Lunge Privacy Policy

1. Who we are

Lunge Premium (Pty) Ltd operates digital products, including Netademix, our school management and learning platform. This policy explains how we handle personal information when you visit our websites, contact us, register an account, or use Netademix. Other Lunge products may require additional notices.

• Information Officer: Nhlakanipho Khumalo (Director)
• Email: info@lunge.co.za
• Telephone: +27 72 507 1175
• Physical Address: 164 Voortrekker Road, Maitland, Cape Town, 7405, South Africa

2. Our role and your school’s role

Responsibility depends on why information is collected and who determines its use. For school records, the school will generally determine educational and administrative purposes as the responsible party. Lunge processes that information on its behalf as an operator under a written agreement.

Lunge may act as responsible party for activities it determines independently, including website enquiries, customer relationships, billing and service security. Read your school’s privacy notice alongside this policy.

3. Information we collect

Depending on your role, enabled features and institutional setup, information may include names, contact details, account identifiers, roles and authentication information; school and staff details; learner identifiers, enrolment, attendance, assignments, submissions, assessments, grades and reports; and parent or guardian relationships and authorised account links.

We may also process communications and support requests; subscription details, invoices and transaction references; IP addresses, device details and access logs; live-class participation and lawfully authorised recordings; and configured transport routes, vehicles and location information.

Health, biometric and other sensitive information requires additional safeguards and an appropriate notice explaining the purpose and lawful basis. We do not require every category from every user.

4. How we obtain information

We may receive information directly from you, your school, an authorised parent or guardian, an account administrator, your use of our services or a provider supporting an agreed feature. People supplying information must have appropriate authority and provide any notices required by law.

5. Why we use personal information

We use information to create accounts, manage authorised access, deliver school administration and learning services, link families to learner records, support assessments and communications, and deliver enabled classroom or transport features.

Other purposes include billing, support, investigating problems, protecting accounts, maintaining security, meeting legal obligations and improving reliability using appropriately limited information. We will not use information for an incompatible new purpose without establishing a lawful basis and providing required notice.

6. Our lawful basis for processing

Depending on the activity, processing may be necessary to perform an agreement, comply with law, protect a legitimate interest recognised by law or act on valid consent. We do not rely on consent for every activity.

Where consent is required, we will explain it. You may withdraw consent without affecting earlier lawful processing. We will explain if withdrawal prevents an optional feature from operating. Accepting our terms does not give unrestricted permission to use information.

7. Children’s personal information

Children’s information requires particular care. The relevant responsible party must establish a lawful basis under POPIA, including prior consent from a competent person, such as an appropriately authorised parent or guardian, where required.

Adults supplying a child’s information must have appropriate authority. A school’s involvement does not automatically replace legally required consent. Public promotional use of a learner’s name, photograph, work or recording requires separate consideration and appropriate authorisation.

8. Who can access school records

Access should be limited to authorised roles. Teachers, administrators, learners and families may have different permissions. Parent access depends on verified learner links and lawful access rights.

Schools must keep staff permissions and family links accurate, including changes arising from departures, guardianship or court orders. Lunge must implement the access controls agreed for its service. If you unexpectedly see another person’s information, stop accessing it and report the issue; do not copy or distribute it.

9. Live classes and recordings

Where live-classroom recording is enabled by a school or organiser, the school must explain whether recording occurs, its purpose, who can access it, its retention period, and how participants can raise concerns.

Where recording is activated, sessions may capture video feeds, incoming and outgoing audio, in-session text chat, shared screens or whiteboard presentations, and attendance timestamps. Learners and participants are notified visually and audibly when a session is being recorded. Unrecorded sessions process audio and video data in real time without persistent storage. Users must not independently record, screenshot, or redistribute sessions without lawful authority.

10. Transport and location information

Where enabled, location information supports route operation, safety monitoring, and authorised family visibility. Vehicle location and individual learner transit status are collected strictly during active, scheduled transport runs.

Location data originates from designated driver mobile devices or integrated vehicle telemetry. Tracking initiates only when a driver starts an assigned route and ceases immediately upon trip completion. Real-time location is restricted to authorised school administrators and verified parents or guardians linked to learners on that route. Location records are retained for an operational period of 30 to 90 days before deletion or de-identification, unless an incident report or safety investigation requires retention. Location data is never made publicly accessible or used for unrelated tracking.

11. Sharing information

We may share personal information with authorised users within the relevant school or learning community; third-party service providers supporting our infrastructure, communications, payments, and security; confidential professional advisers where necessary; and authorities where required by law.

Service providers acting on our behalf are bound by written data protection and confidentiality agreements. We share data only with the following provider categories:

We do not sell personal information or disclose learner records to advertisers or third parties for marketing purposes.

• Cloud Infrastructure & Hosting: Google Cloud Platform
• Database & Storage Services: Managed database and cloud hosting providers
• Transactional Communications: Automated email delivery and SMS notification gateway services
• Payment Processing: Licensed payment gateways and PCI-DSS compliant acquiring partners
• System Monitoring & Security: Application telemetry, logging, and performance observability providers

12. Information processed outside South Africa

Netademix primary systems and databases are hosted on Google Cloud Platform infrastructure. Where personal information is hosted or transferred outside the borders of the Republic of South Africa, Lunge complies with Section 72 of the Protection of Personal Information Act (POPIA).

This is accomplished by ensuring recipient territories maintain data protection laws substantially similar to POPIA, or by binding third-party cloud infrastructure providers to enforceable data processing agreements and cross-border data transfer terms that guarantee equivalent protections.

13. Security and security incidents

We will maintain reasonable technical and organisational safeguards appropriate to the information and risks, including access management, confidentiality controls and incident investigation.

If a compromise occurs, we will investigate, take appropriate remedial steps and make legally required notifications. As operator, we will notify the relevant responsible party as required. Users should protect credentials and promptly report suspected compromise.

14. How long we keep information

We retain personal information only as long as necessary to fulfill lawful educational and operational purposes, service agreements, or statutory duties:

• School & Learner Records: Retained for the duration of the school’s active service agreement with Netademix; returned, archived, or permanently deleted within 60 to 90 days of contract termination or upon formal instruction from the school.
• Transport & Location Logs: 30 to 90 days following route completion.
• Classroom Recordings: Retained in accordance with the individual school’s configured policy (typically 30 days to the end of the current academic year).
• Billing, Invoicing & Financial Records: 5 years, as required by Section 29 of the South African Tax Administration Act.
• System Backups: Automated database snapshots rotate on a 30-day retention schedule before permanent overwrite.

15. Your rights

Subject to law, you may request access, correction or appropriate deletion; object to certain processing; or withdraw consent where processing relies on it. We may need to verify identity and authority, especially for a child’s information.

For school-controlled records, contact the school first. Lunge will assist or direct requests to the appropriate responsible party. Recordkeeping duties or other people’s rights may limit a request; we will explain any restriction. Send requests to info@lunge.co.za.

16. Cookies and similar technologies

Netademix and Lunge websites use strictly necessary first-party cookies and local storage tokens. These are used solely to authenticate user sessions, maintain system security, and store interface preferences (such as light or dark display mode).

We do not deploy third-party advertising cookies, cross-site tracking scripts, or behavioural profiling mechanisms. Users can control cookie settings through their browser preferences, though disabling essential session cookies may prevent account login.

17. Marketing

Electronic marketing must have a lawful basis and provide an opt-out. Essential security and subscription notices are separate from marketing preferences. We will not use school-provided learner contact details for unrelated marketing.

18. Automated and AI-assisted features

Netademix provides optional AI-assisted educational tooling (such as automated quiz, homework, and assessment generation from uploaded curriculum materials or textbooks). These workflows are orchestrated through automated workflow processing (n8n) and powered by Google Gemini API models.

This functionality processes strictly the educational content and curriculum texts provided; it does not ingest, process, or expose learner personal records, student submissions, or identifying school information to the AI model. Content processed via these API integrations is not used to train or refine general-purpose public models. Netademix does not perform automated profiling or execute significant decisions affecting learners without human educator review.

19. Complaints and policy changes

For privacy questions, access requests, or complaints regarding this policy, contact our Information Officer at info@lunge.co.za.

If an enquiry or complaint is not addressed to your satisfaction, you have the right under POPIA to lodge a complaint with South Africa’s Information Regulator:

We may update this policy as our services, features, or legal obligations evolve. Material changes will be communicated via the platform, and the current version will always display its active effective date.

• Website: inforegulator.org.za
• POPIA Complaints: POPIAComplaints@inforegulator.org.za
• PAIA Complaints: PAIAComplaints@inforegulator.org.za