1. Introduction
MindtheHeart (“we”, “our”, or “us”) is a South African educational consultancy dedicated to developing excellence and sustainable character in schools, educators, and communities. We value your trust and are committed to protecting your personal information in accordance with the Protection of Personal Information Act (POPIA) [Act 4 of 2013] and applicable international data-protection standards such as the General Data Protection Regulation (GDPR) where relevant.
By engaging with our website, programmes, surveys, or consulting services, you consent to the collection and use of your personal information as set out in this policy.
2. Information We Collect
a) Website and Enquiries
When you contact us through our website, via email, or by completing an online form, we may collect:
Your name and surname
Email address and telephone number
School or organisation name
Any information you choose to include in your message
b) Consulting and Project Engagements
When we work directly with clients (schools or governing bodies), we may collect:
Contact details of authorised representatives
Role and position within the school or organisation
Responses from interviews, surveys, or assessments (e.g., Voice-of-Stakeholder studies or excellence maturity assessments)
Any documents voluntarily shared with us for project purposes
c) Cookies and Analytics
Our website uses essential and analytical cookies to improve functionality and user experience. We use Google Analytics for anonymised statistical analysis. You can disable cookies through your browser settings at any time.
We do not use cookies for behavioural advertising or tracking beyond our own analytics.
3. Purpose for Collecting Personal Information
We collect and process personal information only for legitimate, explicitly defined purposes, including:
Providing consulting, facilitation, or training services
Administering client relationships and project logistics
Responding to enquiries and requests for information
Conducting educational surveys and assessments
Improving our programmes, website, and communications
Complying with legal and contractual obligations
We will not use personal information for purposes other than those for which it was collected without your consent.
4. Lawful Basis for Processingies
Under POPIA and GDPR, our lawful bases include:
Consent: You voluntarily provide your information for a specific purpose.
Contractual necessity: Processing required to deliver our services.
Legitimate interest: For business administration, quality assurance, or research within the scope of education development.
Legal obligation: Where processing is required by law.
5. Data Storage and Security
MindtheHeart’s digital systems and email services are hosted on secure servers located in South Africa and the European Union. We implement appropriate technical and organisational measures to prevent unauthorised access, loss, or misuse of personal data, including SSL encryption, password protection, and restricted user access.
Where third-party platforms are used (e.g., Google Drive, Zoho Mail, SurveyMonkey, or Ticksy Support), we ensure that these providers comply with POPIA, GDPR, or equivalent data-protection standards.
6. Sharing of Personal Information
We will not sell, rent or disclose your personal information to unauthorised third parties. However, we may share limited data when necessary to fulfil our services or legal obligations, including:
Service Providers: Trusted partners providing IT support, data hosting, email delivery, or survey software.
Project Partners: Independent research associates or consultants directly engaged in MindtheHeart projects under confidentiality agreements.
Legal and Regulatory Authorities: If required to do so by law or court order.
All third parties are bound by confidentiality agreements and required to handle your information in accordance with POPIA.
7. Retention of Data
We retain personal information only for as long as it is necessary for the purposes for which it was collected or as required by law. Project-related information is typically retained for five years following completion unless a client requests earlier erasure or a longer period is legally required.
8. Your Rights under POPIA and GDPR
You have the right to:
Access the personal information we hold about you
Request correction or updating of inaccurate data
Request deletion of personal data (where legally permissible)
Withdraw consent for specific processing activities
Object to the processing of your information for non-essential purposes
Lodge a complaint with the Information Regulator (South Africa) if you believe your rights are being infringed
Information Regulator Contact Details:
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za
9. Cross-Border Transfers
Where data is transferred outside South Africa (e.g., for cloud storage in the EU or support platforms such as Zoho or Google), we ensure that adequate protection measures are in place and that the recipient is subject to a law or binding agreement that upholds data protection principles similar to POPIA.
10. Children’s Information
Our consulting and research services often engage with schools and learners. All personal data from minors (under 18 years of age) is collected only with the explicit consent of a parent, guardian, or the school acting in loco parentis. We do not collect any child’s personal information for marketing purposes.
11. Third-Party Websites and Embedded Content
Our website and publications may contain links to external websites (such as social media or YouTube resources). We are not responsible for the content or privacy practices of those sites. You are encouraged to read the privacy policies of any linked websites before sharing personal information.
12. Legal Disclosure
MindtheHeart may disclose personal information where required to comply with lawful requests from authorities or to protect its rights, clients, and data integrity. Such disclosure will be limited to the minimum necessary information and done in good faith and in accordance with POPIA.
13. Changes to this Policy
We may update this Privacy Policy from time to time to reflect legal changes or improvements in our practices. The latest version will always be available on our website, and the effective date will indicate when it was last revised.
English 
Afrikaans