Legal
Privacy Policy
How we collect, use, and protect your personal information.
Last updated: 1 September 2026
1. Who We Are
Evidina Tutoring is a private tutoring service operated by Franco Jonker, a sole trader based in Port Elizabeth (Gqeberha), Eastern Cape, South Africa. Our website is located at https://evidina.co.za.
Information Officer: Franco Jonker (operator)
Contact: info@evidina.co.za
Address: Gqeberha (Port Elizabeth), Eastern Cape, South Africa
As required by the Protection of Personal Information Act 4 of 2013 (“POPIA”), the operator of this website is the responsible party for the personal information described in this policy.
2. Personal Information We Collect and Why
We collect only the information reasonably necessary to provide our services. The table below lists what we collect, why, and the lawful basis under POPIA.
| Category | Examples | Purpose | Lawful basis |
|---|---|---|---|
| Contact information | Name, email address, phone number | Respond to enquiries; arrange and manage lessons | Contract performance |
| Location | Suburb, and the travel zone derived from it. We do not ask for a street address through this website. | Lessons take place in person at the student's home, so the suburb determines whether a lesson is possible and what travel fee applies | Contract performance |
| Student information | Grade or year of study, subject, learning goals | Personalise the tutoring approach and lesson plans | Contract performance |
| Scheduling preferences | Preferred session length and preferred days or times | Offer times that actually fit before we speak | Contract performance |
| Parent or guardian confirmation | A record that the person submitting the form confirmed they are the parent or legal guardian of the student, or are the student and 18 or older | Evidence of the consent required by section 35 of POPIA before a child's information may be processed | Legal obligation |
| Communication data | Messages sent via a form on this site or via WhatsApp | Respond to queries; maintain service records | Consent / legitimate interest |
| Technical data with a form submission | A salted, one-way hash of your IP address, and the page the form was submitted from. The IP address itself is never stored. | Limit how many submissions one connection can make, so the form cannot be used to flood the inbox | Legitimate interest |
| Website usage data | Pages visited, session duration, browser type, anonymised IP | Understand how the site is used; improve content and performance | Consent (cookie banner) |
We do not collect special personal information (as defined in section 26 of POPIA), such as race, health records, religious beliefs, or biometric data.
3. How We Use Your Information
- To respond to enquiries and schedule tutoring sessions
- To deliver and improve our tutoring services
- To send relevant updates about sessions or resources — only with your explicit consent, and you may unsubscribe at any time
- To analyse anonymous website usage statistics (only after you accept cookies via the banner on this site)
- To comply with applicable legal obligations
We will not use your personal information for any purpose incompatible with the original purpose of collection without first obtaining your consent.
4. Data Storage and Protection
Our website is hosted on Cloudflare Pages (Cloudflare, Inc., USA). All data transmitted to or from this website is encrypted in transit via TLS/HTTPS.
Where enquiries are stored. When you submit a form on this site, the enquiry is saved to a Cloudflare D1 database operated by us on Cloudflare's infrastructure, and a notification is then emailed to us. The database is the record; the email is only a notification. This means we hold your enquiry ourselves rather than relying on an inbox, and it is why the retention periods in section 6 are ours to honour rather than a third party's.
Your IP address is not stored with your enquiry. It is combined with a secret value and put through a one-way hash, and only that hash is kept, so it can be used to count recent submissions from the same connection but cannot be turned back into an address.
We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, or disclosure, including:
- HTTPS encryption for all web traffic
- HTTP security headers (Content Security Policy, X-Frame-Options, etc.)
- No storage of payment card details on our systems
- Access to personal information limited on a need-to-know basis
We do not sell, rent, or trade your personal information to any third party.
5. Third-Party Services and Cross-Border Data Transfers
We use the following third-party services which may receive or process your personal information. Where these services operate outside South Africa, this constitutes a cross-border transfer under POPIA. Such transfers are made where the recipient provides an adequate level of protection (e.g., via Standard Contractual Clauses or equivalent safeguards).
Google Analytics (Google LLC, USA)
We use Google Analytics to collect anonymous statistics about how visitors use this website (pages viewed, traffic sources, session duration). Google Analytics sets cookies and transfers usage data to Google's servers in the United States. This only occurs after you accept cookies via the banner on this site.
- Data collected: anonymised IP address, pages visited, browser type, device type, referring website
- Cross-border transfer destination: USA (Google LLC)
- Transfer safeguard: Google Standard Contractual Clauses
- Google Privacy Policy: policies.google.com/privacy
- Opt-out: Decline cookies via the banner on this site, or install the Google Analytics opt-out browser add-on
Cloudflare Turnstile (Cloudflare, Inc., USA)
Both forms on this site are protected by Cloudflare Turnstile, which distinguishes people from automated scripts. It runs when a form page loads, without requiring you to solve a puzzle.
- Data collected by Turnstile: your IP address, browser and device characteristics, and interaction signals from the page. Turnstile stores a value in your browser for its own operation.
- Why it is not consent-gated: it is strictly necessary to protect the form from abuse, is not used for advertising or profiling, and the form cannot be submitted without it
- Cross-border transfer destination: USA and Cloudflare's global network
- Cloudflare Privacy Policy: cloudflare.com/privacypolicy
EmailJS (EmailJS.com, USA)
After your enquiry is saved, EmailJS is used to deliver the notification email that tells us it has arrived. It is used only for that delivery; it is not used for newsletters or marketing, and it is not where your enquiry is stored.
- Data passed to EmailJS: the contents of your enquiry — your name, email address, phone number if given, suburb and travel zone, grade, subject, session length, preferred days, and your message
- Cross-border transfer destination: USA
- EmailJS Privacy Policy: emailjs.com/legal/privacy-policy
WhatsApp / Meta (Meta Platforms, Inc., USA)
We use WhatsApp for direct communication with students and parents. Messages sent via WhatsApp are processed by Meta Platforms, Inc.
- Cross-border transfer destination: USA and other jurisdictions where Meta operates
- WhatsApp Privacy Policy: whatsapp.com/legal/privacy-policy
Cloudflare Pages and D1 (Cloudflare, Inc., USA)
This website is hosted on Cloudflare Pages, and enquiries submitted through it are stored in a Cloudflare D1 database that we control. Cloudflare acts as our operator (processor) for that storage; it does not use the contents of your enquiry for its own purposes. Cloudflare may separately process server logs, including IP addresses, for security and performance.
- Data stored in D1: everything listed in the section 2 table, together with the date it was received and the date after which it may be deleted
- Cross-border transfer destination: Cloudflare's infrastructure, which is outside South Africa
- Cloudflare Privacy Policy: cloudflare.com/privacypolicy
6. Data Retention Periods
| Data category | Retention period |
|---|---|
| Enquiries that lead to tutoring | Duration of the tutoring relationship, plus 1 year after it ends |
| Enquiries that do not lead to tutoring | 24 months from the date received. Every enquiry is stored with the date after which it may be deleted. |
| Hashed IP values used for rate limiting | Retained only as long as needed to count recent submissions, and purged separately from enquiry records |
| WhatsApp communications | Per Meta / WhatsApp's data retention policy |
| Website analytics (Google Analytics) | 26 months (Google Analytics default retention setting) |
When personal information is no longer required for the purpose for which it was collected, we will take reasonable steps to delete or de-identify it. Deletion is carried out by us on review rather than by an automated job, so a record may persist for a short period after its expiry date. If you would like your enquiry deleted sooner, ask — see section 8.
7. Cookies and Consent
This website uses analytics cookies (Google Analytics) only. These are not set until you explicitly accept them via the consent banner displayed on your first visit.
To withdraw consent or change your preference: use the Cookie settings link at the bottom of any page on this site. You can switch analytics off again at any time, and doing so takes effect immediately — tracking stops in the page you are on, and the analytics cookies already stored on your device are deleted rather than merely ignored.
Separately from analytics, Cloudflare Turnstile stores a value in your browser on pages that contain a form. This is strictly necessary to tell people apart from automated scripts, is not used for advertising or profiling, and is not covered by the analytics banner because the form cannot work without it.
No cookies are used for advertising, retargeting, or profiling.
8. Your Rights Under POPIA
As a data subject under POPIA, you have the following rights:
- Access: request a copy of the personal information we hold about you
- Correction: request that inaccurate, incomplete, or outdated information be corrected
- Deletion: request erasure of your personal information, subject to our legal retention obligations
- Objection: object to the processing of your personal information, in particular for direct marketing purposes
- Restriction: request that we limit how we use your information in certain circumstances
- Portability: request your personal information in a structured, commonly used, machine-readable format
- Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal
To exercise any of these rights, contact the Information Officer at info@evidina.co.za. We will respond within 30 days as required by POPIA.
9. Right to Lodge a Complaint
If you believe we have not handled your personal information in accordance with POPIA, you may lodge a complaint with the Information Regulator of South Africa:
- Website: www.inforegulator.org.za
- Email: inforeg@justice.gov.za
- Telephone: 010 023 5207
We encourage you to contact us first so we can try to resolve your concern directly.
10. Data Breach Notification
In the event of a data breach likely to adversely affect your rights and freedoms, we will notify you and the Information Regulator of South Africa as soon as reasonably practicable, in accordance with the timeframes prescribed by POPIA.
11. Children's Privacy
Most of our students are school learners under the age of 18, so this is the ordinary case rather than an exception. Section 35 of POPIA requires the consent of a competent person before a child's personal information may be processed.
Every form on this site therefore requires you to confirm that you are the parent or legal guardian of the student, or that you are the student and 18 or older. This is checked when the form is received, not only in your browser: a submission without that confirmation is refused and is not stored. The confirmation is kept with the enquiry as the record of consent.
Where lessons go ahead, consent for the ongoing tutoring relationship is dealt with separately in the written agreement signed at the first lesson.
Parents or guardians who believe their child's information has been provided without proper authorisation should contact us at info@evidina.co.za and we will delete it.
12. Changes to This Policy
We may update this policy from time to time. The “Last updated” date at the top of this page reflects when changes were most recently made. Continued use of the website after changes are posted constitutes acceptance of the revised policy.
13. Contact
For any questions, requests, or concerns regarding this policy or your personal information, contact the Information Officer:
Franco Jonker
Evidina Tutoring
Port Elizabeth, Eastern Cape, South Africa
info@evidina.co.za