1. Who We Are

Toppers Tutoring Pty Ltd (registration pending), trading as X-Area, is a South African company that provides a cloud-based tutoring management platform ("the Platform") to educational organisations, tutoring centres, and similar institutions ("Clients").

For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA) and the EU General Data Protection Regulation (GDPR), Toppers Tutoring Pty Ltd acts as the Responsible Party / Data Controller in respect of personal information collected directly from users of the Platform.

Where Clients use the Platform to manage their own students and staff, Toppers Tutoring Pty Ltd acts as an Operator / Data Processor on behalf of those Clients (who are the Responsible Parties for that data).

2. What Personal Information We Collect

We collect personal information in the following categories, depending on your role:

2.1 Platform Administrators, Managers & Tutors (Organisation Members)

• Full name and email address
• Phone number (optional)
• Job role within the organisation
• Login credentials (password stored as a secure hash; we never store plaintext passwords)
• Date and time of account creation and terms acceptance
• Activity logs (pages accessed, actions taken, for security and audit purposes)

2.2 Students

• Full name and email address
• Phone number (optional)
• Home address (optional)
• Education level, and your university if you are a university student
• The sponsor or funder paying for your tutoring, where your organisation asks and you have one
• Answers to any further questions your organisation adds to its registration form — for example your date of birth, your school or grade, or a parent's or guardian's contact details
• A copy of your latest report card, where your organisation asks for one
• Student identification number (auto-generated by the Platform)
• Attendance records: session dates, check-in and check-out times, attendance status (present, late, absent, excused)
• Subject enrolments
• Excuse notes and supporting reasons
• Assessment work you submit: typed answers, and any files you upload — including photographs of handwritten working
• Marks awarded, and the feedback your tutor writes on your work

2.3 Material Uploaded by Organisation Members

• Question papers, diagrams and images attached to assessments
• Documents and materials attached to sessions and announcements

Uploaded files are stored in our database provider's file storage and are reachable only through short-lived signed links generated when an authorised person opens the page. They are not publicly addressable.

2.4 Information Collected Automatically

• IP address and browser/device type (stored in server logs for up to 30 days)
• Session tokens (stored client-side in a secure, HTTP-only cookie)
• Product usage information: pages you open and actions you take in the Platform — for example creating a session, publishing an assessment, or submitting work — together with the identifiers described below

The Platform does not itself ask for special personal information (e.g. race, religion, health or biometric data). The exceptions are an excused absence, where a student or guardian may provide such information voluntarily, and an organisation's own registration questions (section 2.2), which could ask for it. We advise organisations not to ask for special personal information unless they have a lawful basis to; where one does, it is the Responsible Party for that information.

3. How and Why We Use Your Information

We do not use your personal information for direct marketing without your separate consent.

Where we rely on legitimate interests, you may object to that processing — see section 7.

4. How We Share Your Information

We do not sell your personal information. We share it only in the following circumstances:

4.1 Sub-Processors

We use the following third-party service providers who process personal information on our behalf under written data processing agreements:

Supabase complies with GDPR as a data processor and provides a Data Processing Agreement (DPA). Database records and uploaded files are hosted in Ireland, within the European Economic Area.

PostHog and Resend process information in the United States. Section 5 sets out what this means for you.

4.2 Client Organisations

Student data entered into the Platform is accessible to the Client organisation (the tutoring centre or school that engaged with X-Area). Clients are responsible for their own compliance with POPIA and other applicable data protection laws in respect of their students' data. Each Client also decides which of its students' details its tutors can see (section 2.2).

4.3 Legal Disclosure

We may disclose personal information if required to do so by law, court order, or where we reasonably believe disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

4.4 Business Transfers

If Toppers Tutoring Pty Ltd is acquired, merged, or undergoes a similar transaction, personal information may be transferred to the successor entity, subject to the same obligations under this Policy.

5. Cross-Border Transfer of Personal Information

Your account records, attendance data and uploaded files are stored on servers located in Ireland (EU), operated by Supabase Inc. Ireland is a member state of the European Union and is subject to the GDPR, which provides a level of data protection that meets the adequacy threshold recognised by South Africa's Information Regulator under POPIA Section 72.

Two categories of information are processed in the United States. Product usage information (section 2.4) is processed by PostHog Inc., and the content and recipients of transactional email are processed by Resend. The United States has not been recognised as providing an adequate level of protection by South Africa's Information Regulator or by the European Commission in general terms, so these transfers rely on contractual safeguards with each provider rather than on adequacy.

For users in the European Economic Area, information held in Ireland requires no further transfer mechanism. The United States transfers described above are subject to the safeguards referred to in this section.

For users in the United Kingdom, processing is conducted in accordance with the UK GDPR and the Data Protection Act 2018.

For users in other jurisdictions, we implement appropriate safeguards including contractual clauses and technical security measures to protect your information in compliance with applicable local laws.

6. Data Retention

Note on assessment files. Removing a file from an assessment, or deleting the assessment itself, removes it from the Platform so that no one can reach it. The underlying stored copy is not yet erased automatically. If you want a file permanently erased, contact us using the details in section 12 and we will remove it.

After the applicable retention period, data is securely deleted or irreversibly anonymised.

7. Your Rights

Depending on your location, you have the following rights regarding your personal information:

7.1 Rights under POPIA (South Africa)

• Right of access: Request confirmation of whether we hold your personal information and obtain a copy.
• Right to correction or deletion: Request that we correct inaccurate or delete unnecessary information.
• Right to object: Object to the processing of your personal information.
• Right to complain: Lodge a complaint with the Information Regulator (see Section 13).

7.2 Additional Rights under GDPR (EU/EEA & UK)

• Right to erasure ("right to be forgotten"): Request deletion of your personal data in certain circumstances.
• Right to data portability: Receive your personal data in a structured, machine-readable format.
• Right to restrict processing: Request restriction of processing in certain circumstances.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

7.3 Rights under CCPA (California, USA)

• Right to know what personal information is collected and how it is used.
• Right to delete personal information.
• Right to opt out of the sale of personal information (we do not sell personal information).
• Right to non-discrimination for exercising these rights.

To exercise any of these rights, contact our Information Officer at info@topperstutoring.com. We will respond within 30 days (POPIA / GDPR standard).

8. Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, or disclosure, including:

• All data in transit is encrypted using TLS 1.2 or higher.
• All data at rest is encrypted by our infrastructure provider (Supabase / AWS).
• Passwords are hashed using industry-standard algorithms and never stored in plaintext.
• Access to production systems is restricted to authorised personnel only.
• Row-level security policies restrict each organisation's data to that organisation only.
• Session tokens are rotated on authentication and stored in secure, HTTP-only cookies.

In the event of a data breach that is likely to result in a risk to data subjects' rights, we will notify the Information Regulator within 72 hours as required by POPIA and GDPR, and will notify affected data subjects without undue delay.

9. Cookies and Session Data

We use no advertising cookies and we do not allow third parties to track you across other websites. We do use a product analytics cookie, described below.

You may disable cookies in your browser settings, but this will prevent you from logging in.

10. Children's Privacy

The Platform may be used by Client organisations to manage attendance for students who are minors. In such cases, the Client organisation is responsible for obtaining any necessary parental or guardian consent in compliance with applicable law, including POPIA Section 35 (processing of personal information of children).

This includes any additional registration details and any report card an organisation asks its students for (section 2.2). Where a student is under 18, the organisation must have the consent of a parent or guardian before collecting them.

Direct accounts on the Platform (administrators, managers, tutors) are limited to individuals who are 18 years of age or older.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via an in-platform notification and/or email at least 14 days before taking effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

Where required by law (e.g. where changes affect rights under GDPR), we will obtain your explicit consent before the changes take effect.

11.1 What changed on 26 September 2026

This version corrects and expands our description of how the Platform works. In summary:

• Organisations can now ask students for more when they register: a home address, answers to questions the organisation adds — such as date of birth, school or a guardian's contact details — and a copy of their latest report card.
• We explain that each organisation decides what it asks for and which student details its tutors can see, and that tutors only see the students they teach.
• We describe how report cards are kept private, and how long registration details and report cards are kept.
• We have clarified that an organisation's own registration questions could ask for sensitive information, and that parental consent is needed for students under 18.

Every account holder was notified by email and in the Platform. From 10 October 2026 you will be asked to confirm you have read this version the next time you sign in.

12. Contact Us & Information Officer

13. How to Lodge a Complaint

If you believe we have not handled your personal information appropriately, please contact us first at info@topperstutoring.com so that we can resolve the matter. You also have the right to lodge a complaint directly with the relevant supervisory authority: