Purpose and Scope
This agreement governs the processing of personal information by the Platform on behalf of the School to provide video-based educational assessment services. It establishes the rights and obligations of each party with respect to personal information processed in connection with the Taal Rooster platform.
Data Ownership and Storage — The "Own Storage" Guarantee
School Ownership
The School retains full ownership and control of all student video recordings, teacher explainer videos, and audio feedback.
Third-Party Integration
Video files are stored directly in the School's own Google Drive or Microsoft OneDrive accounts.
Platform Limitation
The Platform does not store video files long-term. It only maintains metadata (file IDs and links) required to reference these files within the application.
No Vendor Lock-in
Should this agreement terminate, all video content remains in the School's cloud storage, independent of the Platform's infrastructure.
Nature of Processing
Categories of Data Subjects
Students, teachers, school administrators, and moderators.
Types of Information
Identity data (names, emails, roles), educational records (grades, rubrics, feedback), and authentication metadata.
Data Minimisation
The Platform only collects the minimum personal information necessary to provide the service.
Technical and Organisational Security
Encryption
OAuth tokens for Google and Microsoft storage are encrypted at rest using AES-256-GCM. Passwords are hashed using bcrypt.
Access Control
Access is managed via Role-Based Access Control (RBAC) and enforced through database Row-Level Security (RLS).
Auditability
The Platform maintains compliance-ready logs of significant actions, including account creations and data exports, accessible to School administrators.
Compliance with POPIA and GDPR
Information Officer
The Platform has a designated Information Officer responsible for POPIA compliance and data subject requests (contact@taalrooster.co.za).
Minor Consent
The Platform provides two consent routes for learners under 18: (a) a built-in parent/guardian email confirmation workflow (default); or (b) a school-managed consent attestation, where an authorised school administrator formally attests that the School has obtained valid parent/guardian consent (or another lawful basis under POPIA) for every enrolled learner and uploads a signed copy of the School's consent agreement. Where school-managed consent is enabled, the School assumes full legal responsibility for obtaining, recording, maintaining, and honouring withdrawal of that consent.
Data Residency
Video files inherit the residency and geographic configuration of the School's existing Google or Microsoft tenant.
Right to Erasure
The Platform supports full account deletion and data export for all users.
Section 57 Prior Authorisation
Where processing of children's personal information involves linking with third-party systems (Google or Microsoft OAuth), the Platform's workflows are designed to comply with the requirements of POPIA section 57. The School, as Responsible Party, confirms that it has obtained any prior authorisation required by the Information Regulator in its specific operational context.
Section 72 Cross-Border Transfer
The School confirms that its chosen cloud storage provider (Google Workspace or Microsoft 365) meets the requirements of POPIA section 72 for transborder information flows. The School is solely responsible for ensuring that its Google Workspace or Microsoft 365 tenant configuration — including data residency and regional settings — satisfies these requirements.
Sub-processors
The School acknowledges the use of the following infrastructure sub-processors:
| Sub-processor | Purpose |
|---|---|
| Supabase | Cloud infrastructure and database hosting |
| Paystack | Payment processing (where applicable) |
Breach Notification
In the event of a confirmed data breach affecting the School's personal information, the Platform shall notify the School's Information Officer without undue delay to allow the School to meet its notification obligations to the Information Regulator, as required under POPIA section 22.
Direct Instruction & Documented Instructions
The Operator shall process personal information only on the documented instructions of the School, including with regard to transfers of personal information to a third country or international organisation. The Operator shall immediately inform the School if, in its opinion, an instruction infringes POPIA or any other applicable data-protection legislation.
Audit Rights & Compliance Assistance
The Operator shall make available to the School all information necessary to demonstrate compliance with POPIA and this Agreement, and shall allow for and contribute to audits, including inspections, conducted by the School or an auditor mandated by the School. The Operator shall cooperate fully with any requests received from the Information Regulator of South Africa.
Video Integrity & Human-in-the-Loop Assessment
The Platform makes the following binding commitments regarding assessment integrity and video handling:
- All final assessments and grades are determined exclusively by human teachers. The Platform provides no automated scoring, algorithmic grading, or AI-generated marks of any kind.
- The Platform will not apply generative AI, deepfake technology, or any synthetic-media modification to student video submissions. Video files remain unmodified in the School's cloud storage exactly as submitted.
School Funding Model & PED Oversight (Section 20 Schools)
Schools receiving funding through a Provincial Education Department (Section 20 schools under the South African Schools Act) should note that procurement decisions may require PED approval. Where the Provincial Education Department or the Member of the Executive Council (MEC) requires access to this Agreement for audit or oversight purposes, the Platform will cooperate fully. Section 21 schools (those managing their own budgets) may execute this Agreement through the School Governing Body without additional PED approval.
Signatures
For the School
Signature
Full name
Designation
Date
Information Officer name
IO Registration Number (Information Regulator)
Authorised signatory
For Taal Rooster
Signature
Full name
Designation
Date
Responsive Design Agency (Pty)
Appendix A
Template Parental Consent Letter
This template is provided for schools' convenience. Schools should adapt it to their own letterhead, language policy, and institutional requirements before use.
[Date]
Dear Parent / Guardian,
Re: Video Assessment Platform — Parental Consent for Student Participation (POPIA §26 Special Personal Information)
Our school uses Taal Rooster, a video-based educational assessment platform operated by Responsive Design Agency (Pty) ("RDA"), to facilitate video-based language and subject assessments. The platform allows learners to record short video submissions (oral assessments, presentations, and similar tasks) which are stored directly in the school's own Google Drive or Microsoft OneDrive account — not on the Taal Rooster platform's own servers.
Because a learner's face and voice may be visible in a video submission, these recordings may constitute special personal information (biometric data) under section 26 of the Protection of Personal Information Act, 2013 (POPIA). Processing of such information requires the explicit consent of a competent person (parent or guardian) in terms of POPIA section 27(1)(a) read with section 35.
Please be advised that:
- Video files are stored only in the school's cloud storage (Google Drive / OneDrive) and are managed and secured by the school.
- The Taal Rooster platform does not store, stream, view, or analyse video content.
- No automated grading, AI analysis, or algorithmic processing is applied to video submissions — all assessments are conducted by human teachers.
- You may withdraw your consent at any time by contacting the school; withdrawal will affect your child's ability to submit video assessments.
If you have any questions, please contact [School Information Officer name and contact details].
Yours sincerely,
[Principal / Class Teacher name]
[School name]
[Date]
— Please complete and return this slip to the class teacher —
Parent / Guardian full name
Student full name
Class / Grade
Date
I consent to my child's participation in video-based assessments on the Taal Rooster platform, and to the storage of video recordings in the school's Google Drive / Microsoft OneDrive account, as described in the letter above.
Parent / Guardian signature
I understand that I may withdraw this consent at any time by written notice to the school, and that withdrawal may affect my child's ability to complete video-based assessments.
Contact
Operator: Responsive Design Agency (Pty), operating as Taal Rooster
Address: 14 Sweet Home Way, Elfindale, Cape Town, 7945, South Africa
Information Officer: contact@taalrooster.co.za
General enquiries: contact@taalrooster.co.za