Privacy Policy

GMT-SAMS (Pty) Ltd is the responsible party for personal information processed through the Platform, as defined under POPIA. We determine the purpose and means of processing personal information collected via the Platform and are accountable for its lawful handling.

If you have any questions about how we handle personal information, you can contact us at hello@gmt-sams.co.za.

GMT-SAMS collects and processes the following categories of personal information:

• School details — school name, EMIS number, province, and contact details.
• Staff information — names, email addresses, and roles of administrators and teachers.
• Learner information — first and last names, admission numbers, LURITS/EMIS numbers, dates of birth, gender, grade, class, and parent or guardian contact numbers.
• Usage data — login times and actions taken within the Platform, collected for audit trail and compliance purposes.

GMT-SAMS does not collect payment card details. All invoices are settled by electronic funds transfer (EFT) and no card or banking credentials are entered into or stored on the Platform.

We collect and process personal information for the following purposes:

• To provide the Platform and its features, including attendance tracking, mark capture, conduct management, timetabling, and finance management.
• To support SA-SAMS and CEMIS compliance reporting as required by the Department of Basic Education.
• To generate attendance records, mark reports, and conduct logs for use by authorised school staff.
• To send system notifications, invoices, and support communications to the school.
• To maintain audit trails as required by DBE guidelines and as part of our obligations under POPIA.

GMT-SAMS processes personal information on the following grounds:

• Consent — the school, as the responsible party, consents to the processing of personal information by accepting our Terms of Service.
• Contractual necessity — processing is required to fulfil the service agreement between GMT-SAMS and the school.
• Legal obligation — processing is necessary to comply with obligations under the South African Schools Act and POPIA.
• Legitimate interest — processing is carried out in the legitimate interest of maintaining accurate, complete, and up-to-date school records.

Data storage

All data entered into the Platform is stored on Google Cloud infrastructure in the africa-south1 region (Johannesburg, South Africa). Data does not leave South Africa in the ordinary course of providing the Platform.

Security measures

Data is encrypted in transit using TLS and encrypted at rest using industry-standard encryption. Access to school data is role-based and strictly limited to authorised users within your school and to GMT-SAMS support staff when assisting with a support request. All access to personal information is logged and forms part of the Platform's audit trail.

Data retention

School data is retained for the duration of the subscription. On termination of the subscription, data is retained for a further 60 days to allow the school to request an export. After 60 days, all personal information is permanently deleted from our systems unless a written retention request has been made and agreed to by both parties.

GMT-SAMS does not sell personal information or share it with third parties for commercial purposes. Data may be shared only in the following limited circumstances:

• Google Cloud — as our infrastructure provider, Google Cloud processes data on our behalf and is bound by a data processing agreement that meets POPIA requirements.
• GMT-SAMS support staff — authorised staff may access school data when investigating or resolving a support request raised by the school.
• Government bodies — data may be disclosed to the Department of Basic Education or provincial education departments only where required by law.

Under POPIA, the school as the responsible party, and individual data subjects whose information is held on the Platform, have the following rights:

• The right to access personal information held about them.
• The right to request correction of inaccurate, incomplete, or outdated personal information.
• The right to request deletion of personal information, subject to any applicable legal retention obligations.
• The right to object to the processing of personal information on reasonable grounds.
• The right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

To exercise any of the above rights, please contact us at hello@gmt-sams.co.za. We will respond within a reasonable time and in accordance with POPIA.

The admin web application uses session cookies for authentication purposes only. These cookies are necessary to keep you logged in and are removed when you log out or close your browser session.

No third-party tracking, advertising, or analytics cookies are used on the Platform. Usage data, including page visits and actions taken within the Platform, is collected solely for audit trail and support purposes and is not shared with any advertising or analytics provider.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will notify registered schools by email at least 30 days before any material changes to this policy take effect. The effective date at the top of this page will be updated accordingly.

Continued use of the Platform after a change to this policy takes effect constitutes acceptance of the updated policy.

For questions about this policy, to request access to your personal information, or to exercise any of your rights under POPIA, please contact us at hello@gmt-sams.co.za.

If you are not satisfied with our response, or if you believe that we have processed your personal information unlawfully, you have the right to lodge a formal complaint with the Information Regulator of South Africa at inforegulator.org.za.