Privacy Policy

Luma Learn / Responsible Party / "we", "us", "our"

The organisation that determines the purpose of and means for processing personal information collected via the Platform. (Referred to in POPIA as the "responsible party".)

Platform / Luma Learn WhatsApp Learning Platform

The digital service offered by Luma Learn that delivers learning materials, AI-assistance, past papers and related educational services over WhatsApp and associated systems (including any web admin portals, databases, and integrations used to deliver the service).

User / Data Subject

Any natural person who uses the Platform or whose personal information is processed by Luma Learn (including learners, parents/guardians, teachers and institutional contacts).

Learner

A User who is a student or pupil using the Platform to access learning content or services.

Parent / Guardian / Competent Person

The natural person legally competent to make decisions on behalf of a child (a "competent person" under POPIA), including giving or withholding consent where required.

Academic Institution

A school, university or other educational provider that interacts with or registers learners on the Platform.

Personal Information

Any information relating to an identifiable, living natural person — for example a name, contact details, identity or passport number, date of birth, education records, performance data, or other identifiers. This definition aligns with POPIA's definition of personal information.

Child

A natural person under the age of 18 (POPIA defines a child as any natural person under 18 who is not legally competent to take action for themselves). Luma Learn gives special protection to personal information of children.

Processing

Any operation or activity (automated or manual) performed on personal information — e.g., collection, storage, use, disclosure, retrieval, transmission, erasure or destruction. This mirrors POPIA's conception of "processing."

Operator / Service Provider

A third-party organisation or person that processes personal information on behalf of Luma Learn (for example hosting providers, payment processors, messaging platforms or analytics providers). Under POPIA an operator acts only on the instructions of the responsible party.

Third Party

Any person or entity other than Luma Learn, the User, or an Operator — for example educational partners, government bodies or other service providers to whom we may lawfully disclose information.

Consent

A voluntary, specific, informed expression of will by which a data subject (or a competent person on behalf of a child) authorises the processing of personal information for a specific purpose. (POPIA recognises consent as one lawful basis for processing and also sets out other lawful bases.)

Information Regulator

The independent regulatory authority established by POPIA that oversees compliance, issues guidance and enforces data protection requirements in South Africa.

Cookies and Similar Technologies

Small data files, identifiers or tracking technologies used by the Platform or third parties to enable functionality, analytics, session management and user experience improvements.

2.1. WhatsApp Form

When a user signs up via WhatsApp, we collect their:

• Phone number
• First name
• Grade
• School
• Province
• Language
• Subjects

This helps us give learners the right content for their grade and subjects.

2.2. Website Form

Users may also sign up through our website at www.lumalearn.ai. The information collected is the same as via WhatsApp and is used solely to provide access to the learning platform.

2.3. Anonymisation

All personal information is anonymised after collection. This means that names, phone numbers, and other identifying details are removed before using the data for reporting, research, or improving the platform.

We do not track users outside of Luma Learn or collect any information we don't need to provide learning services.

3.1. To Deliver Educational Services

We use personal information to:

• Provide learners with access to textbooks, past papers, and study content through WhatsApp and our web platform.
• Personalise the learning experience based on grade, subject, or academic level.
• Enable parents and teachers to support learners' progress.
• Offer AI-powered tutoring and feedback within the boundaries of our educational materials.

3.2. To Communicate with Users

We may use contact details to:

• Send platform updates, learning tips, or service announcements.
• Respond to questions or technical issues.
• Provide reminders or progress updates to parents and guardians (where applicable).

3.3. To Improve and Research Educational Outcomes

We analyse anonymised usage data (such as the number of active users, subjects accessed, or learning performance trends) to:

• Improve the quality and relevance of our learning content
• Identify and resolve technical issues
• Understand which subjects or grades need more support

In certain cases, Luma Learn may share anonymised and aggregated data with trusted third-party partners, such as academic researchers, educational organisations, or funders to:

• Conduct independent studies on learning outcomes or access to education
• Support the development of education policy and technology in South Africa and beyond

All shared data is strictly anonymised so that no learner, parent, or institution can be identified. No personally identifiable information (such as names, phone numbers, or messages) is ever shared for research or reporting purposes.

3.4. To Comply with Legal and Safety Obligations

Luma Learn may use or keep information where required by law, or when necessary to:

• Protect the safety and wellbeing of learners.
• Prevent misuse or unauthorised access to our systems.
• Meet record-keeping, reporting, or compliance requirements under South African law.

3.5. Consent for Children Under 18

In line with Section 35 of POPIA, Luma Learn only processes the personal information of a child (any person under 18 years old) with the consent of a competent person, usually a parent or legal guardian.

Where consent is required, we make sure it is:

• Informed (the guardian understands what is being collected and why)
• Voluntary (no service is conditional on unnecessary personal data)
• Specific (only used for the purposes explained in this policy)

Luma Learn's platform is designed to minimise data collection and to protect the identities of learners as far as possible.

4.1. Secure Systems and Encryption

• All personal information shared through our WhatsApp platform and web forms is transmitted through encrypted and secure connections.
• Data stored on our servers is protected using industry-standard encryption, firewalls, and access controls.
• We use reputable third-party service providers (such as hosting and messaging partners) that meet recognised security and privacy standards.

4.2. Limited Access to Personal Information

• Only authorised members of the Luma Learn team, such as administrators or technical staff have access to personal information, and only when necessary to perform their duties.
• All staff and partners are bound by confidentiality agreements and trained in data protection responsibilities.
• We do not give direct access to personal data to teachers, schools, or third parties unless it is essential for delivering educational services and permitted by law.

4.3. Data Anonymisation and Minimisation

• Wherever possible, we remove or anonymise identifiers such as names and phone numbers before using data for analysis or reporting.
• We only keep the minimum amount of personal information necessary to operate the platform effectively.
• Research and performance reports use aggregated, anonymised data that cannot identify individual learners or users.

4.4. Storage and Retention

• Personal information is stored securely for as long as it is needed to provide our educational services or meet legal requirements.
• Once personal information is no longer required, it is securely deleted or anonymised.
• Users (or parents/guardians, in the case of minors) may request deletion of personal information at any time, as permitted under POPIA.

4.5. Third-Party Security Compliance

• When we use trusted service providers (for example, web hosts or analytics tools), we ensure they have appropriate security, privacy, and POPIA-aligned data protection measures in place.
• These providers may only process personal information on Luma Learn's behalf and cannot use it for their own purposes.

4.6. Monitoring and Breach Response

• We regularly monitor our systems for security vulnerabilities.
• In the unlikely event of a data breach, Luma Learn will promptly investigate, take corrective action, and notify the Information Regulator and affected users as required by POPIA.

5.1. Trusted Service Providers (Operators)

We use carefully selected third-party service providers to help us deliver our platform safely and effectively. These include:

• Cloud hosting and data storage services
• Secure communication and messaging systems (e.g., WhatsApp)
• Technical support and analytics services

Each provider is only permitted to handle anonymised data on behalf of Luma Learn and may not use or share it for their own purposes.

5.2. Research and Reporting Partners

Luma Learn may share aggregated and anonymised data with approved research institutions, education organisations, or development partners to:

• Evaluate the impact of our learning programs.
• Improve educational tools and accessibility.
• Support evidence-based decision-making in the education sector.

No information that can personally identify a learner, parent, or school will ever be shared in these reports or research projects.

5.3. Academic Institutions and Guardians

In limited cases, we may share learning progress summaries or performance trends with a learner's school or parent/guardian but only:

• With the consent of the learner's competent person (parent or guardian)
• In anonymised or limited format (e.g., "Grade 9 learners in this school improved in English")

We do not share any private messages, contact information, or identifiable learning records without explicit consent.

5.4. Legal or Regulatory Requirements

In rare situations, Luma Learn may be legally required to disclose information for example, to comply with a valid court order, law enforcement request, or statutory reporting obligation.

In such cases, we will:

• Limit disclosure strictly to what the law requires.
• Notify affected users (or guardians) where legally permitted.
• Continue to protect privacy and security at every stage.

5.5. Mergers or Organisational Changes

If Luma Learn ever merges with another organisation or transfers its operations, only anonymised user data will be transferred, and the same privacy protections described in this policy will continue to apply.

6.1. Consent From a Parent or Guardian

If you are under 18, Luma Learn will only collect, use, or store your personal information with permission from your parent or legal guardian (called a "competent person" under the Protection of Personal Information Act, or POPIA).

Your parent or guardian gives consent when they register you on the platform, complete a sign-up form, or confirm your participation in any Luma Learn program.

We may contact your parent or guardian directly to:

• Verify consent or update their contact details.
• Share learning progress reports (if requested).
• Provide important updates about your use of the platform.

6.2. Limited Collection and Use

• We collect only the minimum information necessary to deliver your learning materials, such as your name, grade, and subject preferences.
• We do not collect unnecessary details, and we do not use your information for marketing or advertising.

6.3. Anonymisation and Safety

All learner information is anonymised before it is used for reporting, analysis, or research. This means:

• Your name, number, and other identifiers are removed.
• You cannot be identified in any reports, statistics, or partnerships we share.
• Your privacy and identity remain fully protected.

6.4. Direct Communication

Luma Learn communicates primarily through WhatsApp. For learners under 18, we encourage parents or guardians to:

• Review messages between Luma Learn and the learner.
• Supervise platform use where possible.
• Contact us if they have any privacy concerns.

6.5. Learners' Rights

If you are under 18, or a parent/guardian of a minor using Luma Learn, you have the right to:

• Ask what information we have about you.
• Request correction or deletion of that information.
• Withdraw consent for processing at any time.

We will always honour these requests in line with POPIA and our duty to protect children's personal information.

7.1. Reporting Concerns or Misuse

Users, parents, or guardians are encouraged to report any suspected abuse or misuse of personal information immediately.

This includes situations where:

• Personal information is shared without consent.
• Messages, data, or files appear suspicious.
• Someone misrepresents Luma Learn or attempts to collect information unlawfully.

Reports can be sent to:

• 📧 info@lumalearn.africa
• 📞 +27 83 271 5104

We also encourage parents or guardians to report privacy concerns on behalf of learners under 18.

7.2. Luma Learn's Response

Upon receiving a complaint or report, Luma Learn will:

• Investigate the matter promptly and fairly.
• Take corrective measures, such as suspending access or updating systems.
• Notify affected users (and the Information Regulator, if required under POPIA).
• Document the incident and implement safeguards to prevent recurrence.

7.3. Breach of Policy or Misconduct

Any staff member, partner, or service provider found to have misused or mishandled personal information may face:

• Disciplinary action, including termination of contracts or employment.
• Reporting to the appropriate authorities or professional bodies.
• Legal action in accordance with POPIA and South African law.

7.4. User Responsibilities

To help us protect everyone's data, users and parents/guardians are asked to:

• Keep communication with Luma Learn respectful and secure.
• Avoid sharing private passwords, login details, or sensitive data via WhatsApp.
• Notify us immediately if a learner's device is lost, stolen, or compromised.

8.1. Notification of Changes

If this Privacy Policy is updated:

• A notice will be shared on our website and WhatsApp platform,
• The updated version will include a revised "last updated" date, and
• In the case of material changes, users (and parents or guardians of learners under 18) will receive a short message or email summarising the update.

We encourage users and guardians to review the Privacy Policy periodically to stay informed about how we protect personal information.

8.2. Continued Use as Acceptance

By continuing to use the Luma Learn Platform after changes to this Privacy Policy are communicated, users indicate that they have read, understood, and accepted the updated terms.

If any user or guardian does not agree with the changes, they may contact Luma Learn to withdraw consent or request deletion of their personal information.

8.3. Ongoing Commitment

Even as our platform evolves, Luma Learn's commitment to privacy and data protection remains unchanged. We will continue to apply strong security standards and safeguard the rights of learners, parents, and educators in full compliance with POPIA.