Privacy policy

IFORM365 AND CARA PRIVACY POLICY

 

Business: Sevensoft (Pty) Ltd

Document version: 1.0

Last updated: 2026-10-06

 

1. PURPOSE AND SCOPE

 

This Privacy Policy explains how Sevensoft (Pty) Ltd ("we", "us", or "our") processes personal information through the iForm365 website, the CARA application, and associated online forms.

 

The current services support teacher and learner registration, attendance capture by authorised teachers, and the printing of related learner records.

 

The services are intended for authorised school administrators and teachers. Learner information, including children's personal information, may be submitted and processed by those authorised users.

 

School-related resources may be introduced in future. If a new feature changes how personal information is processed, we will update this policy and provide any notices or obtain any authorisations required by law before that processing begins.

 

2. RESPONSIBILITIES UNDER POPIA

 

We and the institutions using our services must comply with applicable South African data protection law, including the Protection of Personal Information Act, 2013 ("POPIA").

 

Where we process school information on an institution's authorised instructions, the institution acts as the responsible party and Sevensoft (Pty) Ltd acts as its operator.

 

For processing whose purposes and means we independently determine, such as our own service administration, subscription records, and website security, we act as the responsible party.

 

The institution must ensure that it has a lawful basis and the necessary authority to collect and submit information, including children's personal information. It must provide appropriate notices and manage access by its authorised users.

 

Acceptance of software terms does not replace any lawful basis or authorisation required for processing personal information.

 

3. PERSONAL INFORMATION PROCESSED

 

Depending on the features used, we process:

 

(a) Teacher names, email addresses, and registration details.

 

(b) School names, EMIS numbers, and authorised administrator contact details.

 

(c) Learner identifiers, registration details, class information, and attendance records.

 

(d) Information included in related learner records generated or printed through the services.

 

(e) Device identifiers and authentication information used to validate authorised access.

 

(f) School workbook backups, which may contain personal information recorded in the workbook.

 

(g) Subscription and payment-confirmation information where applicable.

 

(h) Information voluntarily included in support enquiries.

 

(i) Website technical information, which may include IP addresses, browser and device information, cookies, and service activity logs.

 

Additional teacher or learner fields collected:

Parent or guardian names, WhatsApp contact numbers, and/or email addresses are recorded so that the institution can notify parents or guardians about their child's absence.

 

These details are entered and managed by the institution's authorised application administrator. The institution is responsible for ensuring that it has the necessary authority and lawful basis to use these details for absence notifications and for keeping them accurate.

Passwords used for CARA's Azure authentication are stored as cryptographic hashes rather than readable plaintext.

 

4. SOURCES OF INFORMATION

 

Information is supplied by institutions, their authorised administrators and teachers, and individuals completing registration or support forms.

 

Technical information may be generated automatically through use of the website and services.

 

 

5. PURPOSES OF PROCESSING

 

We process personal information to:

 

(a) Register teachers and learners.

(b) Identify the relevant school and authorised users.

(c) Enable authorised teachers to capture attendance.

(d) Generate and print related learner records.

(e) Validate access and administer subscriptions.

(f) Synchronise school records and maintain backups.

(g) Restore records where an authorised recovery is required.

(h) Provide support and necessary service communications.

(i) Protect the services against misuse and security incidents.

(j) Comply with applicable legal obligations.

(k) Enable the institution, under the control of its authorised application administrator, to notify parents or guardians about learner absenteeism using the parent or guardian contact details it maintains.

 

We do not sell school personal information or use learner records for unrelated advertising.

6. CHILDREN'S PERSONAL INFORMATION

 

The services are operated by authorised adults but process learner information, including children's personal information.

 

The institution is responsible for ensuring that the collection and processing of learner information is lawful, including obtaining any required authorisation and providing appropriate notices.

 

We process that information for the agreed school-service purposes and on the institution's authorised instructions, except where otherwise required by law.

 

Access must be restricted to authorised persons. Learner records must not be made publicly available through the services.

 

Parents, guardians, and learners may direct enquiries about school-controlled records to the institution. We will assist the institution with relevant requests where appropriate and required by law.

 

7. SERVICE PROVIDERS AND INFORMATION SHARING

 

Microsoft Azure is used for authentication, school data storage, attendance processing, synchronisation, and backups.

 

Shopify hosts the iForm365 website and stores teacher registration information as customer profiles. In this context, "customer profile" is the platform's record type and does not mean that teachers are using a retail shopping service.

 

Teacher profiles contain names, email addresses, and any additional registration details recorded in them.

 

Authorised personnel and service providers may access information only where necessary to operate, support, or secure the services, or meet legal obligations.

 

We may disclose information where required by law or valid legal process.

 

 

8. STORAGE LOCATIONS AND CROSS-BORDER PROCESSING

 

School information is stored using Microsoft Azure resources in the South Africa North region.

 

Teacher profiles and website information processed through Shopify and its authorised service providers may be processed outside South Africa.

 

International processing is subject to applicable provider agreements, data-processing terms, and technical and organisational safeguards.

 

We must ensure that applicable cross-border transfer requirements under POPIA are met, including requirements relevant to children's personal information.

 

 

9. COOKIES AND TECHNICAL INFORMATION

 

The website uses cookies and similar technologies to support its operation and security.

 

We do not intentionally use optional analytics or advertising tracking technologies. Essential cookies and technical logs may still be used by the website platform to operate and secure the service.

 

Where required by law, non-essential tracking is subject to consent.

 

Users may manage cookies through available website privacy controls and browser settings. Blocking essential cookies may affect some website functions.

 

Information about Shopify cookies is available at:

https://www.shopify.com/legal/cookies

 

10. SECURITY

 

We use technical and organisational safeguards appropriate to the personal information processed.

 

Relevant service communications use HTTPS. CARA's Azure authentication passwords are stored as cryptographic hashes.

 

Institutions must protect their computers, restrict access to authorised users, and keep credentials confidential.

 

No system can guarantee absolute security. This does not remove our obligations under applicable law.

 

Suspected security compromises will be investigated and notifications made to institutions, affected individuals, and the Information Regulator as applicable and required by law.

 

Security enquiries:

admin@iform365.co.za

 

11. RETENTION

 

During an active trial or subscription, school records are retained for as long as reasonably necessary to provide the services and support the institution's authorised recordkeeping requirements.

 

Records may be deleted earlier on an authorised instruction, subject to applicable legal retention requirements.

 

After a trial or subscription expires, school records are retained for 90 calendar days to allow an authorised institution representative to request retrieval or arrange renewal. This does not automatically extend access to the application.

 

After that period, school records are deleted or de-identified unless continued retention is required by law or another lawful basis.

 

Requests received within the retrieval period will be processed before the requested records are deleted.

 

Cloud backups are retained during the active service and the 90-day retrieval period. Remaining backup copies are deleted within a further 30 days following deletion of the primary records. They are not used for ordinary service purposes during that deletion window.

 

Security logs are ordinarily retained for up to 12 months from creation. Relevant logs may be retained longer for security investigations, disputes, or legal obligations.

 

Subscription, accounting, and payment records are retained for the periods required by applicable law. Other service-administration records are retained only as long as reasonably necessary for their stated purposes.

 

Teacher registration profiles are retained for:

Teacher registration profiles

 

The institution's authorised application administrator controls teacher registration and deregistration at that school.

 

When a teacher is deregistered, their role at that school is changed to inactive. This does not automatically delete their Shopify registration profile, which may be used if the teacher is subsequently registered at another school.

 

Registration at another school does not grant access to the previous school's records.

 

A teacher may request deletion of their registration profile by emailing admin@iform365.co.za. We will verify their identity and assess the request, taking account of any current school registration and applicable legal retention requirements.

 

Inactive profiles will be reviewed periodically and deleted or de-identified when they are no longer reasonably needed for registration or another lawful purpose.

 

Deletion of a registration profile does not automatically delete historical school attendance records, which are retained separately according to the institution's lawful recordkeeping requirements.

Records retained under a legal obligation or legal hold are restricted to the relevant purpose.

 

 

12. ACCESS, CORRECTION, AND DELETION

 

Individuals may request access to or correction of their personal information, request deletion, or exercise other rights available under applicable law.

 

Where processing relies on consent, consent may be withdrawn, subject to applicable law. Withdrawal does not affect prior lawful processing.

 

We verify identity and authority before releasing or changing information. Passwords must not be included in requests.

 

Where the institution controls the relevant school records, we may refer the request to the institution or assist it in responding.

 

Requests are subject to applicable law, the rights of other individuals, and lawful retention requirements.

 

Contact:

admin@iform365.co.za

 

13. SCHOOL DATA RETRIEVAL

 

An authorised institution representative may request school records by emailing admin@iform365.co.za and supplying:

 

(a) The school name.

(b) The EMIS number.

(c) The records required.

 

Following verification, records will be supplied through a secure delivery method. Instructions will be sent to the institution's verified email address.

 

Available formats are CSV files for relevant datasets and, where available, an XLSB workbook backup for restoration.

 

There is no charge for exports through this procedure.

 

We aim to supply the requested records within 36 hours after verifying identity and authority and confirming the scope of the request. This is a target, not a guaranteed deadline.

 

If more time is needed because of complexity or support closures, we will advise the requester of the expected delivery date. Applicable statutory time limits remain binding.

 

Requests following subscription or trial expiry must be submitted within 90 calendar days. Retrieval after that period cannot be guaranteed because records may have been deleted or de-identified.

 

14. SUPPORT AND PRIVACY CONTACT

 

Support email:

admin@iform365.co.za

 

Support hours:

08:00 to 16:00 South African Standard Time (UTC+02:00) during official South African school terms.

 

Support is not available during school holidays or public holidays. These support arrangements do not override statutory obligations or deadlines relating to privacy requests or security incidents.

 

Business:

Sevensoft (Pty) Ltd

 

Privacy enquiries:

admin@iform365.co.za

 

Business or postal address:

7 Festival Street Jamestown Stellenbosch 7600

 

 

15. COMPLAINTS

 

Please contact us if you have concerns about how personal information is processed.

 

Individuals may also lodge a complaint with South Africa's Information Regulator.

 

Information Regulator:

enquiries@ inforegulator.org.za

 

16. CHANGES TO THIS POLICY

 

We will update this policy when our processing practices change and display the revised version and date.

 

Material changes will be communicated by email to the institution's registered administrator email address at least 30 calendar days before taking effect.

 

Where a shorter period is necessary for legal compliance or an urgent security risk, we will provide as much notice as reasonably practicable and explain the reason.

 

Institutions must keep their administrator contact details current. We will obtain any additional agreement, consent, or authorisation required by law.