary

and permitted by law.

11. Cookies, analytics and external content

The website has no installed analytics or advertising pixels. Google Maps loads automatically near the location section and may use third-party cookies. There is no on-site cookie preference control. Details and browser controls are described in the Cookie Policy.

Cloudflare Turnstile helps distinguish legitimate submissions from abuse. Links, embedded content and third-party services may be

subject to the third party's own privacy notice.

12. Security

We use appropriate, reasonable technical and organisational measures designed

to protect personal information against loss, damage, unauthorised destruction,

unlawful access or unlawful processing. These measures include risk assessment,

access restriction, authentication, software maintenance, secure transmission,

controlled backups, staff confidentiality and incident-response procedures as

appropriate to the risk.

No internet or storage system is risk-free. We therefore review safeguards and

update them in response to material risks or deficiencies.

Sensitive learner documents, if required during later onboarding, should be

collected through authenticated private storage and not a public website

media URL. Staff notifications should contain a secure link rather than the

document as an email attachment.

13. Retention and deletion

We keep personal information only for as long as necessary for the purpose for

which it was collected, or as required or authorised by law, contract or a

documented operational need.

• If a public enquiry does not lead to enrolment, we aim to delete or

de-identify it within 90 days after the last meaningful contact, unless a

complaint, legal requirement or agreed follow-up requires limited retention.

• Information used for an active service is retained while needed to provide

the service and afterwards only for the applicable legal, financial,

safeguarding, dispute or record-keeping period.

• Sensitive information and reports that are no longer necessary for support

will be deleted or de-identified as soon as reasonably practicable.

• Consent and request records may be retained for as long as reasonably needed

to demonstrate compliance or resolve a dispute.

• Backup copies are protected and removed through the applicable backup

lifecycle rather than reused for an unrelated purpose.

When information is no longer authorised for retention, it will be destroyed,

deleted or de-identified in a manner intended to prevent reconstruction.

14. Your rights

Subject to POPIA and PAIA, a data subject or competent person acting for a child

may:

• ask whether we hold personal information and request access to it;

• ask us to correct, update, delete or destroy information that is inaccurate,

irrelevant, excessive, out of date, incomplete, misleading, unlawfully

obtained or no longer authorised to be retained;

• object to processing on grounds permitted by law;

• withdraw consent, where processing relies on consent;

• object to direct marketing and unsubscribe at any time; and

• lodge a complaint with the Information Regulator.

To exercise a right, contact the Information Officer using the details above.

We may need to verify identity or authority before disclosing or changing

information. We will respond in accordance with applicable law and explain any

lawful ground for refusal.

15. Direct marketing

Submitting an enquiry or accepting a privacy notice is not blanket marketing

consent. Where consent is required, marketing consent will be requested

separately and will be optional. Every electronic marketing message will provide

a reasonable way to opt out.

Service, safety, scheduling, billing and enquiry-response communications are

not marketing merely because they are sent electronically.

16. Automated decisions

Study With Sadie does not currently make a decision that has legal or similarly

significant effects on a learner solely through automated processing. Automation

may route an enquiry, send an acknowledgement or invite a parent to the next

stage, but a person remains responsible for suitability and enrolment decisions.

We will update this Policy and implement required safeguards if that changes.

17. Security compromises

Where there are reasonable grounds to believe that personal information has

been accessed or acquired by an unauthorised person, we will investigate,

contain and document the incident and notify the Information Regulator and

affected data subjects as required by POPIA. Operators must notify us promptly

of a relevant compromise affecting information processed for Study With Sadie.

18. Other websites

This Policy does not control an external website merely because we link to it.

Please review the external provider's privacy notice before supplying personal

information.

19. Changes to this Policy

We may update this Policy to reflect changes in processing, services, providers

or law. The latest version and effective date will be published on this page. A

material new purpose will not be treated as authorised merely because the

Policy was updated; we will provide further notice or obtain consent where

required.

20. Complaints and regulator contact

Please contact Sadie Kruger first so that we can investigate and respond: