Wonderkind Privacy Policy

1. Introduction

Wonderkind is a school management platform operated by White Wolf Studio ZA (Pty) Ltd ("we", "us", "Wonderkind"), a company registered in South Africa. We provide schools with a platform to record observations, track learning journeys, manage attendance, generate term reports, and communicate with families.

This Privacy Policy explains how we collect, use, store, share, and protect personal information processed through Wonderkind, in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA).

2. Our Role Under POPIA

Wonderkind operates as an Operator under POPIA. This means schools using Wonderkind are the Responsible Party (data controller) for the personal information they collect about students, families, and staff. Wonderkind processes that information on the school's instructions, in accordance with a Data Processing Agreement signed with each school.

This distinction matters: questions about what data is collected, why, and who can access it are determined by your school. Questions about how the platform stores and protects the data are our responsibility.

3. Personal Information We Process

3.1 Information about staff and administrators

• Full name, email address, phone number
• Role within the school (teacher, admin, principal, support staff)
• School association and class assignments
• Account credentials and authentication data
• Activity logs and audit trails

3.2 Information about students (children)

• Full name, date of birth, age group, class enrolment
• Educational records: observations, learning journey entries, attendance, term reports
• Photos and media uploaded by authorised staff
• Developmental notes and Montessori-domain progress markers
• Optional: dietary, allergy, or safeguarding notes if entered by staff

3.3 Information about parents and guardians

• Full name, email address, phone number
• Relationship to enrolled student(s)
• Communication history with the school via Wonderkind
• Notification preferences and read receipts

3.4 Technical information

• Device type, browser, operating system
• IP address and approximate location (country/region only)
• Push notification tokens for device alerts
• Usage logs (page views, actions taken, timestamps)
• Crash reports and performance diagnostics

4. Children's Personal Information

Wonderkind processes the personal information of children under 18, which is specifically protected under Section 35 of POPIA.

We rely on the following lawful basis: consent given by a competent person (parent or legal guardian) at the time of school enrolment. Schools are responsible for obtaining and recording this consent before adding a student to Wonderkind.

We apply heightened protections to children's data:

• Access is strictly limited to authorised school staff and the child's linked guardians
• Children's data is never used for marketing, profiling, or advertising
• Photos and media are only visible to families linked to that specific child
• Children's data is never sold, shared, or licensed to any third party for commercial purposes
• Schools must withdraw a child's record from active processing within a reasonable time after the child leaves the school

If you are a parent or guardian and have concerns about your child's data, contact your school administrator first. If your concerns are not resolved, contact us at hello@wonderkind.co.za.

5. How We Use Personal Information

We process personal information to:

• Deliver the core platform features schools have subscribed to (observations, reports, messaging, attendance, learning journeys)
• Authenticate users and maintain account security
• Send opted-in notifications and platform alerts
• Maintain audit trails and traceability records as required by school operations and applicable law
• Diagnose technical problems and improve platform reliability and performance
• Comply with legal, regulatory, and safeguarding obligations

We do not use personal information for:

• Advertising or marketing to children or families
• Profiling, behavioural prediction, or AI training (we do not use your data to train AI models)
• Selling, renting, or licensing data to third parties
• Any purpose unrelated to delivering the Wonderkind service

6. Legal Basis for Processing

Our processing is grounded in the following POPIA conditions for lawful processing:

• Section 11(1)(a) – Consent: Where parents or guardians have consented to school participation in Wonderkind
• Section 11(1)(b) – Contractual necessity: Where processing is necessary to deliver the service the school has contracted us to provide
• Section 11(1)(c) – Legal obligation: Where processing is required to comply with applicable laws (e.g., safeguarding, education regulations)
• Section 11(1)(f) – Legitimate interests: For platform security, fraud prevention, and audit logging, where these interests do not override the rights of data subjects

7. Data Sharing and Sub-Processors

We share personal information only with:

7.1 Within the school community

• Authorised school staff (per role-based permissions)
• Linked parents and guardians (only for their own children)

7.2 Service providers (sub-processors)

We use carefully selected third-party services to operate Wonderkind. Each is bound by data protection agreements:

We do not share student or family personal information with payment providers — only school-level billing contact details are shared with Paystack.

7.3 Legal disclosure

We may disclose personal information if required by:

• A court order or lawful subpoena
• Law enforcement acting under proper legal authority
• A safeguarding obligation where a child may be at risk

We will notify the school as soon as legally permissible if such a disclosure is made.

8. International Data Transfers

Some of our sub-processors store data outside South Africa. Where this happens:

• We only use providers with adequate data protection standards comparable to POPIA
• Data transferred internationally remains encrypted in transit and at rest
• We do not transfer data to jurisdictions that lack legal protections for personal information

If your school requires data residency exclusively within South Africa, contact us to discuss our enterprise hosting options.

9. Data Security

We protect personal information through:

• Encryption in transit (TLS 1.2+) for all data transmitted between devices and our servers
• Encryption at rest for all stored personal information
• Role-based access control with school-scoped data isolation
• Multi-factor authentication available for staff accounts
• Audit logging of administrative actions
• Regular security reviews, penetration testing, and dependency monitoring
• Backup and disaster recovery procedures with encrypted offsite backups

While we apply industry-standard protections, no system is entirely secure. We continuously improve our security posture and respond to evolving threats.

10. Data Retention

When data is no longer required, we delete or anonymise it. Schools may instruct us to delete data sooner via the Data Processing Agreement.

11. Your Rights Under POPIA

11.1 Right of access (data export)

Sign in and open Profile → Privacy & your data → Request export. We email you a secure download link to a JSON file containing your personal data (profile, messages, observations, attendance, notifications, and more). Links expire after seven days and can only be opened while you are signed in.

11.2 Right of correction

You can update your profile information at any time from Profile → Personal information. For changes to records created by school staff (such as observations or attendance), please contact your school administrator.

11.3 Right of deletion

Open Profile → Privacy & your data → Schedule account deletion. Your account is queued for permanent deletion after a 30-day grace period. You can cancel the deletion at any point during the grace period by signing back in.

Please note: certain records (safeguarding logs, audit trails, financial records) may be retained after account deletion to the extent required by law or school policy. Where retained, they are anonymised or pseudonymised wherever practical.

11.4 Right to object to processing

You can object to processing of your personal information for purposes other than those described in this policy. Submit objections to hello@wonderkind.co.za.

11.5 Right to lodge a complaint

If you are unhappy with how Wonderkind has handled your personal data:

1. First, contact your school administrator
2. If unresolved, contact our Information Officer at dhash@whitewolfstudio.co.za
3. If still unresolved, lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za or by emailing complaints.IR@justice.gov.za

12. Cookies and Tracking

Wonderkind uses minimal cookies and similar technologies, limited to:

• Essential cookies: Required for authentication and security (e.g., session tokens)
• Functional cookies: Remembering your preferences (e.g., language, dashboard layout)

We do not use:

• Advertising cookies
• Cross-site tracking
• Third-party analytics that profile users
• Behavioural advertising trackers

Where we use any analytics, they are configured to be privacy-respecting (e.g., IP anonymisation, no cross-site tracking).

13. Data Breach Notification

In the event of a security compromise involving your personal information, we will:

• Notify the affected school(s) as soon as reasonably possible after confirming the breach
• Notify the Information Regulator of South Africa as required under POPIA
• Notify affected data subjects directly where the breach poses a reasonable risk to their rights
• Provide details of the incident, the data affected, and the steps taken to mitigate harm

We maintain an internal data breach response procedure to ensure rapid containment, investigation, and notification.

14. Information Officer

Our designated Information Officer under POPIA is:

Dhashin Reddy
Director, White Wolf Studio ZA (Pty) Ltd
Email: dhashin@whitewolfstudio.co.za

The Information Officer is responsible for ensuring our compliance with POPIA, handling data subject requests, and serving as the contact point for the Information Regulator.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• The "Last updated" date at the top will be revised
• We will notify schools and affected users via email or in-app notification at least 30 days before changes take effect (where practical)
• Continued use of Wonderkind after changes take effect constitutes acceptance of the updated policy

16. Contact Us

For privacy-related questions:

• Your school administrator (first point of contact for school-specific data questions)
• Wonderkind Information Officer: dhashin@whitewolfstudio.co.za
• General enquiries: hello@wonderkind.co.za

Postal address: