POPIA (Data Protection) Policy

1. Purpose

This policy outlines how Easy2Swim Swimming Academy collects, processes, stores, shares, and protects personal information in compliance with the Protection of Personal Information Act (POPIA) of South Africa.

It ensures that all personal data belonging to learners, parents, employees, and contractors is handled lawfully, securely, and transparently.

2. Scope

This policy applies to:

• All Easy2Swim staff, contractors, and volunteers
• All learners and parents or guardians who provide personal information
• Any third-party service providers (e.g. Brevo, Google Drive, WordPress) who process data on behalf of Easy2Swim

3. Definitions

4. Policy Statement

Easy2Swim Swimming Academy is committed to:

• Processing personal information lawfully and fairly
• Collecting only information necessary for legitimate operational, educational, or legal purposes
• Maintaining accurate and up-to-date records
• Storing all data securely to prevent loss, unauthorised access, or misuse
• Providing clear communication about how information is used

5. Types of Information Collected

We may collect and store:

• Learner Information: Name, age, date of birth, medical details, progress records
• Parent/Guardian Information: Names, contact details, billing information
• Employee Information: Qualifications, police clearance certificates, contracts, payroll data
• Marketing Information: Email addresses and preferences for newsletters or updates (with consent)

6. Purpose of Collection

Personal information is collected to:

• Enrol learners in swimming and training programmes
• Provide safe and individualised instruction
• Maintain attendance, progress, and certification records
• Communicate with parents and guardians
• Meet health-and-safety or legal obligations
• Process payroll and human-resources functions for staff

7. Consent and Rights of Data Subjects

Consent will be obtained for the collection of any sensitive data (e.g. medical information or photography use).

8. Storage and Security

9. Data Retention and Disposal

• Learner and staff records are retained for five years after completion or employment termination, unless otherwise required by law
• Records are securely deleted or shredded after the retention period expires

10. Third-Party Data Processors

Where Easy2Swim uses third-party systems (e.g. Brevo for emails or Google Drive for storage), these partners must also comply with POPIA or equivalent international data-protection standards.

No data will be shared with unauthorised third parties.

11. Data Breach Procedure

12. Staff Training

All staff receive annual training on POPIA awareness, confidentiality, and secure information handling. New staff are introduced to this policy during induction.

13. Monitoring and Review

The Information Officer will review this policy annually or following any regulatory changes. Updates will be communicated to all staff and reflected on Easy2Swim's internal policy register.