PRIVACY POLICY Effective Date: 1 October 2026
Tutor ya Rena — Your Maths and Science Tutor · NTSWAKAZA HOLDINGS (PTY) LTD

WHO WE ARE AND WHAT THIS POLICY COVERS

1. We are NTSWAKAZA HOLDINGS (PTY) LTD (registration number 2026/684248/07) of 16 Dartford Drive, Parklands, Cape Town, Western Cape, 7441 (“NTSWAKAZA”, “we”, “us” or “our”). We are the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”) for the personal information described in this policy.

2. This policy covers the personal information we process through Tutor ya Rena — Your Maths and Science Tutor — the learning application and website at ntswakazah.co.za (the “Service”). A word not defined in this policy has the meaning given to it in our Terms and Conditions of Use.

3. The Service is built for school learners, and many of them are children.

CHILDREN

1. We process a child's personal information only with the prior consent of a competent person — the parent or legal guardian, whom our Terms and Conditions of Use call your Guardian.

2. We ask whether you are 18 or older when you create an account. Where you are under 18, we ask for the email address or mobile number of a competent person and send that person a request. We begin processing your personal information only once that person has agreed, and until then you may use only the sample questions. Where a competent person buys a Paid Plan for you, that person gives the consent at checkout. We record who agreed, when, and which version of this policy they saw.

3. We give children a short explanation, in plain language a learner can understand, of what the Service collects and what happens to it.

4. We do not use a child's personal information for marketing, for advertising or to profile the child.

5. A competent person may exercise every right in the Your rights clause on the child's behalf, and may withdraw consent at any time. Withdrawal does not affect processing already done.

6. Trying the Service without an account. You may try a fixed set of sample questions without creating an account. We do not ask for your name, age, nickname or contact details, we do not keep anything about you or your device on our servers, and nothing you do in the trial is linked to an account you later create. Because we collect no personal information in the trial, a parent’s consent is not needed for it.

WHAT WE COLLECT

1. Learner profile: the nickname you choose, your grade and your subject choices. The nickname does not have to be your real name. You must give a nickname, a grade and subjects — without them the Service cannot work.

2. Learning records: your progress and mastery for each topic; your practice and tutor attempts, being the subject, topic, skill and whether you answered correctly; and your streak and study-day count.

3. Usage counts: a count of your use of the AI Features, so that usage limits can be applied and abuse prevented.

4. What you send to an AI Feature: the question you type, speak, photograph or select from a paper; the working or answer you type; your grade, subject, curriculum topic and mastery level for that topic; and page images of a scanned paper, but only when you press “Process paper”; and the text you ask to have read aloud, when you use Read Aloud.

5. Kept in your browser or on your device, not on our servers: your nickname, grade and subject choices; the past papers you paste or upload and the questions extracted from them; your current tutor lesson and the working you type during it; saved simulations; a copy of your progress, mastery, streak and attempt history; and your accessibility and reading preferences.

6. Billing information: if you buy a Paid Plan, PayFast collects and processes your payment details as its own responsible party. We do not store card numbers. We keep a record of the transaction.

7. Email address: we do not require an account, a password or your school. If you buy a Paid Plan we collect an email address so that we can send you the confirmation, receipts and notices about your plan, and so that we can reach you if your personal information is ever compromised.

8. Where we get it: your personal information comes to us from you, and from our payment provider, which confirms payment outcomes to us. If we collect your personal information from any other source, we will tell you the source.

9. Special personal information: we do not ask for, and do not want, information about your health, religion or beliefs, race or ethnic origin, trade union membership, sex life or biometrics, or about criminal behaviour. Please do not type it into the tutor or into a support request. If you include it anyway, we use it only to deal with your request, relying on the consent you give by providing it, and we redact or delete it once your request is resolved.

WHY WE USE IT

1. We process personal information only with a lawful basis under section 11 of POPIA. We use:

2. the learner profile and the learning records to provide the Service, to keep your progress and to give you tutoring, because the processing is necessary to perform our agreement with you and, where you are a child, on the competent person's consent;

3. transaction records to meet the tax and other obligations that the law imposes on us;

4. usage counts to enforce usage limits, to secure and operate the Service and to prevent abuse, in our legitimate interest in running a reliable service;

5. what you send to an AI Feature to produce the Output you asked for, because the processing is necessary to perform our agreement with you and, where you are a child, on the competent person's consent; and

6. support records to resolve your requests, to perform our agreement with you.

7. For analytics we use learning and usage information only in aggregated or de-identified form that does not identify you.

8. We do not sell personal information. We do not use it for advertising, we do not share it with advertisers, and we do not use third-party trackers.

AI-ASSISTED TUTORING

1. An AI Feature runs only when you ask for it — by asking the tutor, generating practice, pressing “Process paper”, using Read Aloud, or using another function that states that it uses artificial intelligence.

2. We send the AI Provider only what the What you send to an AI Feature paragraph lists. We never send your nickname, your school or your contact details.

3. Our AI Provider is Lovable Labs Incorporated (“Lovable”), which provides the AI Features through its AI Gateway using models from Google (Gemini) and OpenAI. Lovable processes that information as our operator under its Data Processing Agreement, which binds it to keep the information confidential and secure, to tell us of any security compromise, and not to use personal information to train or develop artificial-intelligence models.

4. Lovable and the model providers it uses process the information outside South Africa, including in the United States. The Cross-Border Transfers clause applies. We do not keep the photographs or documents you upload.

SECURITY

1. We protect personal information with appropriate, reasonable technical and organisational measures against loss, damage, unauthorised destruction, and unlawful access or processing. Those measures are: encryption of personal information in transit and at rest; access controls and authentication for everyone who can reach it; logging and monitoring; regular backups; vulnerability management; and confidentiality undertakings from our staff and service providers. We review them regularly against current risks and generally accepted security practices.

SECURITY COMPROMISES

1. If we have reasonable grounds to believe that an unauthorised person has accessed or acquired your personal information, we will notify the Information Regulator, through its eServices portal, and — if we can identify you — notify you, as soon as reasonably possible after we discover the compromise (section 22 of POPIA). We may delay notifying you only where a public body responsible for investigating the compromise, or the Regulator, determines that a delay is needed for a criminal investigation.

2. Our notice to you will be in writing — by a prominent notice in the Service and on our website, by email where we have an address for you, or as the Regulator directs — and will give you enough information to protect yourself, including what happened, the categories of information involved, the identity of the unauthorised person if we know it, what we have done to contain the compromise, and what you can do. Where the compromise affects a child's personal information, we notify the competent person as well, where we are able to.

RETENTION

1. We keep personal information only as long as a purpose in this policy or a law requires: the learner profile and learning records for 24 months after you last use the Service; transaction records for five years, or seven years where the Companies Act 71 of 2008 requires; usage counts for 12 months; and support records for 36 months. We then delete or de-identify the information. Deleted information may persist in encrypted backups for up to 30 days more; we do not use it during that period.

COOKIES AND WHAT IS KEPT IN YOUR BROWSER

1. The Service uses cookies and browser storage only to make it work: to keep your place, to remember your nickname, grade, subject choices and reading preferences, and to hold your lesson, working and saved papers on your device. We do not use advertising cookies and we do not use third-party trackers. You can block or delete cookies in your browser, but the Service may then stop working.

2. Our website may link to other websites. Their own privacy notices apply to them.

YOUR RIGHTS

1. You may ask us, free of charge: what personal information we hold about you and who has had access to it; to correct or delete it (Form 2 under the POPIA Regulations, or any similar written request); to object to processing (Form 1 or any similar request, in writing or by telephone — we record telephone objections); and, where processing rests on consent, to withdraw that consent at any time, which does not affect processing already done. Where you are a child, a competent person may exercise these rights for you. The Service also gives you controls that delete your progress, mastery, streak and attempt history, your learner profile, and the papers saved on your device, without making a request to us. We may charge the prescribed fee for copies of records, as our PAIA manual sets out.

2. We do not make decisions that have legal consequences for you, or that affect you substantially, based solely on automated processing of your personal information intended to profile you (section 71 of POPIA). If we ever propose to, we will tell you first, give you the opportunity to make representations, and apply the other safeguards that section 71 requires.

3. We may ask you to prove your identity before we act on a request. We respond to correction, deletion and objection requests within 30 days, and to access requests within the time PAIA allows (normally 30 days).

4. Send requests to our Information Officer, whose details appear at the end of this policy. We respond as POPIA and the Promotion of Access to Information Act 2 of 2000 require; our PAIA manual, published at ntswakazah.co.za, describes the procedure and any fees.

5. If you are not satisfied, you may complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; telephone 010 023 5200 (toll-free 0800 017 160); POPIAComplaints@inforegulator.org.za (complaints) or enquiries@inforegulator.org.za (general enquiries); www.inforegulator.org.za. You may also lodge a complaint on the Regulator’s eServices portal at eservices.inforegulator.org.za.

WHO WE SHARE IT WITH

1. Service providers (“operators” under POPIA) that process personal information for us — our hosting provider, our AI Provider and our payment provider. Each acts only with our knowledge and authorisation, under a written agreement that binds it to keep the information confidential, to secure it, and to tell us immediately if it reasonably believes the information has been accessed or acquired without authorisation. Our hosting provider is Lovable and our payment provider is PayFast.

2. Our professional advisers, where needed for advice or to handle a claim.

3. Authorities, where a law requires the disclosure. We will notify you before disclosing unless the law prohibits the notice.

4. A buyer or prospective buyer of our business, under confidentiality. This policy continues to apply to transferred personal information, and we will notify you of the transfer.

CROSS-BORDER TRANSFERS

1. The Service and our own systems are hosted by Lovable. Lovable's transfers of personal information are governed by its Data Processing Agreement, which incorporates the European Union's Standard Contractual Clauses. Where a service provider processes personal information outside South Africa, we transfer it only to a recipient that is subject to a law, binding corporate rules or a binding agreement giving the information a level of protection substantially similar to POPIA, including restrictions on onward transfer. We will tell you, on request, in which countries your personal information is processed.

CHANGES TO THIS POLICY

1. We may update this policy. We publish the current version in the Service and at ntswakazah.co.za, and we will tell you about a material change, in the Service, before it takes effect. Where a new feature of the Service processes personal information this policy does not describe, or processes it for a purpose this policy does not describe, we update this policy before that feature goes live. Where you are a child, we tell the competent person as well, where we are able to.

INFORMATION OFFICER AND CONTACT

1. Our Information Officer is Kholofelo Makwela, reachable at support@ntswakazah.co.za, registered with the Information Regulator. No deputy Information Officer has been appointed.