Effective date: 12 November 2026

This Privacy Policy explains how MONYETLA BURSARY PROJECT NPC ("Monyetla", "we", "us", "our") collects, uses, stores, shares and protects personal information when you use https://monyetlaproject.co.za and the related online registration, payment, student card, Saturday School attendance and online learning services (together, the "Service"). It is written to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA") and, for Google sign-in, the Google API Services User Data Policy.

If you are under 18, please read this policy together with a parent or legal guardian. See section 4.

1. Who we are (the responsible party)

We are the "responsible party" under POPIA for the personal information described in this policy. The Service is designed and maintained for us by Mightyweb (Pty) Ltd (100 Victoria Road, Park West, Bloemfontein, 9301) and hosted by iClix in Bloemfontein, South Africa. Mightyweb acts as our "operator" and may only process personal information on our instructions, under a written agreement and subject to confidentiality and security obligations (POPIA sections 20 and 21).

2. What personal information we collect

2.1 Learner registration (2027 intake)

When a learner is registered for Saturday School we collect the information on our registration form:

• Learner surname, initials and first name;
• School and grade (Grade 12; Grade 11 when it is opened);
• School subjects the learner takes (for example Mathematics, Physical Sciences, Accounting, Life Sciences);
• Learner South African ID number, or passport number for foreign nationals (used to confirm identity and to prevent duplicate registrations);
• Learner cellphone number and parent/guardian cellphone number;
• Parent/guardian residential address;
• Learner photograph (used on the student card and gate check-in screen);
• Bus route used to travel to Saturday School (for example Botshabelo, Thaba Nchu, Ladybrand, Brandfort);
• Learner signature or typed acceptance, and date, together with the learner's and parent/guardian's consent and acceptance of the Code of Conduct;
• Email address and password (or Google sign-in identifier) for the learner's or parent's online account.

2.2 Fee waiver applications

If a learner cannot afford the registration fee and applies for a fee waiver, we collect the reason for the application, any teacher or school reference and any voucher code supplied. This information is used only to decide the application and is visible only to authorised Monyetla administrators.

2.3 Payments

Registration fees are paid through Payfast (PayFast (Pty) Ltd, a Network International company). We never see or store your card number, CVV, bank login or other payment credentials. These are entered on Payfast's secure payment pages. We receive from Payfast only a payment confirmation: the transaction reference, amount, date/time, payment status and payment method type, linked to the registration.

2.4 Student card, attendance and learning activity

• A unique student number (format MBP-2027-XXXX) and a QR code linked to it;
• Saturday gate check-in records: date, time, result of the scan (accepted, already scanned, not registered) and, where relevant, school and bus route;
• Online learning activity: the lessons, subjects and Grade pages the learner is enrolled in, lesson progress, and quiz or assessment results done on the Service.

2.5 Technical information

Through ordinary website use we collect IP address, browser and device type, pages visited, and cookies (see section 11). We use this to run, secure and improve the Service.

2.6 Google sign-in data (if you choose "Sign in with Google")

See section 7 for exactly what we receive from Google and how it is used.

2.7 What we do not collect

We do not collect bank account or card details; we do not use photographs for facial recognition or any other biometric identification; and we do not intentionally collect "special personal information" under POPIA (religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information or criminal behaviour). Please do not include such information in free-text fields. If we ever need to collect it (for example health information needed for a learner's safety at Saturday School), we will ask for specific consent and only use it for that purpose.

3. Why we use your information, and our lawful basis

We use personal information only for the purposes above, or for a purpose compatible with them. We do not sell personal information, and we do not use it for third-party advertising. We will send you marketing messages only if you have opted in, and you can opt out at any time (POPIA section 69).

4. Children and minors

Most of our learners are in Grade 11 or 12 and some are under 18. Under POPIA, a "child" is a person under 18, and we may process a child's personal information only with the consent of a competent person (normally a parent or legal guardian) or where POPIA otherwise allows it.

• A learner under 18 may be registered only by, or with the documented consent of, a parent or legal guardian. The registration form includes the parent/guardian's consent to the processing described in this policy.
• Learner information is used only for Saturday School administration, safety, fee processing, bursary eligibility and learning. We do not use it to market to children and we do not share it with advertisers.
• Learner photographs, ID numbers and contact details are accessible only to authorised Monyetla administrators and gate staff, and to our operator for support and maintenance.
• A parent or guardian may at any time ask to see, correct or delete a child's information, or withdraw consent, by contacting our Information Officer (section 12).
• Learners under 18 may not use "Sign in with Google" unless their Google Account permits it and a parent or guardian has agreed.

5. Who we share information with

We share personal information only where necessary and only with:

We do not share information with any other third party without your consent unless the law requires it. If Monyetla were ever merged, restructured or wound up, personal information would be handled in line with POPIA.

Vista Winter School Trust is a separate legal entity. We do not share learner information with it unless the learner or parent/guardian has asked to register for Winter School.

6. Storage location and cross-border transfers

The Service is hosted by iClix in Bloemfontein, South Africa. Some of our providers, in particular Google (for sign-in, Analytics and reCAPTCHA), may store or process information outside South Africa. Where personal information is transferred outside South Africa, we do so only to recipients that are subject to law, binding rules or an agreement that gives a level of protection substantially similar to POPIA, or otherwise as permitted by POPIA section 72.

7. Google user data (Google API Services disclosure)

This section applies if you choose to sign in to the Service with your Google Account.

What Google data we access. We use Google Sign-In (OAuth 2.0 / OpenID Connect) to let you create an account and log in. We request only these basic scopes: openid, email and profile (https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile). From Google we receive your name, email address, profile picture URL (if provided) and a unique Google account identifier. We do not access your Gmail, Google Drive, Google Calendar, Contacts or any other Google service data.

How we use it. We use this information only to (a) create and sign you in to your Monyetla account, (b) match you to your learner registration and (c) send you service messages about your registration, payments and classes. These are user-facing features that are visible in the Service.

How we store it. Your name, email address and Google account identifier are stored in the Service's database on our hosting provider's servers (section 6), protected as described in section 9. We do not store your Google password and never receive it.

Sharing. We do not sell Google user data. We do not transfer it to third parties, except (i) to our operator Mightyweb (Pty) Ltd and hosting provider, who process it on our behalf to run the Service; (ii) where necessary for security purposes, such as investigating abuse; (iii) to comply with applicable law; or (iv) as part of a merger, acquisition or sale of assets, after obtaining your explicit prior consent. We do not use Google user data for advertising, for profiling, for training generalised artificial-intelligence or machine-learning models, or to determine creditworthiness. We do not allow humans to read Google user data except with your consent for specific support requests, where necessary for security purposes or abuse investigation, to comply with law, or where the data is aggregated and used for internal operations.

Limited Use. Monyetla Bursary Project's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion. We keep Google-sourced data for as long as your account is active. If you delete your account, ask us to delete it, or revoke our access, we will delete the Google-sourced data from our systems within 30 days, except where we must keep limited records by law (for example payment records). Backups are overwritten in the normal backup cycle (section 10).

How to revoke access. You can remove Monyetla's access to your Google Account at any time at https://myaccount.google.com/permissions (select "Monyetla Bursary Project" and choose "Delete all connections" or "Remove access"). You can also email our Information Officer to request deletion of your Google-sourced data.

If we ever need additional Google permissions, we will update this policy, ask for your consent in the sign-in screen, and request only the minimum needed.

8. Your rights under POPIA

You (or, for a child, your parent or guardian) have the right to:

1. Ask whether we hold personal information about you and to access it;
2. Ask us to correct inaccurate or incomplete information, or to delete or destroy information we are no longer authorised to keep;
3. Object to the processing of your information on reasonable grounds, and withdraw consent at any time (this does not affect processing done before withdrawal);
4. Object to direct marketing and opt out at any time;
5. Not be subject to a decision based solely on automated processing that has legal or significant effects on you. (Fee waiver and registration decisions are made by people. Gate scanner results are an access check against the registered list.);
6. Lodge a complaint with the Information Regulator (section 13);
7. Request access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA), through our Information Officer.

To use these rights, email or write to our Information Officer (section 12). We may need to verify your identity first. We will respond within a reasonable time and normally within 30 days.

9. How we protect information

We take reasonable technical and organisational measures to secure personal information (POPIA section 19), including:

• HTTPS/TLS encryption of all traffic to and from the Service;
• Card and bank details are handled only on Payfast's secure, PCI-DSS compliant pages and never reach or are stored on our systems;
• Role-based access: only authorised administrators and gate staff can see learner records, and the gate scanner shows only the minimum needed;
• Strong passwords, restricted administrator accounts and security monitoring of the website (including regular security updates and security scanning);
• Regular backups of the website, stored securely (section 10);
• Written confidentiality and operator agreements with those who process data for us.

No online service is completely secure. If there is a security compromise involving your personal information that creates a real risk of harm, we will notify the Information Regulator and you as soon as reasonably possible, as required by POPIA section 22.

10. How long we keep information

We keep personal information only as long as necessary for the purpose it was collected, or as the law requires:

11. Cookies

The Service uses:

• Strictly necessary cookies to keep you signed in, keep your registration and checkout working and protect against abuse (these cannot be switched off);
• Analytics cookies (Google Analytics) to understand how the site is used, for example which pages are visited and from which type of device (Google may process this information outside South Africa);
• Security and third-party cookies from Google reCAPTCHA, which protects our forms against spam and bots (it analyses interactions such as mouse movement and your IP address, and Google may process this information under its own privacy policy), and from embedded YouTube lesson videos, where used.

You can block or delete cookies in your browser settings; some parts of the Service may not work without necessary cookies.

12. Contact us and the Information Officer

For any privacy question or request, contact our Information Officer:

• Information Officer: Christiaan Rufus Grobler, Chairman / Information Officer
• Email: monyetlabursaryproject@gmail.com
• Post / in person: MONYETLA BURSARY PROJECT NPC, 26 Naval Road, Navalsig, Bloemfontein, 9301
• Telephone: 084 999 1592

13. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information, you may complain to the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• Complaints email: POPIAComplaints@inforegulator.org.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Telephone: 010 023 5200

We encourage you to contact us first so that we can try to resolve your concern.

14. Changes to this policy

We may update this policy from time to time. The "Effective date" at the top shows the latest version. If we make material changes, we will post the new version on the Service and, where required, notify you or ask for your consent again. If we change how we use Google user data, we will update section 7 before the change takes effect.

15. Related documents

Please also read our Terms of Service (https://monyetlaproject.co.za/terms-of-service.php), which govern use of the Service, fees and refunds.