Privacy Notice

1. About this Privacy Notice

This Privacy Notice explains how K2026684028 (SOUTH AFRICA) (PTY) LTD, registration number 2026/684028/07, trading as Paper Kite Learning ("Paper Kite Learning", "PKL", "we", "us" or "our"), processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

It applies when you visit paperkitelearning.co.za, contact us, use our support channels, or purchase or access a digital educational resource through a checkout or delivery platform linked from our website.

This Notice should be read together with our Terms and Conditions and, when you use an external checkout or delivery platform, that provider's own privacy and cookie information.

2. Who is responsible for your information?

Paper Kite Learning is the responsible party for the personal information for which we determine the purpose and means of processing. External platforms and service providers may process information on our behalf as operators, or for their own purposes where their terms and applicable law make them independently responsible.

3. Personal information we process

Depending on how you interact with us, we may process:

• Identity and contact information: your name, purchase or contact email address, and telephone number if you telephone us or choose to provide it.
• Order and transaction information: order reference, purchase date, product, amount, payment status, download or access status, and related refund, support or dispute records.
• Communications: emails, telephone notes and other information you send when you ask a question, request support, exercise a privacy right or raise a complaint.
• Technical and security information: information generated by the website, hosting infrastructure or linked platforms, such as an IP address, browser or device information, request time, requested page, download event, and access or security logs.
• Compliance and business records: records reasonably needed for accounting, tax, fraud prevention, legal claims, audits and regulatory compliance.
• Learner-related information: limited information you voluntarily include in a support request. We do not ask for a learner's identity number, school, marks or other sensitive learner information unless it is genuinely necessary and lawfully processed.

Information that a learner writes into or onto a downloaded resource ordinarily remains on the learner's or purchaser's own device or printed copy. We do not receive that information unless it is deliberately sent to us.

4. How we collect personal information

• Directly from you when you email or telephone us, submit a privacy request, or communicate about an order.
• From a linked sales or delivery platform when you place an order, receive a download, request a refund or raise a platform-related support matter.
• Automatically from the website, hosting or security infrastructure where basic technical logs are generated to deliver, secure and troubleshoot the service.
• From advisers, authorities or other lawful sources where necessary for a legal obligation, dispute or investigation.

Information is voluntary unless a form, checkout or legal requirement says otherwise. If you do not provide information that is necessary for an order, delivery, identity verification, support request or legal obligation, we may be unable to complete the relevant action.

5. Why we process personal information

6. Purchases, Payhip and payment information

Where a product page links to a Payhip checkout or delivery page, Payhip collects and processes information needed to operate that page, complete or record the order, deliver the file, prevent abuse and provide platform services. Payhip may provide us with customer and order information such as a buyer's name, email address, product, transaction status and download activity.

Payment details are submitted to the payment service made available through the checkout. Paper Kite Learning does not ordinarily receive or store your full payment-card number, card verification value or online-banking credentials. The payment platform or processor handles that information under its own terms and privacy notice.

Payhip's privacy notice is available at payhip.com/privacy. Check the checkout page for the identity and terms of the active payment processor before completing payment.

7. When we share personal information

We may share personal information only where reasonably necessary with:

• Payhip and the active payment processor used for checkout, payment status and digital delivery.
• Website hosting, security, email and technical service providers used to operate and protect the service.
• Accountants, lawyers, insurers or other professional advisers where confidentiality and the purpose require it.
• Regulators, courts, law-enforcement bodies or other authorities when disclosure is required or lawfully permitted.
• A lawful successor or transaction counterparty if the business is reorganised or transferred, subject to appropriate confidentiality and data-protection measures.

We do not sell or rent personal information.

8. Cookies and website technology

At the effective date of this Notice, the public Paper Kite Learning website does not intentionally use analytics cookies, advertising cookies, social-media tracking pixels or remarketing technology. Basic technical logs may still be generated by hosting and security infrastructure to deliver pages, maintain availability, prevent abuse and diagnose faults.

A linked platform such as Payhip operates separately and may use cookies or similar technology on its own pages. Its cookie and privacy information applies when you use those pages. If we later add non-essential analytics, advertising or similar technology to our own website, we will update this Notice and implement an appropriate consent mechanism before using it where required.

9. Direct marketing

Paper Kite Learning does not currently use personal information to send newsletters, promotions or other direct marketing. Order confirmations, download messages, support replies, service corrections, security notices and legally required communications are operational messages rather than marketing.

If we introduce electronic direct marketing, we will first implement the consent or existing-customer process required by applicable law and provide a simple way to opt out.

10. Children and learner information

Our educational resources are intended for school learners, but purchases should be completed by a parent, guardian or other competent adult. We do not intend to create direct customer accounts for children or knowingly collect personal information directly from children through the current website.

If you are under 18, please ask a parent, guardian or other competent person to contact us or submit information on your behalf. A parent or guardian may purchase a resource for one authorised learner in accordance with our Terms and Conditions.

If we unexpectedly receive a child's personal information without an appropriate lawful basis or the required authorisation, we will restrict its use, seek the involvement of a competent person where appropriate, and delete or de-identify it when required.

11. Cross-border processing

Some providers that support the website, email, checkout, payment or digital delivery may process or store information outside South Africa. Payhip states that it uses infrastructure in the European Union and may make international transfers in connection with its service.

Where personal information is transferred outside South Africa under our responsibility, we use a ground permitted by section 72 of POPIA, such as an adequate legal framework, binding corporate rules or agreement that provides appropriate protection, consent where appropriate, or a transfer necessary for a contract or your benefit. You may contact us for more information about the safeguards relevant to your information.

12. Security and data breaches

We use reasonable and appropriate technical and organisational measures designed to protect personal information against loss, damage, unauthorised destruction, unlawful access or unauthorised processing. Measures are selected according to the nature of the information and the risks, and may include access restrictions, minimisation, service-provider controls, secure credentials, updates, backups and incident procedures.

No system is completely secure. If there are reasonable grounds to believe that personal information under our control has been accessed or acquired by an unauthorised person, we will investigate and notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to POPIA and any lawful delay or exception.

13. How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, required or authorised by law, reasonably needed for accounting, tax, audit, fraud prevention, complaint handling or legal claims, or retained with valid consent. Different records therefore have different retention periods.

When retention is no longer authorised or necessary, we delete, destroy or de-identify the information in a manner that prevents reconstruction, subject to practical backup cycles and lawful holds.

14. Your rights

Subject to POPIA and any applicable limitations, you may:

• ask whether we hold personal information about you;
• request access to the personal information we hold, subject to the applicable procedure and any prescribed fee;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to retain;
• object to processing on a lawful ground and object to direct marketing;
• withdraw consent where processing is based on consent, without affecting processing that was lawful before withdrawal;
• complain to us or submit a complaint to the Information Regulator; and
• receive information about a security compromise where notification is required by law.

These rights are not absolute. For example, we may retain information where law requires it or where it is reasonably needed for a contract, dispute, investigation or legal claim.

15. How to exercise a privacy right

Email info@paperkitelearning.co.za with the subject line “Privacy request”, or use the contact details in section 18. Describe the information or action you are requesting and provide enough detail for us to locate the relevant record.

We may ask for proportionate information to verify your identity, protect another person's information, or confirm that you are authorised to act for a learner or another data subject. Please do not send an identity-document copy unless we specifically and lawfully request it.

We will respond within the period required by law. We may explain if a request must be refused, deferred, limited or subject to a prescribed fee.

16. Complaints to the Information Regulator

We encourage you to contact us first so that we can try to resolve the matter. You may also complain directly to the Information Regulator (South Africa).

The Regulator may change its contact channels or forms. Check its official website for the current complaint process before submitting.

17. Changes to this Notice

We may update this Notice when our services, providers, technology or legal obligations change. The current version will be published on our website with its effective or last-updated date. Material changes will be communicated in an appropriate way before or when they take effect.

18. Contact Paper Kite Learning