Effective date: 13 October 2026 · Last updated: 13 October 2026 · Version: 1.0
This policy explains how TMTD Academy collects, uses, shares and protects personal information, and what rights you have over that information. It is written to meet the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA).
Most of the people we teach are children. If you are a parent or legal guardian, the section on children’s personal information is the one that affects you most directly.
1. Who we are
TMTD Academy is the tutoring and education division of TMTD Corp (Pty) Ltd, a private company registered in the Republic of South Africa.
TMTD Corp (Pty) Ltd is the responsible party for the personal information described in this policy. That means we decide what information is collected, why, and how it is used, and we are accountable for it under POPIA.
8 Die Bof Street, Robinpark, Randfontein, Gauteng, South Africa
2. What this policy covers
This policy applies to personal information we process when you:
visit or use tmtdacademy.co.za, including the enquiry form and the study-planner tool;
contact us by email, telephone or WhatsApp;
book, attend or pay for tutoring, group sessions or coding courses;
apply to work with us as a tutor;
represent a school or organisation that books group sessions with us.
It does not cover websites or services operated by other people, even where we link to them. Those are governed by their own privacy policies.
3. Information we collect
3.1 Enquiry and contact information
When you submit an enquiry through our website forms, we collect:
your name;
your email address;
your telephone number;
the type of enquiry (for example tutoring, a school or group booking, coding courses, or a tutor application);
the learner’s grade or level of study;
the message you write to us;
the page of our site the enquiry was sent from, and the date and time of submission.
3.2 Learner information
Once tutoring is arranged, we collect what we need in order to teach well and keep the learner safe:
the learner’s name, grade and school;
subjects and topics being tutored;
areas of difficulty, learning needs and any support arrangements the parent tells us about;
attendance records and session notes;
assessment results, progress notes and feedback, where the parent or school shares these with us;
the name and contact details of the parent or legal guardian responsible for the learner.
We do not ask for a learner’s identity number, medical records or any other special personal information unless a parent or guardian volunteers it because it is relevant to how we must teach or supervise the learner. Where that happens, we process it only for that purpose.
3.3 Tutor applicant and tutor information
If you apply to tutor with us, we collect your name and contact details, your qualifications and academic records, your subject and grade competencies, your work history, your references, and the results of background checks where we carry them out. Because our learners are children, this includes checks relevant to working with children.
3.4 Payment information
We invoice for sessions and record what has been invoiced, paid and outstanding, together with the payment reference and the bank account name used for electronic transfers.
When online card payments go live on our website, payments will be processed by a registered third-party payment provider. We will not receive, see or store your full card number, expiry date or CVV. Those details go directly to the payment provider over an encrypted connection. We will only ever hold the outcome of a payment and a reference for it.
3.5 Technical information
When you browse our website, our hosting provider and analytics tools record:
your IP address, approximate location derived from it, and internet service provider;
your browser type, operating system and device type;
the pages you visit, the time spent on them and the links you click;
the website or search that referred you to us;
cookie and similar identifiers, as described in the cookies section.
4. How we obtain it
We collect personal information:
Directly from you — forms, email, telephone calls, WhatsApp messages, and during sessions.
From a parent or legal guardian — where the learner is a child.
From a school or organisation — where it books group tutoring and supplies learner lists or results.
Automatically — through cookies, server logs and analytics when you use our website.
From references and background-check providers — for tutor applicants, with their knowledge.
If you give us someone else’s personal information — a learner, a co-parent, a reference — you confirm you are entitled to do so and that you have told them we will process it as set out in this policy.
5. Why we process it
POPIA requires us to have a lawful justification for every processing activity. Ours are set out below.
Purposes for processing personal information, and the POPIA justification for each.
What we do
Why
Justification under POPIA
Respond to enquiries
To answer your question, quote on tutoring and arrange a first session.
Your consent in submitting the enquiry; steps toward a contract (s11(1)(a) and (b)).
Deliver tutoring
To schedule sessions, assign a suitable tutor, prepare material, track progress and report back to you.
Performance of our contract with you (s11(1)(b)).
Safeguard learners
To vet tutors, keep attendance records and investigate any concern about a learner’s safety.
Our legitimate interests and the protection of a legitimate interest of the child (s11(1)(d) and (f)).
Invoice and collect payment
To bill for sessions, reconcile payments and follow up on unpaid accounts.
Performance of our contract; our legitimate interests (s11(1)(b) and (f)).
Keep accounting and tax records
To meet our obligations under the Companies Act and the Tax Administration Act.
Compliance with an obligation imposed by law (s11(1)(c)).
Improve our service
To understand which pages and subjects draw interest, fix faults and plan what we offer.
Our legitimate interests (s11(1)(f)); your consent for non-essential analytics cookies.
Send you updates about tutoring
To tell existing clients about term dates, holiday programmes and new subjects.
Your consent, or our existing customer relationship with you (s69).
Recruit tutors
To assess applications, verify qualifications and conduct background checks.
Steps toward a contract; our legitimate interests in learner safety (s11(1)(b) and (f)).
Defend or pursue legal claims
To establish, exercise or defend a right or obligation in law.
Our legitimate interests; protection of a legitimate interest (s11(1)(d) and (f)).
We will not use your personal information for a new purpose that is incompatible with the ones above without telling you first and, where the law requires it, obtaining your consent.
6. Children’s personal information
Most of our learners are under 18. POPIA treats the personal information of a child — a person under 18 who is not legally emancipated — as a special category that may generally only be processed with the consent of a competent person, meaning the parent or legal guardian.
How we apply this:
We take bookings for a learner under 18 only from that learner’s parent or legal guardian, or from a school acting with parental authority. By making a booking, the parent or guardian consents to us processing the learner’s personal information for the purposes set out in this policy.
We do not knowingly collect personal information directly from a child through our website. Our forms are intended for parents, guardians, schools and adult learners.
We limit what we collect about a learner to what we actually need in order to teach and supervise them.
We do not send direct marketing to a child, and we do not sell or rent a learner’s personal information to anyone.
A parent or legal guardian may ask at any time to see, correct or delete what we hold about their child, or withdraw consent, by contacting our Information Officer. Where we must keep certain records by law — invoices, for example — we will explain which and why.
If you believe a child has given us personal information without the consent of their parent or guardian, contact [email protected] and we will delete it unless we are required by law to keep it.
7. Who we share it with
We do not sell personal information. We share it only as described here, and only with what is needed for the task at hand.
7.1 Our tutors and staff
A tutor assigned to a learner receives the learner’s name, grade, subjects, learning needs and session history, and the parent’s contact details for scheduling. Tutors and staff are bound by confidentiality obligations and may use that information only to deliver the service.
7.2 Operators (service providers)
POPIA calls a third party that processes personal information on our behalf an operator. Each operator acts on our instructions, is contractually required to keep the information confidential and secure, and may not use it for its own purposes.
Categories of operator we use and what each handles.
Category
What they handle
Website hosting and security
Our web host and our content-delivery and security provider store the site and its server logs, including IP addresses, and filter malicious traffic.
Enquiry storage
A hosted database service stores submitted enquiries so that our staff can work through them and so that nothing is lost.
Email and messaging
Our email provider carries correspondence with you. Where you choose to contact us over WhatsApp, that conversation is carried on WhatsApp’s infrastructure.
Website analytics
Google Analytics and Google Search Console tell us how the site is used and how it performs in search, on an aggregated basis.
Embedded maps and fonts
Google Maps and web font services receive your IP address in order to serve a map or a typeface to your browser.
Online session tools
Where a session is held online, the video-conferencing provider handles the connection and any recording we have told you about in advance.
Payments
Our bank and, once online payments go live, our payment provider process transactions. Card details go to the payment provider, not to us.
Accounting
Our accountants and bookkeeping software handle invoices and financial records.
7.3 Other disclosures
Schools and organisations that have booked group tutoring receive attendance and progress reporting for the learners they enrolled.
Professional advisers — our attorneys, auditors or insurers — where they need the information to advise or represent us.
Authorities and courts where we are obliged by law to disclose, or where disclosure is necessary to establish or defend a legal claim.
Child protection authorities where we have reason to believe a child is being abused or neglected. Reporting this is a legal duty under the Children’s Act 38 of 2005 and we will comply with it.
An acquirer, if the business or part of it is sold or restructured. We will tell you if that happens and the acquirer will be bound by this policy until it publishes its own.
8. Transfers outside South Africa
Some of the operators above run their infrastructure outside South Africa, typically in the United States or the European Union. That means your personal information may be stored or processed outside the country.
Section 72 of POPIA permits this where one of a number of conditions is met. We rely on the following:
the operator is bound by a contract or by binding corporate rules that uphold principles for the lawful processing of personal information substantially similar to POPIA, including provisions on onward transfers; or
the transfer is necessary for the performance of our contract with you; or
you have consented to the transfer.
We check the terms on which an operator handles personal information before we use it, and we review those terms when they change.
9. Cookies and analytics
A cookie is a small file your browser stores when you visit a website. We use the following kinds:
Strictly necessary cookies — needed for the site to work: keeping a form session alive, remembering a cookie choice, and protecting against malicious traffic. These cannot be switched off.
Analytics cookies — set by Google Analytics to count visits and show us which pages are used. We set these only where you allow them.
Functional cookies — set by embedded features such as a map or a chat button, to make them work and remember your preferences.
You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site working, including the enquiry form.
We do not currently respond to browser “Do Not Track” signals, because there is no agreed standard for how a website should do so.
10. Direct marketing
We send marketing — term-date reminders, holiday programmes, new subjects, special offers — only where:
you asked us to, or consented to it; or
you are an existing client, the marketing relates to tutoring similar to what you already use, and you were given a chance to refuse when we first collected your details.
Every marketing message carries a way to stop receiving them. You may also unsubscribe at any time by replying to the message or emailing [email protected], and we will stop without charge. If you have never been our client, we will approach you about marketing only once, in order to ask your consent, as section 69 of POPIA requires.
We do not send marketing to learners under 18.
11. How we protect information
Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures. Ours include:
serving our website over HTTPS so that information in transit is encrypted;
limiting access to enquiry records and learner records to staff who need it for their work;
individual accounts with strong passwords, and multi-factor authentication where the system supports it;
confidentiality obligations in our contracts with tutors, staff and operators;
keeping software, plugins and server components up to date;
routing card payments to a registered payment provider so that card data never reaches our systems;
regular backups, and review of who has access to what.
No system is completely secure. If we become aware that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires, and tell you what happened and what you can do about it.
12. How long we keep it
We keep personal information only for as long as we need it for the purpose it was collected, unless the law requires us to keep it longer.
Retention periods by record type.
Record
How long we keep it
Enquiries that do not become bookings
24 months from the enquiry, then deleted.
Learner and session records
5 years after the last session, so that we can answer questions about past tutoring and provide history if the learner returns.
Invoices, payments and accounting records
5 years, as required by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011.
Unsuccessful tutor applications
12 months, unless the applicant asks us to keep them on file for future openings.
Tutor records (engaged)
5 years after the engagement ends.
Marketing consents and opt-outs
Indefinitely, so that we can prove we honoured your choice.
Website server logs and analytics
Up to 26 months, in line with our analytics provider’s retention setting.
Records relevant to a legal claim
Until the claim and any appeal is finally resolved, and any applicable prescription period has expired.
At the end of a retention period we delete the information or de-identify it so that it can no longer be linked to a person.
13. Your rights
Under POPIA you have the right to:
Be told whether we hold personal information about you, and to be given a record or description of it, together with the identity of anyone who has had access to it (sections 23 and 24).
Have it corrected or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
Object to processing that we base on our legitimate interests or on the protection of a legitimate interest, on reasonable grounds (section 11(3)).
Withdraw consent where consent is our justification. This does not affect processing that already took place, and it may mean we can no longer provide tutoring.
Stop direct marketing at any time (section 69).
Not be subjected to a decision based solely on automated processing that has legal consequences for you (section 71).
Complain to the Information Regulator, and to institute civil proceedings about an alleged breach (sections 74 and 99).
How to exercise a right
Write to our Information Officer at [email protected]. Tell us which right you are exercising and what information it concerns.
To object to processing, use Form 1 under the POPIA Regulations. To request correction or deletion, use Form 2. Both forms are available from the Information Regulator at inforegulator.org.za. We will also accept a clear written request that is not on a form.
We will verify your identity before acting, so that we do not disclose someone’s information to the wrong person. For a learner’s information, we will confirm that you are the parent or legal guardian.
We respond within 30 days of receiving a complete request. If we need longer, we will tell you why and give you a date.
Access requests are free unless the request is such that a fee is prescribed, in which case we will give you a written estimate before doing the work.
If we refuse all or part of a request, we will tell you on what legal ground, and how to take the matter further.
14. Complaints
Please raise a privacy concern with our Information Officer first. We would rather fix it ourselves, and quickly.
If you are not satisfied with how we handled it, you may complain to the Information Regulator. A complaint is lodged on Form 5 under the POPIA Regulations.
Please confirm the Regulator’s current contact details on its website before sending anything, as these can change.
15. Automated decisions
We do not make decisions about you, your account or a learner’s tutoring solely by automated means. Tutor matching, scheduling suggestions and the study planner produce recommendations only; a person reviews and decides.
16. Changes to this policy
We update this policy when our practices, our service providers or the law change. The effective date at the top shows when the current version took effect, and we keep the version number so you can tell one version from another.
Where a change materially affects how we use your personal information, we will tell you directly — by email, or by a notice on the website — before it takes effect. Continuing to use our website or our services after a change takes effect means the updated policy applies to you.
17. Contact us
For anything in this policy, including to exercise a right or raise a concern: