Privacy notice

Who we are

Bhala is a trading name of THE CREATIVE CLAN GROUP LTD. That company is the responsible party for the information described in sections 4 to 7, and the operator for everything described in sections 8 to 11. In this notice, we and us mean that company.

Registered name

THE CREATIVE CLAN GROUP LTD

Registration number

13472488

Registered in

England and Wales

Registered office

3 Bakehouse Mews, Hampton, England, TW12 2NL

Information Officer

Ross Walker

Email

[email protected]

Anything in this notice, including a request to see, correct or delete information, reaches the Information Officer at that address.

The two roles Bhala plays

POPIA gives two different names to two different jobs, and Bhala does both. Which one applies decides who you ask, so it is worth thirty seconds.

The practical difference: for anything about a pupil, the school answers you and we assist. For anything about you as a visitor, an enquirer or a member of staff with an account, we answer you directly.

If you are a parent or a pupil, start here

Your child's school holds the record. It chose to use Bhala to keep it, and it decides what goes in. We keep it safe and make it work, and we do not use it for anything the school has not asked for.

What Bhala can hold about your child: their name, their class and year, their marks and academic history, the notes their teachers write, pastoral ratings, records the school has marked as sensitive such as medical or legal ones, a photograph where your school has recorded consent for it, your own contact details as a guardian, and a record of any parent share the school has sent you. Section 8 sets this out in full.

Who to ask: your child's school. Ask them to show you what is held, to correct something that is wrong, or to remove something. They can do all three from inside Bhala. If they need our help to answer you, we help them. We cannot show you a record, or change one, without the school asking us to, because it is not ours to decide about. If you are not getting anywhere with the school, section 20 says how to complain to the Information Regulator.

What this website collects

This website has no analytics, no tracking pixels, no advertising and no third-party scripts. The typefaces are served from this site rather than from a font service, so loading a page here does not tell any other company that you visited.

The contact form. If you fill it in we collect your name, your school, your role, your email address and your message. It is sent to us as an email so that a person can reply to you. It is not written into the product's database, and it never reaches a school's records. There is one hidden field on the form that a person never sees; anything typed into it tells us the submission came from a script rather than from you.

Serving the page. Cloudflare serves this site, so your request passes through Cloudflare and is logged there for operational purposes, including the address your browser connected from, in the way any web host logs a request. Those logs stay with Cloudflare under its own retention policy. We do not download them or keep a copy.

The submission limit. To stop the form being used to send bulk email, we record the internet address a submission came from, and allow five in an hour from the same address. Only submissions inside that hour count towards the limit. Those rows are not yet cleared away automatically, so they stay until we clear them. Sign-in attempts, parent PIN attempts and demo sign-ins are limited the same way.

What we collect when you have an account

A member of staff with a Bhala account has a name, a work email address, a role at their school, and a password. The password itself is never stored: what is kept is a one-way hash of it, from which the password cannot be worked out.

Signing in creates a session. That means a cookie in your browser and a matching record on our side holding when you signed in, when the session expires, the address you connected from and which browser you used. The access log records the sign-in itself. Signing out ends the session.

If your school pays by card, Stripe holds the billing details and tells us only whether the subscription is active. Card numbers are typed on Stripe's own pages and never reach us.

What we collect when you ask us about Bhala

If you write to us, book a walkthrough or ask for a quote, we keep your message and our correspondence with you in our email, so that we can carry on the conversation and remember what was agreed. We do not buy contact lists, and we do not add a school to a mailing list that has not asked to hear from us. Ask us to stop writing and we stop.

Why we may hold it, and whether you have to give it

Under section 11 of POPIA, each of the things above rests on one of these:

Performing a contract

Staff accounts, sessions, billing status. Without them there is no product to sign in to, so these are not optional: if you hold an account, your name, work email and role have to be there.

Our legitimate interest

Answering an enquiry, keeping the site up, limiting submissions, and keeping the access log that lets a school see who looked at what. The interest is running a safe product and replying to people who write to us, and none of it involves profiling you or selling anything on.

Consent

Filling in the contact form at all, and any email you ask us to send you. Both are voluntary. You can say no and still use the rest of the site, and you can change your mind later.

The school's own basis

Everything about a pupil. The school decides why it holds the record and on what basis, usually its obligations as a school and its contract with you. We process it only on the school's instruction.

What the product holds about a pupil

In this section the school is the responsible party and we are its operator. Bhala can hold:

• the pupil's name, class, year group and academic history;
• marks, and the record of corrections to them, with the original kept beside the correction;
• notes written by staff about the pupil;
• pastoral ratings, which are three scores from one to five covering settling in, effort and getting on with others;
• records the school marks as sensitive, such as medical or legal ones, held in a separate encrypted store;
• a photograph, where the school has recorded that it has consent for one;
• guardian contact details: a name, the relationship to the pupil, a phone number and an email address;
• the record of any parent share, including a hashed form of the PIN, which fields it covered and when it expires;
• an entry in the access log every time somebody views, prints or shares the pupil's information.

None of it is collected from a child. The school provides it, and the school is the one holding the consent relationship with the parent. See the access log on the Trust page for how the log works.

Sensitive records

Medical, pastoral and legal records sit in their own store, encrypted with a key of their own. They can be opened by two roles only: a school administrator and academic support. A class teacher cannot open one, even for a pupil in her own class, and there is no screen anywhere that changes that. They are excluded from anything that leaves the system, including every parent share.

What a parent can see through a share

A teacher can share one pupil's information with that pupil's parent. The parent gets a link and a six digit PIN sent separately, and the PIN opens a view of that one child. The teacher ticks which details are included, and only the ticked ones appear. The share can be looked at and not changed. It expires after fourteen days, a head can revoke it at any moment, and every view is written to the access log. No sensitive record is ever part of a share, and no other pupil is ever visible through one.

Report drafts, and what we never do

A report draft is assembled on our own servers from the phrase bank the school wrote. No language model is asked to write about a pupil, and none is sent a pupil's marks or notes in order to do it.

One capability in the product would use a model: reading the details out of an admission PDF when a new pupil starts, so that a form does not have to be retyped. It is switched off. Nothing has been sent to it, and if a school ever turned it on, an admission form is the only thing it would receive. This notice will say so before that changes.

Beyond that:

• we do not use anything in a school's records to train a model, ours or anyone else's;
• we do not sell personal information, and we do not share it for advertising;
• we do not use pupil information to market anything to a parent;
• we do not read a school's records except when the school asks us to help with something specific.

Who else touches it

Four companies handle information on our behalf, each for one job, each under a contract that binds them to the same standard. A fifth is wired up and switched off. This is the same list as the one on the Trust page.

• Railway

  Hosting the application and the database

  European Union

• Cloudflare

  File storage, and serving this website

  European Union

• Resend

  Sending email, such as an invitation or a password reset

  European Union

• Stripe

  Taking payment from a school. No pupil record ever reaches it

  Payment information only

• Anthropic Switched off

  Reading the details out of a new starter admission PDF

  Switched off. Nothing is sent to it today

Where it is kept, and when it leaves South Africa

The application, the database and the files are hosted in the European Union. A South African school's records are therefore held outside South Africa, so section 72 of POPIA applies: information may go to another country where its law gives protection substantially similar to POPIA. European data protection law does, and that is the basis we rely on. The same applies to any other country a sub-processor in section 12 operates from.

Hosting in South Africa is available on request for a school that needs it. Ask us and we will tell you what it involves before you commit to anything.

How long it is kept

Medical records

Five years after a pupil leaves the school.

Other records about a pupil

Seven years after a pupil leaves.

Academic history

Kept permanently, because a school has to be able to say what a pupil achieved.

The access log

Kept. It can only be added to: nobody can edit or remove an entry, the school cannot and neither can we. That is the point of it.

Enquiries and correspondence

Kept in our email while the conversation is live and for as long as we may need to refer back to it.

A head can shorten the first two windows for their school. Nobody can lengthen one or switch it off, and the product refuses an attempt to.

Being straight about the mechanism: nothing deletes on a timer today. There is no job that runs through old records and removes them, so a record reaches the end of its window and stays until it is removed. Deletion happens when a school asks for it, or when we run it. Building the job that does it automatically is on our list, and this notice will change when it exists.

Cookies

This website sets no cookies at all. There is nothing here to consent to, which is why you are not being asked to dismiss a banner.

The product at app.usebhala.app sets one cookie when you sign in, holding nothing but a session identifier. A parent opening a share gets a second, once the PIN has been entered, so that the page does not ask for the PIN again on every click. Both are strictly necessary: without them, signing in would not survive the next page. Both are marked HttpOnly, so no script can read them, and Secure, so they only travel over an encrypted connection. There are no third-party cookies anywhere, and nothing is set for analytics or advertising.

The demo school

The demo school contains no real people. Every pupil, mark and note in it was made up. Anything you type while you are in it is fictional data in a fictional school: the whole demo school is emptied and rebuilt from its made up starting data, so nothing typed into it is kept. Please do not put a real child's details in there. Sign-ins to the demo are limited by internet address in the same way as the contact form.

Children

Pupils in a South African primary school are children in law, and POPIA treats information about a child as needing extra care. Bhala does not collect anything directly from a child: there is no pupil sign-in, and no part of the product is aimed at a child. Everything about a pupil comes from the school, and it is the school that holds the relationship with the parent or guardian who can consent on the child's behalf.

Keeping it safe

Information is encrypted in transit and at rest, sensitive records again with their own key. Passwords are hashed rather than stored. Marks, notes and the access log can only be added to, and that is enforced by the database rather than by the application, so it holds even if the application is wrong. One school's records cannot be reached from another school's session. A complete backup of a school can be taken and restored from. Nightly encrypted backups are being introduced, and this notice will say so once they are running rather than before.

The Trust page goes through all of this properly. If something does go wrong and it puts personal information at risk, we tell the affected school and the Information Regulator, as section 22 of POPIA requires.

Your rights

You can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct anything that is wrong or out of date;
• delete something, where we are not required to keep it by the school's retention windows or by a legal duty of our own;
• stop doing something we do on the basis of our legitimate interest, if you object to it;
• stop sending you anything.

Write to [email protected]. We may ask you to confirm who you are before we act, because handing a record to the wrong person is the failure this is all meant to prevent. We answer as quickly as we can and within thirty days.

For anything about a pupil, ask the school. The rights above are still yours, but it is the school that must answer, because it is the school that decides. We will help it do so promptly. There is no whole school download in the product today, so if a school needs a copy of its records we produce it for them.

If you live in the United Kingdom or the European Union and you use this site, you have the equivalent rights under UK and EU data protection law, including access, correction, erasure, restriction, objection and portability, and you can complain to your own supervisory authority.

Complaining to the Information Regulator

If you are unhappy with how a school or we have handled your information, you can complain to the Information Regulator of South Africa. You do not have to come to us first, though we would rather have the chance to put it right.

POPIA complaints

[email protected]

General enquiries

[email protected]

Telephone

010 023 5200, or 0800 017 160 toll free

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Website

inforegulator.org.za

Changes to this notice

When this notice changes, the new version appears here with a new date at the top. If a change matters to what happens to a school's information, we tell the school rather than leaving it to be noticed.

How to reach us

Ross Walker, Information Officer, THE CREATIVE CLAN GROUP LTD, 3 Bakehouse Mews, Hampton, England, TW12 2NL.

Email [email protected], or use the contact form. A person reads both.