POPIA Notice — Crechely (working name)

Status: DRAFT — not yet reviewed by a lawyer. This is a plain-language summary of the Protection of Personal Information Act (POPIA) points that matter most for a South African preschool using Crechely — it is not a substitute for the full Privacy Policy (`PRIVACY_POLICY.md`), and both should be read together. Do not publish or rely on this until a lawyer familiar with POPIA has reviewed it.

Last updated: [DATE]

The short version

Crechely stores information about your school's staff, and information your school itself enters about children and their parents/guardians — names, contact details, enrolment dates, and payment history.

• Your school is the "responsible party" under POPIA for the children's and parents' data it records — you decide what to record and why, same as if you kept it in a paper fee book or a spreadsheet.
• Crechely is the "operator" — we process that data only to run the Service, on your school's instructions, and don't use it for our own purposes (like marketing to those parents directly).
• Your school stays responsible for telling parents their information is processed in a system like this, and for responding if a parent asks to see, correct, or have their information removed.

What we actually store

Names, contact details (phone/email), enrolment/exit dates, fee amounts, and payment history for the children your school enters. We do not collect this directly from parents — your school enters it.

Where it's processed

Hosted on Vercel (application) and Render (database) — both list [REGION — CONFIRM: which data-centre region each provider uses for this account] as their processing location. Transactional email (password resets, receipts) is sent via Zoho Mail. If any of these store or process data outside South Africa, POPIA requires either that country to have adequate data-protection laws recognised by the Information Regulator, or specific safeguards — this needs legal confirmation before launch, see PRIVACY_POLICY.md §"Where data is stored".

Your school's information officer

POPIA requires every responsible party (your school, for the children's data it holds) to register an information officer with the Information Regulator. That's a per-school obligation, not something Crechely does on your behalf — mentioning it here so it isn't missed.

Crechely's own information officer, for data we hold about our own customer accounts: [ADD REAL: name/contact of Crechely's information officer].

How to raise a concern

Email support@crechely.co.za for anything data-related. If unresolved, South Africa's Information Regulator can be contacted directly — see inforegulator.org.za.

Relationship to the other legal documents

This notice is a summary. PRIVACY_POLICY.md is the full policy; TERMS_OF_SERVICE.md covers the contractual relationship. All three need to be read and updated together, and reviewed by a lawyer before Crechely starts onboarding real, paying customers with real children's data.