How we look after this properly

1. Why this page exists

The Protection of Personal Information Act (POPIA) has applied in full since July 2021. It applies to us because we process personal information in South Africa — and it applies with particular force because most of that information is about children.

The privacy policy tells you what we hold and why. This page is the working detail underneath it.

2. Responsible party and information officer

William du Plooy is both the responsible party and the information officer for The Kids Are Coding, based in Durban, KwaZulu-Natal.

Requests, complaints or questions: william@thekidsarecoding.com or WhatsApp 069 009 6569. We respond within 30 days, and normally within a few days.

3. The eight conditions, one at a time

Accountability

One named person is responsible, and it is not a department. See section 2.

Processing limitation

We collect the minimum the programme needs, with the parent’s consent given at enrolment and again when the portal account is set up. Date of birth is optional. We never collect information about anyone other than the enrolled learner and their parent or guardian. Consent can be withdrawn at any time.

Purpose specification

Everything we hold serves one of four stated purposes — delivering lessons, giving feedback, running the account, or meeting a legal record-keeping duty. They are listed in the privacy policy, and we do not quietly add a fifth.

Further processing limitation

We do not repurpose your information. It is not used for advertising, not used to train any model, not sold, and not shared with anyone for their own purposes.

Information quality

You can correct your own name, phone number and password in the portal. Anything else — a learner’s name, a fee, a billing day — we correct on request, same week.

Openness

This page and the privacy policy are public, linked from the sign-in screen and from the bottom of every family-facing page, and readable without an account. You should not need to hand over information to find out what happens to it.

Security safeguards

See section 4 — it is the longest part of this page for good reason.

Data subject participation

You may ask what we hold, get a copy, have it corrected or deleted, and object to how it is used. One message is enough; there is no form and no fee. See section 6.

4. What is actually in place

Described plainly, because “we take security seriously” means nothing:

Separation between families

Every table has access rules attached to the table itself, not just to the screens. A request for another family’s learner returns nothing, even if someone edits a web address by hand, because the database refuses it rather than the app remembering to filter.

There is an automated suite of 62 security tests that signs in as a learner, a parent, a coach and an unrelated account, and then tries to read and write things it should not be able to. It runs against the real database before a release. Two genuine cross-tenant defects were found and fixed by exactly this method before any family used the portal.

Passwords and sessions

• Passwords are stored as one-way hashes. Nobody on our team can read yours.
• Minimum eight characters, and we do not force meaningless complexity rules.
• Sign-in attempts are rate-limited, so a password cannot be guessed by brute force.
• Every session token is verified against the auth server on every request.

Your child’s work

• Stored in a private bucket — there is no public URL for any of it.
• Served only through signed links that expire within the hour, so a link shared by accident stops working.
• Only accepted file types and sizes are allowed in.

In transit and in the browser

• HTTPS everywhere, with HSTS so a browser refuses to fall back.
• A content security policy that stops injected scripts from running or sending data elsewhere.
• The portal cannot be embedded in a frame on another site.
• Nothing a learner or coach types is ever rendered as raw HTML.

Access by staff

Staff accounts see only their own organisation. Coaches can review work and write feedback, but cannot change fees or the catalogue — a separation that matters the first time we hire help.

5. Cross-border transfer

Our database and files are hosted by Supabase in Ireland, page serving is by Vercel, and email is sent by Resend. Your family’s information therefore leaves South Africa.

POPIA section 72 permits this where the recipient is subject to a law providing substantially similar protection. Ireland is in the European Union and subject to the GDPR, which meets that bar. Each provider processes information on our instructions only.

6. Making a request

Message us and say what you want — a copy, a correction, a deletion, or to withdraw consent. Tell us which learner it concerns. We will confirm you are the parent on the account before acting, which is a protection for you rather than an obstacle.

POPIA also gives you a formal route using Form 2, and we will accept one if you prefer — but a WhatsApp message gets the same result faster. If we get it wrong, complain to the Information Regulator at inforegulator.org.za.

7. What we have not built

Listing the gaps is the part that makes the rest of this page worth believing:

• No self-service data export. You ask, and a person does it. Fine at this size; it should become a button as we grow.
• No automatic deletion after 12 months. Deletion currently happens on request or when an account is closed by hand.
• No two-factor authentication for parents or learners. Staff accounts are the priority for this, and it is the next security item on the list.
• Backups are the hosting provider’s automated ones. We do not keep a separate, independently tested restore.
• The content security policy still allows inline scripts. The framework we use needs it unless the policy is generated fresh on every request. It is on the list. The part of that policy that matters most — the rule saying data may only be sent to our own database and nowhere else — is fully in place.

If any of these matters to you before you enrol, say so — it is a reasonable thing to ask about.

8. Breach notification

If personal information is ever accessed by someone unauthorised, POPIA requires us to tell the Information Regulator and every affected person as soon as reasonably possible.

We will do that, and we will tell you what actually happened, what was affected, and what we changed — not a paragraph engineered to sound calm.