Privacy & Data Protection Policy (POPIA & GDPR)

1. Commitment to Privacy

Sharon Online (Pty) Ltd. ("Sharon Online") is committed to safeguarding the privacy and personal information of our students, teachers, and website visitors. This Privacy Policy details our practices concerning personal data collection, processing, storage, and cross-border transfer.

Our policies comply with:

• POPIA: The Protection of Personal Information Act No. 4 of 2013 (South Africa).
• GDPR: The General Data Protection Regulation (Regulation EU 2016/679).
• APPI: The Act on the Protection of Personal Information (Japan).

2. Personal Information We Collect

We collect information necessary to provide synchronous educational services:

1. Account Information: Full name, email address, password hash, country of residence, IANA timezone, and optional phone number.

2. Student Profile Data: Target English proficiency level (CEFR), specific learning objectives, and vocabulary acquisition records.

3. Tutor Professional Data: Audio audition files, video introductions, TEFL/TESOL teaching credentials, identity verification documents, and South African banking details for EFT disbursements.

4. Classroom Telemetry: Join and leave timestamps, connection quality metrics, attendance status, and automated session audit records.

5. Payment Information: Transaction identifiers, billing currency, and receipt histories. Credit card numbers and PayPal credentials are processed directly by compliant PCI-DSS Level 1 payment processors and are never stored on our servers.

3. Lawful Basis and Purpose of Processing

We process your data strictly under the following lawful bases:

• Contractual Necessity: To deliver scheduled lessons, maintain credit balances, process payments, and pay tutor earnings.
• Legal Compliance: To fulfill tax accounting obligations, South African Reserve Bank reporting, and child safeguarding mandates.
• Legitimate Interests: To detect and prevent fraud, optimize video call latency, and enforce platform anti-harassment standards.
• Consent: For optional promotional communications, cookie tracking, and student feedback surveys.

4. Cross-Border Data Transfers

Because Sharon Online connects South African educators with students worldwide, personal information may be transmitted and stored in secure cloud data centers located in South Africa, the European Union, the United Kingdom, and the United States (via Cloudflare and Amazon Web Services).

All cross-border data transfers are executed under strict contractual safeguards, ensuring that recipient jurisdictions maintain data protection standards substantially similar to POPIA Condition 12 and GDPR Chapter V.

5. Data Retention Schedules

• Account Data: Retained for the lifetime of your active account plus 3 years following account closure.
• Financial & Tax Records: Retained for 5 years in compliance with the South African Tax Administration Act.
• Attendance & Telemetry Logs: Retained for 90 days for dispute resolution and quality auditing, after which logs are anonymized.
• Support Inquiries: Retained for 12 months following resolution.

6. Your Rights (SAR & Rectification)

Under POPIA Section 23 and GDPR Article 15, you have comprehensive rights over your personal data:

• Right to Access (SAR): You may request a complete, machine-readable export of all personal data held about you at any time via our automated Subject Access Request pipeline (GET /api/v1/auth/me/data-export/).
• Right to Rectification: You can update your contact information, timezone, or profile details at any time in your account settings.
• Right to Erasure: You may request permanent deletion of your profile, subject to statutory tax and financial retention laws.
• Right to Object: You may opt out of non-essential communications and marketing notifications.

To contact our Data Protection Officer, email privacy@sharonesl.com.