Data Processing Agreement

Working draft — not yet legally reviewed.

This is the template we work from, published for transparency — it isn't itself a signed agreement, and it hasn't been reviewed by a South African attorney. The version that legally applies to your school is the one incorporated into your signed contract with us.

Last updated: August 2026

1. Purpose and scope

This Data Processing Agreement (DPA) describes how Gelezanathi ("Operator") processes personal information on behalf of a school ("Responsible Party") under South Africa's POPIA, as part of the school's underlying agreement with Gelezanathi. This page sets out the template terms we work from — the version that applies to your school is the one incorporated into your signed agreement.

2. Nature and purpose of processing

Gelezanathi processes personal information to provide assessment creation, automated marking, performance analytics, and intervention plan generation for the Responsible Party's school.

3. Categories of data subjects and data

Data subjects: learners, teachers, and school administrative staff.
Categories of data: names, grades, classes, contact details for staff, and assessment responses and results for learners.

4. Duration

Processing continues for the duration of the Responsible Party's agreement with Gelezanathi, and data is handled after termination as described in our Privacy Policy.

5. Operator obligations

Process personal information only on the Responsible Party's documented instructions, or as needed to provide the platform.
Apply the technical and organisational security measures described on our Security page.
Keep personal information confidential and limit access on a role and school basis.
Notify the Responsible Party without undue delay if we become aware of a personal information breach affecting their data.
Reasonably assist the Responsible Party in responding to data subject requests it receives.
Notify the Responsible Party before appointing a new sub-processor that will handle their data.

6. Responsible Party obligations

The school confirms it has a lawful basis for the personal information it provides to Gelezanathi, including any consent required from parents or guardians, and that its instructions to us comply with POPIA.

7. Sub-processors

We use a small number of infrastructure and service providers — for example, cloud database and hosting providers, and providers used to power in-platform AI features — to run Gelezanathi. We'll provide a current list of sub-processor categories on request, and notify schools of material changes.

8. Security measures

Summarised on our Security page: encryption in transit and at rest, role- and school-scoped access, backups, and an incident response process.

9. International transfers

Where a sub-processor handles data outside South Africa, we take reasonable steps toward a level of protection consistent with POPIA.

10. Term and data return

On termination of the underlying agreement, we'll delete or return the Responsible Party's data in line with our Privacy Policy, except where we're required to retain it for legitimate administrative, financial, or legal reasons.

11. Execution

This template is incorporated into, and forms part of, a school's signed service agreement with Gelezanathi. A finalised, signed copy specific to your school is provided during contracting — this page isn't itself a substitute for that signed agreement.