Privacy
Privacy notice
Draft for legal review — not yet final. Items in [square brackets] still need the business's details.
Who we are
Key2K53 is software that driving schools use to manage lessons, learners, quotes, invoices and payments. It is run by Lea [surname] as a sole proprietor trading as Key2K53 [registered business name and number once registered], [physical address]. As the owner, Lea is the Information Officer, reachable at leandra@key2k53.co.za.
Two roles
Each driving school decides what information it collects about its learners and instructors and why. Under POPIA the driving school is the "responsible party" for that information and Key2K53 is its "operator", processing it only on the school's instructions. For school owners' own accounts and our website, Key2K53 is the responsible party.
What is collected
Name, email, phone number, pickup addresses, lesson bookings, K53 progress and test results, quotes, invoices and payments, messages, and — only where a school needs it for test bookings — an ID or passport number. Learners under 18 also have a parent or guardian's name and phone number recorded. We do not sell personal information or use it for advertising.
Why it is collected
To arrange and run driving lessons and tests, to bill and record payments, to send service reminders about lessons, tests and payments, to keep the platform secure, and to meet legal duties such as keeping tax records.
Children
Learners under 18 may only be added once a parent or guardian has consented. The school records this consent in the platform and should keep the signed consent form.
Who can see it
Only people at the learner's own school, according to their role: the owner sees the school's records; instructors see only their own learners, without ID numbers or the owner's private notes; learners see only themselves. Each school's data is kept separate and checked by the database on every request. Service providers we use: Supabase (database and sign-in), Vercel (hosting), and, where a school switches them on, Clickatell (WhatsApp/SMS), Resend (email) and PayFast (payments). [Confirm the data-processing agreements and where each provider stores data.]
How it is protected
Encrypted connections, per-school access rules in the database, two-step sign-in for owners and administrators, automatic sign-out after 30 minutes of inactivity, masked ID numbers with an audit log of who viewed them, and limits on repeated sign-in attempts.
How long it is kept
While the learner is with the school. When a learner is removed, their profile, bookings, progress, messages and documents are deleted. Invoices and payment records are kept for 5 years without the learner's name or contact details, as required by the Tax Administration Act. Reminder logs are deleted after 90 days and unused invitations 30 days after they expire.
Your rights
You can ask to see the information held about you, ask for corrections, object to processing, or ask for deletion. Learners can download their data and send requests from "My data" in the learner portal, or contact their driving school. If you are not satisfied, you may complain to the Information Regulator (South Africa). [Add the Information Regulator's current contact details from inforegulator.org.za.]
Security incidents
If personal information is accessed without authorisation, we will notify the affected schools, and the schools and we will notify the Information Regulator and affected people as POPIA section 22 requires.
Changes
We will publish any changes to this notice on this page. Last updated: [date].