Privacy Policy

Last updated: April 2026

1. Who We Are

Qulu Education operates the website qulu.co.za, an online educational platform providing South African learners with past examination papers, memoranda, quizzes, and study tools for Grades 10 to 12. In this policy, "we", "us", and "our" refer to Qulu Education.

2. What Data We Collect

We collect the following personal information when you register for and use our platform:

• Account information: first name, last name, email address, and password (stored as a secure hash).
• Profile information: date of birth, grade level, and school name.
• Usage data: quiz results, test scores, study progress, papers viewed, and download history.
• Technical data: IP address, browser type, and session information for security purposes.

3. Why We Collect It

We use your personal information to:

• Provide and operate our educational services, including access to past papers, quizzes, and study tools.
• Personalise your learning experience by adapting content to your grade level and tracking your progress over time.
• Communicate with you about your account, service updates, and important notices.
• Improve our platform through aggregated, anonymised usage analytics.
• Process payments for Pro subscriptions.

4. Legal Basis for Processing

We process your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). Our lawful basis for processing is your informed, voluntary, and specific consent, which you provide when you register for an account and accept this policy. You may withdraw your consent at any time by contacting us or deleting your account, though this may affect your ability to use our services.

5. Children's Data

Qulu is designed for learners aged 13 and older. In compliance with Section 34 of POPIA, if a user is under the age of 18, we require the consent of a parent or legal guardian before processing their personal information. During registration, learners under 18 are required to provide a parent or guardian's email address. We send a consent request to the parent or guardian, and full account functionality is only enabled once consent is confirmed.

Parents and guardians can withdraw consent at any time by contacting us at privacy@qulu.co.za.

6. Who We Share Data With

We do not sell your personal information to any third party. We only share data with the following service providers, who process data on our behalf under strict confidentiality agreements:

• Hostinger: our web hosting provider, which stores and serves your data on secure servers.
• PayFast: our payment processor, which handles Pro subscription payments. PayFast receives only the information necessary to process your transaction.
• Brevo (formerly Sendinblue): our email service provider, used to send account verification emails, password reset links, and important service notifications.

We may also disclose your information if required by South African law or a valid court order.

7. How Long We Keep Data

We retain your personal information for as long as your account is active. If you delete your account, we will retain your data for a maximum of two years after deletion to comply with any legal obligations, after which it is permanently deleted. Anonymised, aggregated usage data (which cannot identify you) may be retained indefinitely for platform improvement.

8. Your Rights

Under POPIA, you have the following rights regarding your personal information:

• Access: you may request a copy of the personal information we hold about you.
• Correction: you may request that we correct or update inaccurate or incomplete information.
• Deletion: you may request that we delete your personal information, subject to any legal obligations that require us to retain it.
• Data portability: you may request your personal data in a structured, commonly used format.
• Objection: you may object to the processing of your personal information in certain circumstances.

9. How to Exercise Your Rights

To exercise any of the above rights, please email us at privacy@qulu.co.za. We will respond to your request within 30 days, as required by POPIA. We may need to verify your identity before processing your request.

10. Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it, including:

• All data transmitted between your browser and our servers is encrypted using HTTPS (TLS).
• Passwords are hashed using bcrypt and are never stored in plain text.
• Access to personal data is restricted to authorised personnel only.
• We regularly review and update our security practices.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. If you become aware of any security breach, please contact us immediately.

11. Cookies

We use session cookies only, which are essential for the operation of our platform (e.g., keeping you signed in). We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. Session cookies are automatically deleted when you close your browser.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email at the address associated with your account and update the "Last updated" date at the top of this page. Your continued use of the platform after changes are posted constitutes acceptance of the revised policy.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact our Information Officer:

• Email: privacy@qulu.co.za
• Website: qulu.co.za

You also have the right to lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg.