Privacy Policy

1. Who we are and what this covers

Yellow Tree Reading (PTY) LTD, trading as Yellow Tree Reading Academy ("Yellow Tree", "we"), is the responsible party under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) and the controller under the EU and UK GDPR for the personal information processed through this website: the shop, membership, the Academy courses, training bookings, our forms and your account. We serve customers in the EU and UK, so the GDPR applies alongside POPIA.

The Yellow Tree Hub, our literacy screening and assessment platform, holds children's assessment records under its own privacy policy at [HUB PRIVACY POLICY URL]. This website does not hold learner assessment data.

• Registered address: 49 Hibiscus Way, Halali, Cape Town, 7550, South Africa · registration number [COMPANY REGISTRATION NUMBER]
• Information Officer: Tania Roux, Co-Founder & CEO · Regulator registration [IO REGISTRATION NUMBER] · Deputy: [NAME]
• Data protection contact: privacy@yellowtreereading.com (general enquiries: hello@yellowtreereading.com)
• EU / UK representative: [NOT YET APPOINTED — Article 27 assessment pending]

2. What we collect, and why

• Orders: first name, last name, email, the items and amount, a PayFast payment reference and payment status. Card details go to PayFast directly; we never see or store them. Basis: contract; tax law (5-year retention).
• Your town or city (optional): if you fill it in at checkout, when buying a course or when booking training. We only look at it in totals, to see which areas our customers come from and where to advertise. It is not sent to PayFast or anyone else, and you can leave it blank. Basis: legitimate interest in knowing where our customers are.
• Accounts and the Academy: email, password (hashed by our authentication provider), full name, course enrolments, lesson progress and quiz attempts. Basis: contract.
• Training bookings: name, email, phone, seats, your message, payment reference. Basis: contract.
• School invoices: when you save an invoice, the school or institution name, address and contact number you entered, the items and total, and the invoice number. A copy is emailed to our team so we can match your payment to it. Basis: steps taken at your request before a contract.
• Contact form: name, email, subject, message. Basis: legitimate interest in answering you.
• Data requests: name, email, request type, details. Basis: legal obligation.
• Usage analytics (only with your consent): page path, product id and a random session id, in our own database. No name, email, IP or account id. Basis: consent.
• Sales statistics: when a payment is confirmed, our server sends Google Analytics the order reference, amount, currency, any coupon code and the products bought, so we can count every sale. Nothing that identifies you: no name, email, IP address, account or browser id, and no cookie is set or read. Google is told not to use it for advertising. Basis: legitimate interest in knowing our sales.
• Security records: a salted hash of your IP address on public form submissions (rate limiting), and a log of administrator actions. Basis: legitimate interest in security.

We do not run a newsletter from this website and do not send marketing email. The invoice generator sends us the details on the invoice only when you click Save changes.

3. Who we share information with

These providers process personal information for us under written agreements (POPIA section 21; GDPR Article 28). We do not sell personal information.

• Supabase — database, authentication and file storage. Location: Ireland, EU (Amazon Web Services eu-west-1).
• Vercel — hosting: serves the site through its global network and runs the site's server code in Dublin, Ireland (EU).
• Resend — email delivery (order confirmations, booking confirmations, sign-in emails). Location: United States.
• PayFast (Pty) Ltd — payment processing in South African rand. PayFast is the responsible party for the card transaction itself.
• Zoho Books and QuickBooks Online (Intuit) — invoicing and accounting: your name, email and the order lines. Both integrations exist; which one is in use at a given time is an internal choice and does not change what is shared.
• Google Analytics and Google Ads (Google Ireland Ltd / Google LLC) — only if you switch on Analytics and marketing in the cookie banner: which pages you visit and how you use the site and, when you arrived from one of our ads, the payment reference and amount of an order, booking or course purchase. Separately, for every paid sale, our server sends Google Analytics the sales statistics described in section 2, with nothing that identifies you. No name, email or card details. Google acts as an independent responsible party for this and applies its own privacy policy. Location: EU and United States.

The current list is also kept in our records of processing and changes are announced here.

4. International transfers

Our providers store information outside South Africa. Under POPIA section 72 we transfer only where the recipient is bound by law or agreement providing substantially similar protection: Supabase, Vercel and Resend under GDPR-based data processing agreements with standard contractual clauses; [accounting provider] under its terms. Where the GDPR applies to you, transfers out of the EEA/UK rely on standard contractual clauses.

5. How long we keep information

• Orders and training bookings: 5 years from the transaction (South African tax law); after that the purchaser details are anonymised and the amounts and dates kept.
• Abandoned checkouts and unpaid bookings: deleted after 90 days.
• Saved school invoices: kept with our financial records for [5 years].
• Contact form submissions, closed data requests, usage analytics and email delivery logs: the deletion schedule for these is being set (proposed [12 months], [12 months], [13 months] and [6 months]). Until it is switched on they are kept; you can ask us to delete yours at any time through the data request form. Suppression records (addresses that bounced or unsubscribed) are kept so we do not email them again.
• Accounts: until you delete your account from the account page.

A scheduled job applies these periods. The bracketed ones are applied once confirmed.

6. Your rights

You can, free of charge:

• See and download everything your account holds, from the account page.
• Delete your account from the account page: your profile, course progress and community content are deleted; orders and bookings are anonymised and kept only as accounting records.
• Correct, object, restrict, or withdraw consent at any time — analytics consent from "Cookie preferences" in the footer, anything else through the data request form or privacy@yellowtreereading.com.

We respond within 30 days. Requests about a learner in the Hub are coordinated with the school or practice that holds the record.

7. Cookies and browser storage

Listed item by item in the Cookie Policy. In short: fonts served from our own domain; remembering your currency, and analytics with the Google tag (Google Analytics and Google Ads), only after you turn each one on in the cookie banner.

8. Security

Row-level access control on every table, encryption in transit, administrator rights held as database roles and logged when they delete or change accounts, bookings and submissions, a minimised record of each payment (no full payment notification stored), and rate limits on public forms. If a security compromise affects your information we will notify the Information Regulator through its eServices portal and you, as soon as reasonably possible (POPIA section 22), and within 72 hours where the GDPR applies.

9. Children

Accounts and purchases on this website are made by adults. The demonstration pages for our assessment tools store nothing. Assessments of children happen in the Yellow Tree Hub with a parent's or guardian's consent, under its own policy. [If the legacy demo applications are kept: "The Processing Speed Test and Comprehension Challenge are separate applications with their own notices at their own addresses."]

10. Complaints

Contact us first at privacy@yellowtreereading.com. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · POPIAComplaints@inforegulator.org.za · www.inforegulator.org.za, or, in the EEA/UK, to your supervisory authority.

11. Access to information

Our PAIA manual explains how to request records under the Promotion of Access to Information Act.

12. Changes

The version and date above change whenever this policy changes. Earlier versions are available on request.