Who we are
Khutso is a South African educational technology platform operated by Khutso Learning. We provide exam practice and instant feedback to Grade 7, 8 and 9 learners in South Africa. Our registered contact email is enquiries@m-khutso.com.
Our commitment
We serve learners from communities that have historically been let down by systems that did not protect them. We take that responsibility seriously. We collect only what we need, store it securely and never sell or share your information with anyone who does not need it to deliver our service.
What information we collect
For learners we collect full name, grade and WhatsApp number.
For parents or guardians we collect a WhatsApp number for POPIA consent purposes and monthly progress notifications.
We also collect submitted worksheet answers and photographs for marking purposes.
We do not collect ID numbers, physical addresses, financial information beyond what Paystack processes on our behalf or any information that is not directly necessary to provide the Khutso service.
Why we collect it
Learner information is collected to create and manage their account, generate appropriate worksheets, mark submitted work and track their progress over time.
Parent or guardian WhatsApp number is collected to obtain verifiable consent for processing a minor's personal information as required by the Protection of Personal Information Act 4 of 2013 and to send monthly progress notifications via WhatsApp.
How we store it
All data is stored on Supabase infrastructure hosted in the European Union West region. Personal information including WhatsApp numbers is encrypted at rest. Row Level Security is enabled on all database tables containing personal information.
Who has access
Only Khutso's authorised personnel have access to personal information. We do not sell, rent or share personal information with third parties for marketing purposes. The following third party services process data on our behalf: Supabase, OpenAI, Paystack and WhatsApp Business API via Meta as the message delivery service.
Children's privacy
Khutso is designed for learners who may be minors. We require verifiable parental or guardian consent before processing a minor's personal information. A learner's account is not fully activated until that consent is confirmed.
Your rights under POPIA
You have the right to know what personal information we hold about you, request correction, request deletion, object to processing and lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.
Contact us at enquiries@m-khutso.com. We will respond within 30 days.
Data retention
We retain learner data for as long as the account is active. If an account is inactive for 24 months we will notify the contact on file and delete the account within 30 days unless instructed otherwise.
Data breaches
In the event of a data breach we will notify the Information Regulator and affected users within 72 hours of becoming aware of the breach. Notifications to users will be sent via WhatsApp to the number registered on their account.
Changes to this policy
We may update this Privacy Policy from time to time. We will notify users of material changes via WhatsApp. Continued use of Khutso after notification constitutes acceptance of the updated policy.