Legal

POPIA Compliance

Yellow Tree Reading (PTY) LTD · Version 1.6 · Last updated: 5 November 2026 · Privacy Policy · PAIA manual · Make a data request

The Protection of Personal Information Act 4 of 2013 (POPIA) sets eight conditions for processing personal information lawfully. This page explains, condition by condition, how this website and the database behind it meet them. Our Privacy Policy is the formal notice of what we collect and why; this page describes the safeguards that back it up.

It covers this website only: the shop, membership, the Academy courses, training bookings, our forms and your account. The Yellow Tree Hub, where children's literacy assessments are recorded, is a separate system with its own database and privacy policy. This website holds no learner assessment data.

What our database holds, and who can see it

Account and profile
Email, hashed password, full name
Who can read it
You (your own row only); administrators
How long we keep it
Until you delete your account
Academy learning
Enrolments, lesson progress, quiz attempts, certificates
Who can read it
You; administrators
How long we keep it
Until you delete your account
Orders, course purchases and training bookings
Name, email, phone (bookings), items, amount, payment reference and status
Who can read it
You, signed in with the buying email, or through a private, expiring order link; administrators
How long we keep it
5 years, then anonymised; unpaid ones deleted after 90 days
Contact and data request forms
What you type into the form, and the notice version you were shown
Who can read it
Administrators only
How long we keep it
[12 months] once the schedule is switched on; until then on request
Email delivery records
Recipient, template, delivery status; bounced and unsubscribed addresses
Who can read it
The website's server only
How long we keep it
[6 months]; suppression list kept so we never re-email you
Usage analytics (only with consent)
Page path, product id, random session id — no name, email, IP or account
Who can read it
Administrators only
How long we keep it
[13 months] once the schedule is switched on
Security records
Salted hash of your IP on public forms; log of administrator actions
Who can read it
The website's server only
How long we keep it
Rate-limit records deleted after 1 day; admin log [period to be set]

Information	Who can read it	How long we keep it
Account and profile Email, hashed password, full name	You (your own row only); administrators	Until you delete your account
Academy learning Enrolments, lesson progress, quiz attempts, certificates	You; administrators	Until you delete your account
Orders, course purchases and training bookings Name, email, phone (bookings), items, amount, payment reference and status	You, signed in with the buying email, or through a private, expiring order link; administrators	5 years, then anonymised; unpaid ones deleted after 90 days
Contact and data request forms What you type into the form, and the notice version you were shown	Administrators only	[12 months] once the schedule is switched on; until then on request
Email delivery records Recipient, template, delivery status; bounced and unsubscribed addresses	The website's server only	[6 months]; suppression list kept so we never re-email you
Usage analytics (only with consent) Page path, product id, random session id — no name, email, IP or account	Administrators only	[13 months] once the schedule is switched on
Security records Salted hash of your IP on public forms; log of administrator actions	The website's server only	Rate-limit records deleted after 1 day; admin log [period to be set]

Card details never reach us: payments are made on PayFast's own pages, and we keep only a short summary of each payment notification.

1. Accountability (section 8)

Yellow Tree Reading (PTY) LTD is the responsible party. Our Information Officer is Tania Roux, Co-Founder & CEO, registered with the Information Regulator under number 2026-064606. The Information Officer owns this page, the Privacy Policy and the PAIA manual, and answers data requests. When an administrator deletes or changes an account, a booking or a form submission, the database records who did it and when.

2. Processing limitation (sections 9–12)

Only what is needed. Each form asks only for what it needs to do its job. Analytics records are blocked by a database rule from carrying an account id, and are limited to a page, a product and a random session id.
A lawful basis for everything. Each purpose and its basis (contract, legal obligation, legitimate interest or consent) is listed in section 2 of the Privacy Policy.
Real consent. Optional cookies and browser storage stay off until you switch them on. Nothing is pre-ticked, "Reject all" is as prominent as "Accept all", and you can change your choice any time from "Cookie preferences" in the footer. Every form shows why we are asking, and the database records which version of that notice you saw.

3. Purpose specification and retention (sections 13–14)

We collect information for the specific purposes in the Privacy Policy and keep it only as long as those purposes need. A scheduled job in the database applies the retention periods every night:

orders and bookings are anonymised 5 years after the transaction, keeping only the amounts and dates that tax law requires;
abandoned checkouts and unpaid bookings are deleted after 90 days;
private order-lookup links expire automatically;
the periods for form submissions, analytics, email logs and the administrator log are being confirmed (the bracketed periods in the table above) and switch on once set. Until then you can ask us to delete yours at any time.

4. Further processing limitation (section 15)

We do not use your information for purposes unrelated to why you gave it. We do not sell personal information, send marketing email from this website or run a newsletter. The one Google tag (Google Analytics and Google Ads, to see how the site is used and which of our ads lead to a sale or booking) runs only if you switch Analytics and marketing on in the cookie banner, and stops when you switch it off. Separately, our server tells Google Analytics about each paid sale (order reference, amount and products only, with no name, email, IP address or cookie) so that our sales figures are complete.

5. Information quality (section 16)

You can change your email address and password from your account page. For anything else that is out of date or wrong, use the data request form and we will correct it.

6. Openness (sections 17–18)

Our Privacy Policy tells you what we collect, why, who we share it with and your rights. The Cookie Policy lists every cookie and browser storage item the site uses, and an automated check compares that list against the code so the two cannot drift apart. The PAIA manual describes the records we hold and how to request them.

7. Security safeguards (sections 19–22)

Access control inside the database. Row-level security is switched on for every table. The database itself, not just the website, decides who can read each row: a signed-in customer sees only their own profile, orders, enrolments and progress; anonymous visitors cannot read orders at all; data requests, email logs, rate-limit records and the administrator log are closed to everyone except the website's server.
Forms go through the server. Contact, booking and data request submissions are validated and written by our server, not directly by the browser. Public forms are rate-limited and carry spam traps, and IP addresses are stored only as salted hashes for that purpose.
Administrators. Administrator rights are a role held in the database, and their changes to accounts, bookings and submissions are logged.
Accounts. Passwords are hashed by our authentication provider and never stored or seen by us. Deleting an account needs a fresh one-time code sent to your email.
In transit. The site is served only over encrypted connections, with security headers that limit what pages may load and what they may share.
Operators. The service providers that process information for us (database and hosting, email delivery, payments and accounting) are named in section 3 of the Privacy Policy with what each receives, as section 21 requires.
Breaches. We keep a written breach procedure. If a security compromise affects your information we will notify the Information Regulator and you as soon as reasonably possible (section 22).

8. Data subject participation (sections 23–25)

You can, free of charge:

See and download everything your account holds, as a data file or a readable page, from your account page;
delete your account from the same page: your profile, learning progress and community content are deleted, and orders and bookings are anonymised and kept only as accounting records;
ask for access, correction, deletion or an objection through the data request form or privacy@yellowtreereading.com. We respond within 30 days.

Children's information (sections 34–35)

Accounts and purchases on this website are for adults, and the assessment demonstration pages store nothing. Children's assessments happen only in the Yellow Tree Hub, with the consent of a parent or guardian, under the Hub's own policy.

Direct marketing (section 69)

This website sends only the emails needed for what you asked for: order and booking confirmations, sign-in emails and replies to your messages. It sends no marketing email.

Information stored outside South Africa (section 72)

Our database provider, Supabase, stores the data in Ireland, in the European Union (Amazon Web Services region eu-west-1), where the GDPR protects it. The site is hosted on Vercel, whose servers for it run in Dublin, Ireland, and emails are sent through Resend in the United States. We transfer information only to providers bound by law or agreement to protect it to a standard substantially similar to POPIA. Section 4 of the Privacy Policy gives the details.

Questions and complaints

Contact our Information Officer at privacy@yellowtreereading.com. If you are not satisfied, you may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · POPIAComplaints@inforegulator.org.za · www.inforegulator.org.za.