Parental Consent & Data Processing
Document reference: BNA-POPIA-CPF-v1.1 — Effective [add date when approved]
Important notice to parents and legal guardians
Under Section 34/35 of South Africa's Protection of Personal Information Act (POPIA), processing a child's (anyone under 18) personal information requires the consent of a parent or legal guardian. When a learner registers, we ask for their date of birth. If the learner is under 18, a parent or guardian must give consent before the learner can use the portal. A learner who is 18 or older gives this consent for themselves, and no parent details are collected.
1. Identifying parties
- Responsible party (data controller): BNA STEM Academy
- Operator (data processor): KMHG Web Solutions, the platform's developer and technical maintainer
- Data subject (student): the minor learner (Grades 8–12) using the platform
- Consenting party (guardian): the learner's parent or legal guardian
2. Information we process
| Category | Fields | Purpose |
|---|---|---|
| Learner identity | Full name, date of birth (stored encrypted), grade | Account creation, working out whether parent/guardian consent is required, grade-appropriate content |
| Learner contact | Email, phone number | Login, session recovery, class notifications |
| Parent/guardian | Full name, email, phone, relationship to learner (we do not collect ID or passport numbers) | Consent verification and an auditable consent record |
| Academic performance | Subject enrollments, homework, quiz responses and scores, tutor feedback | Tracking progress and delivering tutoring support |
| Technical/security | Login timestamps, IP address, session identifiers | Preventing unauthorized access and keeping accounts isolated from each other |
3. Technical safeguards actually in place
- Password hashing: passwords are hashed with bcrypt at 12 rounds. Raw passwords are never stored.
- Signed sessions: login sessions use cryptographically signed, HTTP-only, SameSite=Lax cookies — signed so a session token can't be forged, and HTTP-only so page scripts can't read them.
- Parameterized database queries: the backend uses PostgreSQL with an ORM that parameterizes every query, preventing SQL injection.
- Role-based route isolation: middleware checks every request to student, tutor, and admin areas, so accounts can't reach data outside their own role.
- Data encrypted at rest: our database provider (Neon) encrypts stored data at rest by default, and learners' dates of birth are additionally encrypted by the platform before they are stored.
- Second sign-in step for staff: tutors and administrators must confirm each sign-in with an authenticator app, and can be signed out remotely.
- Access records: sign-ins, data exports, approvals and views of consent records are logged.
4. Data retention and automatic erasure
In line with Section 14 of POPIA, we don't keep personal information longer than necessary:
- Active retention: data stays active for as long as the student is enrolled.
- Automatic erasure: if an account has no login and no active enrollment for 12 consecutive months, an automated job erases that student's homework submissions, quiz history, class attendance records, and personal identifiers (phone, date of birth). The account is deactivated rather than deleted outright, so administrative records stay consistent, but no identifying personal information about the student or their parent/guardian remains attached to it.
5. Your rights under POPIA
- Right of access: request a copy of everything we hold about your child.
- Right to rectification: request correction of inaccurate information.
- Right to object: object to processing on reasonable grounds.
- Right to erasure: request your child's data be permanently removed.
- Right to withdraw consent: withdraw consent at any time — this ends portal access immediately.
To exercise any of these rights, email support@bnastemacademy.co.za.
6. How consent is given
Consent isn't collected on paper — it's captured digitally.Learner under 18: the registration form asks for the parent or guardian's name, email address, phone number and relationship to the learner (we do not ask for ID or passport numbers) and requires a consent box to be ticked. We then email the parent or guardian, and the learner can use the portal only after the parent confirms from that email. Learner 18 or older: the learner ticks a consent box confirming their age and consent. In both cases we record the date, time, IP address and browser used to give consent, as an auditable trail.
Contact
Email: support@bnastemacademy.co.za
Phone: 067 025 1855