Responsive image
Data Privacy

Data Privacy

    • PAIA manual 2026
    • PAIA: Form 2: Request for access to record
    • Curro privacy policy

       

      1    INTRODUCTION
      MOUTON EDUCATION FOUNDATION trading as CURRO ('Curro') strives to ensure that our use of personal information of data subjects is lawful, reasonable, and relevant to our business activities. This notice applies to Curro, its subsidiaries and business units. Reference to ‘Curro’, ‘we’, ‘us’ or ‘our’ in this notice means Mouton Education Foundation NPC and any of its subsidiaries.
      Curro respects privacy and is committed to protecting the privacy of visitors to this site and treats the personal information in its possession with the utmost discretion. We seek to employ best practice when it comes to the collection and processing of personal information in accordance with data protection or privacy legislation. This is done in line with the Constitution, which protects the right to privacy.
      The Protection of Personal Information Act (POPIA), 4 of 2013, which aims to give effect to the constitutional right to privacy and promote the fair and transparent use of personal information, further strengthens our resolve, and requires us to protect the personal information of all our stakeholders appropriately.
      POPIA defines ‘personal information’ as any information that can be used to identify you as an individual or a legal entity. Examples of personal information are your identity number, account number, telephone number, email address or physical address.
      As part of our commitment to protecting your personal information, and in compliance with the law, our processing activities involving personal information are aligned with POPIA. We also process all personal information in line with our POPIA policy, which outlines our obligations when processing the personal information of our stakeholders, and does not replace the provisions of POPIA.
      Our privacy notice sets out how we will use your personal information, and it applies to any information, including personal and special personal information, that you give us or that we may collect from third parties.
      It is important that you read our privacy notice carefully before giving us any personal information. If you give us your personal information, you consent to our processing your personal information as set out in this notice. If you do not agree to all the provisions of our privacy notice, please do not submit any personal information to us and note that, as a result, we may not be able to provide our services to you.

      2    WHAT PERSONAL INFORMATION IS
      Curro may collect, receive, record, organise, collate, store, update, change, retrieve, read, process, analyse, use and share your personal information in a way set out in this privacy notice. When we do one or more of these actions with your personal information, we are ‘processing’ your personal information.
      ‘Personal information’ refers to private information about an identifiable person (which includes natural persons as well as juristic persons, such as companies or trusts). Personal information does not include information that does not identify a person (including in instances where that information has been de-identified).
      Your personal information includes the following:
      •    Identity data, which includes information concerning your name, username or similar identifier, marital status, title, date of birth, gender, race and legal status, your identity number and documents, photographs, registration number and qualifications.
      •    Contact data, which includes addresses, email addresses and telephone numbers.
      •    Financial data, which includes bank account details, and financial statements.
      •    Transaction data, which includes details about payments to and from you.
      •    Service data, which includes information concerning your interactions with Curro.
      •    Security data, which may include records of your access to our facilities, as well as CCTV camera footage of you on or near our premises.
      •    Technical data, which includes your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Curro website.
      •    Usage data, which includes information about how you use our website, products and services; and
      •    Marketing and communications data, which includes your preferences in receiving marketing from us and our third parties and your communication preferences.
      •    Special personal information may be collected in certain circumstances. It may include the following:
      -    your race or ethnicity or religion (required for statistical purposes or by law).
      -    your health (e.g. if you apply for employment).
      -    your criminal behaviour (relating to an offence allegedly committed or proceedings regarding an offence allegedly committed, or the fact that these proceedings took place).
      The collection and processing of your special personal information will only happen with your consent, if this is necessary to establish, exercise or defend a right or obligation in law, to comply with a law, for historical, statistical or research purposes or if it is otherwise lawful to do so.
      •    Curro may also process, collect, store and/or use aggregated data, which may include historical or statistical data (’aggregated data’) for any purpose. Aggregated data could be derived from your personal information but is not considered personal information as this data will not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we will treat the combined data as personal information which will be used in accordance with this privacy notice.

      3    THE AIM OF CURRO’S PRIVACY NOTICE
      It is the aim and objective of Curro’s privacy notice to give you and our stakeholders guidance and information on how we collect, use and protect personal information. The privacy notice will tell you:
      •    why we collect your personal information and how we may process it;
      •    how we share your information with third parties;
      •    how we protect your information;
      •    how long we hold onto your information, and
      •    what your rights are.

      4    WHY WE COLLECT AND PROCESS YOUR INFORMATION
      For us to offer you our services, we need to collect, use, share and store personal information about you so that we can:
      •    contractually engage in an admissions contract;
      •    market relevant services to you;
      •    verify your identity and assess your ability to honour the admissions contract; and
      •    communicate with you by post, phone, SMS, email and other electronic media.
      It is your right to refuse to provide personal information, but this refusal may limit our ability to provide the required educational services to you. We will only collect information from you that is necessary and relevant to the service or product we have to provide.
      We will only collect and use personal information if we are lawfully permitted to do so.
      We may send you direct marketing, but you can unsubscribe by opting out on the relevant internet-based platform or advising Curro directly.
      If we use third-party data providers, we will ensure that they are lawfully allowed to share the information with us.
      The lawful bases we rely on for processing this information are:
      •    we have your consent to do so;
      •    we have an obligation to carry out actions for the cancellation or performance of a contract with you;
      •    we are required by law to process your personal information;
      •    the processing protects your legitimate interest;
      •    we have a legitimate interest to pursue, and/or
      •    a third party has legitimate interest to pursue.

      5    PROCESSING CHILDREN’S INFORMATION
      If any information you provide us contains the processing of personal information of children (minors), this processing of personal information of children may only be carried out with the prior consent of the competent person such as a parent or legal guardian, unless a lawful basis exists allowing us to process such information without the aforementioned consent.
      We do not provide services directly to children, and our site is not available for use by any person under the age of 18 years without consent and supervision from a competent person such as a parent or a legal guardian.
      This privacy notice also applies in a case where a child makes use of our website with the consent from a competent person. Use of our website by a child without the relevant consent from a competent person is prohibited.

      6    HOW WE COLLECT YOUR INFORMATION
      We collect your personal information in three ways, namely:
      •    through direct or active interactions with you;
      •    through automated or passive interactions with you, and
      •    from third parties.
      6.1    Direct or active collection from you
      We may require you to submit certain information in order for you to access certain portions of the Curro website and to enable us to provide certain services to you (e.g. providing further requested information, applying for a vacancy, enrolling in a school, prospectus ordering etc.) or to conclude an agreement with us, or to fulfil our statutory obligations.
      We also collect information directly from you when you communicate directly with us, for example via email, telephone calls, feedback forms, site comments and forums. If you
      contact us, we may keep a record of that correspondence. The information we may actively collect from you may include any of the information listed in section 2 of this privacy notice.
      6.2    Passive collection from your access device
      We passively collect some of your personal information from devices that you use to access and navigate through the website or to access any network administered by Curro (each an ‘access device’), using various technological means. The information which we passively collect from your access device may include your identity data, contract data, security data, technical data, usage data, marketing and communications data, and any other information, which you permit us, from time to time, to passively collect from your access device.
      6.3    Information collected from third parties
      Curro may receive personal information about you from various third parties and public sources and will treat that information with due care.

      7    WITH WHOM WE SHARE YOUR INFORMATION
      Curro will not intentionally disclose, for commercial gain or otherwise, your personal information other than as set out in this privacy notice or without your permission.
      We may share your personal information under the following circumstances:
      •    to service providers and suppliers which have agreed to be bound by this privacy notice or on terms which offer the same level of protection as this privacy notice;
      •    to our employees, suppliers and service providers if and to the extent that they need to know the information in order to provide the services for or to us for which they have been appointed, such as hosting, development and administration, technical support and other support services relating to the website or the operation of Curro. We will authorise any information processing done by a third party on our behalf, amongst other things by entering into written agreements with those third parties governing our relationship with them and containing confidentiality and non-disclosure provisions;
      •    in order to enforce or apply any other contract between you and us;
      •    in order to protect our rights, property or safety or that of our customers, employees and prospective employees, contractors, candidates and prospective candidates, suppliers, service providers, agents and any other third party;
      •    in order to mitigate any actual or reasonably perceived risk to us and our stakeholders, including employees and prospective employees, contractors, parents/guardians, prospective parents/guardians, learners and prospective learners, agents or any other third party, and
      •    to governmental agencies, exchanges and other regulatory or self-regulatory bodies if required to do so by law or if we reasonably believe that such action is necessary to:
      -    comply with the law or any legal process;
      -    protect and defend the rights, property or safety of Curro, or our stakeholders, including employees and prospective employees, contractors, parents/guardians, prospective parents/guardians, learners and prospective learners, agents or any other third party;
      -    detect, prevent or deal with actual or alleged fraud, security or technical issues or the abuse, misuse or unauthorised use of the website and/or contravention of this privacy notice, and
      -    protect the rights, property or safety of members of the public. If you provide false or deceptive information about yourself or misrepresent yourself as being someone else, we may proactively disclose such information to the appropriate regulatory bodies and/or commercial entities.

      8    CROSS-BORDER TRANSFERS
      Information collected by us, may be collected in, or transferred to, a destination outside of South Africa. Such destination may not have comparable data protection legislation, and such collected information may also be processed by staff operating outside South Africa who work for us or by one of our contractors. However, we will ensure that there are either binding corporate rules or a binding agreement in place to ensure your information is processed in line with South African privacy legislation and this privacy notice.

      9    HOW WE PROTECT YOUR INFORMATION
      We are committed to ensuring that your information is secure. To prevent unauthorised access or disclosure, we have put reasonable physical, electronic and managerial procedures in place to safeguard and secure the information we collect. These measures are to ensure the security of your personal information by taking reasonable measures to prevent destruction, unlawful access and loss of personal information. Any compromise of data integrity or confidentiality will be reported to you by written notice.
      We therefore also make every effort to keep the personal information we hold updated, complete and accurate.
      Even by taking the above measures when processing personal information, it cannot be guaranteed that personal information is 100% secure. You can contact us by email at PAIAinfo@curro.co.za if you:
      •    require access to any of your personal information we have on our database; or
      •    wish to notify us of any change, modification or correction; or
      •    would like to have your personal information removed from our records.
      We will require suitable proof of identity from you before we can action any of the above requests.

      10    HOW LONG WE KEEP YOUR INFORMATION
      We will keep your information only for as long as we need it for a lawful business purpose or as required by law and any other statutory obligations. We may keep your personal information for longer than required if you have agreed to this or we are lawfully allowed to do so.
      You can contact the information officer at the address above if you need further information.
      Personal information that you provide to us will be stored electronically on our servers or those of our service providers, as well as in hardcopy format (at times), with reasonable organisation and technical safeguards in place to protect this personal information. However, we do work with third party contractors, some of whom host and operate certain features of the website.
      If you subscribe for data, news, announcements, alerts or any such information to be emailed to you from Curro, we will hold your details on our database until such time as you choose to unsubscribe from this service. You may do this at any stage by selecting the appropriate option in the alerts section of this site.
      We may keep and process some or all of your personal information if and for as long as:
      •    we are required or permitted by law or a contract with you to keep it;
      •    we reasonably need it for lawful purposes related to our functions and activities;
      •    we reasonably need it for evidentiary purposes, or
      •    you agree to us keeping it for a specified further period.
      To determine the appropriate retention period for personal information, Curro will consider, the following, which are not limited to the quantity, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means. Curro’s Data Management Policy governs the retention and destruction of all data held. Curro will always comply with applicable legal, regulatory, tax, accounting or other requirements as they pertain to the retention of personal information.

      11    HOW WE USE ‘COOKIES’
      In so far as our web pages use ‘cookies’, a cookie is a small file of letters and numbers that we place on your computer or mobile device. These cookies allow us to distinguish you from other users and assist us in providing you with a good experience when browsing our website. It also allows us to improve our website.

      12    ACCESS TO INFORMATION
      The Promotion of Access to Information Act, 2000 gives you the right to access information. For further information about this right and how to exercise it, you can refer to Curro’s PAIA manual available at www.curro.co.za.
      The relevant documentation relating to request for access to information is also available on Curro’s website.

      13    YOUR DATA PROTECTION RIGHTS
      In terms of POPIA, you have certain rights in relation to your personal information.
      You have the right to ask us to confirm whether we hold any information about you. You may also request a record from us about the personal information we hold about you, as well as information about all third parties with whom we have shared your personal information.
      Once we have given the information to you, you may ask that we:
      •    correct or delete the personal information in our possession or under our control if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or has been obtained unlawfully;
      •    destroy or delete a record of your personal information that we are no longer authorised to keep in terms of regulatory requirements, or
      •    stop or start sending you marketing messages by informing us in writing or through our branch network, call centres or website.
      If you want to verify the information we have about you or want us to update, change, or delete it, you may:
      •    access the Curro PAIA Manual here
      •    contact Curro’s information officer at PAIAinfo@curro.co.za

       14    COMPLAINTS
      You may submit complaints about the processing of your personal information by sending an email to PAIAinfo@curro.co.za.
      Or, if you are not satisfied with the way we have dealt with your complaint, you can contact the Information Regulator by completing the prescribed POPIA form 5 and emailing it
      to POPIAComplaints@inforegulator.org.za. For more information, visit the Information Regulator website at https://inforegulator.org.za.

      15    OUR CONTACT DETAILS
      15.1    Information Officer:
      Mari Lategan PAIAinfo@curro.co.za

      15.2    Website:
      curro.co.za

      16    CHANGES TO OUR PRIVACY NOTICE
      Any changes we may make to our privacy notice in the future will be posted on this page.