1. Parties
Operator: FutureReady Digital (Pty) Ltd, reg. 2026/345734/07, Gauteng, Johannesburg.
Responsible Party: ________________________________ (School name), a school registered and operating in the Republic of South Africa.
2. Definitions
- "POPIA" means the Protection of Personal Information Act 4 of 2013.
- "Operator" means FutureReady Digital, who processes personal information on behalf of the Responsible Party.
- "Responsible Party" means the School, who determines the purpose and means of processing.
- "Processing" has the meaning assigned in POPIA Section 1.
3. Scope and Purpose
FutureReady processes personal information on behalf of the School solely to provide the FutureReady Digital LMS and associated educational services as described in the Service Level Agreement. Processing categories include: learner identity data, learning progress data, mood check-in data, device access logs, and parent/guardian contact details.
4. Operator (FutureReady) Obligations
- Process personal information only on documented instructions from the School.
- Ensure staff with access to personal information are bound by confidentiality obligations.
- Implement appropriate technical and organisational security measures.
- Assist the School in responding to data subject rights requests within 5 business days.
- Notify the School of any data breach within 24 hours of becoming aware of it.
- Delete or return all personal information upon termination of the SLA.
- Host the platform, its database and uploaded files in South Africa (Google Cloud, Johannesburg), and transfer personal information outside South Africa only to the sub-processors listed in section 6, in line with section 72 of POPIA.
5. Responsible Party (School) Obligations
- Obtain and maintain written parental/guardian consent for all learners under 18.
- Ensure registration information is accurate and up to date.
- Notify FutureReady immediately if a parent or guardian withdraws consent.
- Ensure all platform users comply with the Acceptable Use Policy.
- Maintain a register of guardian consents available for inspection by the Information Regulator.
6. Sub-Processors
Approved sub-processors:
- Google Cloud - hosts the platform, its database and uploaded files in Johannesburg, South Africa.
- Resend - delivers emails, receiving the recipient's name and email address and the email content, in Ireland (European Union).
- Anthropic - powers the AI Study Assistant, only if the School turns it on, receiving the text a learner types into the assistant but not their name or account details, in the United States.
Transfers outside South Africa are made under section 72 of POPIA. FutureReady will notify the School of any intended changes. All sub-processors are bound by equivalent data processing obligations.
7. Data Subject Rights
FutureReady will assist the School in fulfilling data subject rights requests by providing relevant data within 5 business days of a written request. The School remains responsible for communicating with data subjects.
8. Security Measures
- Encryption at rest: Google Cloud encrypts all stored data, including the database and uploaded files, with AES-256. Sensitive fields such as ID numbers and medical information are encrypted again by the platform.
- Encryption in transit: all traffic uses HTTPS (TLS). Plain HTTP is redirected to HTTPS, and browsers are instructed to use HTTPS only (HSTS).
- Role-based access controls, so each user sees only what their role and school allow. The administration panel is limited to platform administrators, and login attempts are rate-limited.
- Automated tests covering school data separation and role-based access, and automated scanning of code changes for leaked secrets.
- Audit logging of logins, failed login attempts and administrative actions.
9. Breach Notification
FutureReady will notify the School within 24 hours of becoming aware of a breach. The School must notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA Section 22 requires. FutureReady will provide all information necessary for breach notification compliance.
10. Deletion and Return of Data
- Full data export provided to School within 7 business days of contract termination.
- All personal information securely deleted within 30 days of termination.
- Written confirmation of deletion provided to the School.
11. Duration and Termination
This DPA is effective from the date of signature and remains in force for the duration of the SLA. Provisions related to data deletion and confidentiality survive termination.
12. Signatures
By signing below, both parties agree to be bound by this Data Processing Agreement.
Return signed DPA to: legal@futurereadydigital.co.za