Yellow Tree Reading Academy
Legal

Privacy Policy

Yellow Tree Reading Academy — operated by Yellow Tree Reading (PTY) LTD. Last updated: 25 June 2026.

1. Introduction

Yellow Tree Reading (PTY) LTD, trading as Yellow Tree Reading Academy ("Yellow Tree", "we", "us", "our"), respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the rights you have over it.

This Policy is written to comply with:

  • The Protection of Personal Information Act 4 of 2013 ("POPIA"), South Africa's data protection law; and
  • The General Data Protection Regulation (EU) 2016/679 ("GDPR"), which applies to us because we offer Digital Resources and Membership to individuals located in the European Union and European Economic Area, regardless of where we are based.

Where POPIA and GDPR use different terminology for similar concepts, we use the more familiar term and note the equivalent where helpful (for example, the "responsible party" under POPIA is the equivalent of the "data controller" under GDPR — in both cases, this is Yellow Tree Reading (PTY) LTD).

2. Who We Are

  • Legal Entity (Responsible Party / Data Controller): Yellow Tree Reading (PTY) LTD
  • Registered Address: 49 Hibiscus Way, Halali, Cape Town, 7550, South Africa
  • Information Officer: Tania Roux, Co-Founder & CEO
  • Email: support@yellowtreereading.com
  • Phone: +27 82 331 3096

3. What Personal Information We Collect

  • Identity & contact details — name, email address, phone number.
  • Account & order information — purchase history, Membership tier, learner/seat count, licence type.
  • Billing information — billing address, currency, last 4 digits of payment card (full card details are handled exclusively by PayFast or Paddle — we never see or store full card numbers).
  • Communications — messages you send us via email, contact forms, or our Facebook community.
  • Marketing preferences — newsletter subscription status, email engagement (opens/clicks).
  • Technical & usage data — IP address, browser type, device type, pages visited, cookies (see our Cookie Policy).
  • Children's information (limited) — where a parent, guardian, or educator sets up multi-seat Membership access for named learners, we may hold a learner's first name and grade/level for the purpose of organising materials — never more than necessary, and never for marketing.

We do not knowingly collect information directly from children. All purchases and account creation are completed by an adult, as set out in our Terms and Conditions.

4. Why We Process Your Information, and Our Legal Basis

  • Processing your purchase and providing access to Digital Resources or Membership — performance of a contract (POPIA s11 / GDPR Art. 6).
  • Customer support and responding to enquiries — performance of a contract / legitimate interest.
  • Sending Membership renewal, billing, and access notices — performance of a contract / legal obligation.
  • Sending marketing emails and newsletters — consent.
  • Improving the Website and our products (analytics) — legitimate interest.
  • Preventing fraud and enforcing our Terms — legitimate interest / legal obligation.
  • Complying with tax, accounting, and consumer protection law — legal obligation.

You may withdraw consent for marketing at any time (see clause 8). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. Who We Share Your Information With

We share personal information with the following categories of trusted service providers, strictly for the purposes described above. We do not sell your personal information.

  • PayFast (Pty) Ltd — payment processing for South African Rand (ZAR) purchases. Billing details, transaction data.
  • Paddle (Paddle.com Market Ltd / regional entity) — Merchant of Record and payment processing for international (USD/EUR) purchases; tax calculation, collection, and remittance. Billing details, transaction data, email.
  • Klaviyo — email marketing automation and transactional emails. Name, email, purchase/engagement history.
  • Supabase — database hosting, authentication, and storage for our Website, Membership platform, and resource library. Account data, learner/seat data, purchase records.
  • Lovable — application infrastructure and hosting for our Website, funnels, and Membership platform. Account and usage data, contact form submissions.
  • Meta (Facebook/Instagram) — advertising and audience measurement (Pixel). Website behaviour, in aggregate/pseudonymised form, for advertising purposes — see our Cookie Policy.

We require each of these providers to handle your information securely and only for the purposes we've authorised, through contractual data processing terms.

6. International Transfers of Your Information

Because several of our service providers operate outside South Africa (including in the United States, United Kingdom, and European Union), your personal information may be transferred to, and processed in, those countries.

Under POPIA (Chapter 9, section 72), we only transfer personal information outside South Africa where:

  • the recipient is subject to a law, binding corporate rules, or contractual terms that uphold data protection principles substantially similar to POPIA;
  • you have consented to the transfer; or
  • the transfer is necessary to perform a contract with you (for example, processing an international payment through Paddle).

Under GDPR, where we transfer the personal information of EU/EEA individuals to a country outside the EU/EEA that has not been recognised as offering an adequate level of protection, we rely on appropriate safeguards such as Standard Contractual Clauses with the relevant provider.

7. How Long We Keep Your Information

We retain personal information only for as long as necessary for the purposes set out in this Policy, including:

  • Active Membership and purchase records: for the duration of your relationship with us, plus a reasonable period afterward to meet our tax, accounting, and consumer-protection obligations under South African law (generally up to 5 years from the relevant transaction);
  • Marketing data: until you unsubscribe or withdraw consent, after which we suppress (rather than further process) your details to honour your opt-out; and
  • Support correspondence: for as long as reasonably needed to resolve your query and for a reasonable period afterward for record-keeping.

8. Your Rights

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you;
  • Correct inaccurate or outdated information;
  • Delete your personal information, subject to our legal retention obligations;
  • Object to processing carried out on the basis of legitimate interest, including direct marketing, at any time and free of charge;
  • Restrict processing in certain circumstances;
  • Receive a copy of certain information you provided to us in a structured, portable format (data portability — GDPR only);
  • Withdraw consent at any time, where processing is based on consent (such as marketing emails); and
  • Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on you.

To exercise any of these rights, contact our Information Officer at support@yellowtreereading.com. We will respond within a reasonable time and in any event within the time limits required by applicable law.

We will never charge you for receiving unsolicited direct marketing you did not consent to receive; under current Information Regulator guidance, providing only an opt-out mechanism does not constitute valid consent, and we obtain your affirmative consent before sending marketing communications.

9. Lodging a Complaint

If you believe we have mishandled your personal information, please contact us first at support@yellowtreereading.com so we can try to resolve it directly.

South African residents may also lodge a complaint with the Information Regulator:

Information Regulator (South Africa), 27 Stiemens Street, JD House, Braamfontein, Johannesburg, 2001. P.O. Box 31533, Braamfontein, Johannesburg, 2017.
Email: enquiries@inforegulator.org.za (general) / POPIAComplaints@inforegulator.org.za (complaints).
Phone: +27 10 023 5200 · www.inforegulator.org.za

EU/EEA and UK residents may also lodge a complaint with their local data protection supervisory authority, or with the UK Information Commissioner's Office (ICO) if resident in the United Kingdom.

10. Children's Privacy

Our Digital Resources and Membership are built for children's learning, but accounts and purchases are made by adults. Where a parent, guardian, or educator provides limited information about a named learner for the purposes described in clause 3, we process that information only for the educational purpose for which it was provided, with that adult's consent, and never for marketing or profiling.

11. Security

We use reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, and misuse, including secured hosting infrastructure (Supabase) and encrypted payment processing through PayFast and Paddle. No system can be guaranteed 100% secure, but we take this responsibility seriously.

If a security compromise occurs that may have affected your personal information, we will notify the Information Regulator and you, as soon as reasonably possible, in accordance with section 22 of POPIA, and notify the relevant supervisory authority and affected individuals under GDPR where required.

12. Direct Marketing

We will only send you marketing emails or newsletters if you have given us your express, informed consent (for example, by ticking the newsletter checkbox at checkout or registration). You can withdraw this consent at any time by clicking "unsubscribe" in any marketing email, or by emailing support@yellowtreereading.com.

13. Cookies

Our Website uses cookies and similar tracking technologies. Full details, including how to manage your preferences, are set out in our separate Cookie Policy.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our products, or applicable law. The "Last Updated" date at the top of this page shows the latest revision. Material changes will be communicated by email to active Membership subscribers and/or highlighted on this page.

15. Contact Us

Yellow Tree Reading (PTY) LTD
49 Hibiscus Way, Halali, Cape Town, 7550, South Africa
Email: support@yellowtreereading.com
Phone: +27 82 331 3096
Information Officer: Tania Roux