Privacy Policy

1. Who is responsible

The responsible party for ClickTrack personal information is Smudge Colour (PTY) Ltd trading as Smudge Technologies, registration number 2012/140667/07, at 1st Floor, 139 Greenway, Greenside, Johannesburg, Gauteng, South Africa. The Information Officer function is handled by a designated representative of Smudge Technologies. Contact the Information Officer for privacy and account-closure requests at info@smudge.co.za. This notice covers members and people whose details members provide, such as invitation recipients.

2. Our privacy commitment

We do not sell or rent personal information, or share it with other companies for their own advertising or marketing. Information is used to operate ClickTrack, provide the features members choose, protect the service and comply with law. This commitment allows the member-to-member visibility explained below, necessary processing by contracted service providers acting on our instructions, and disclosures required or otherwise lawfully authorised. It is not a promise that information you deliberately share is visible only to you.

3. Information we handle

Account information includes names, email addresses, password hashes, age eligibility confirmation, account status and Terms acceptance records (the agreed version and text, declaration, and date/time). Optional profile information includes profile photos, maiden names, professional details and up to five products or services. School information includes memberships, connection roles, staff positions, optional school-year/teacher/subject details and recognition records. We process posts, comments, likes, reports, messages and uploaded images, invitation names/email addresses supplied by members, notification preferences, activity/presence signals and operational security records. Server and provider logs may include IP addresses and browser/device information. Within ClickTrack, operational logs are managed by the Super Admin through an access-restricted dashboard. Hosting and other service providers may maintain separate operational logs needed to provide and secure their services.

4. Why we use it and your choices

We use information to register and secure accounts, verify email ownership, show relevant school connections, deliver content and messages, support school submissions and moderation, and match community posts with members’ chosen offerings. Core registration information is needed to create and maintain an account; optional profile fields can be omitted. Some features need the information relevant to that feature. Processing must have an applicable lawful basis, such as performing the member service, meeting a legal obligation, protecting legitimate interests where permitted, or consent where required. A privacy-policy acknowledgement is not blanket consent for unrelated use.

5. Who can see information

Members in the relevant school network can see profile, school and professional information made available by those features. A post shared to multiple communities reaches those communities. Other users can see activity status where the platform displays it. Conversation participants can see messages/photos sent to them. Authorised administrators can review reports and related content, including the reported portion of a private conversation. Access for operational support, security and lawful compliance is limited to legitimate needs. Recipients can retain, forward or screenshot information; access controls cannot prevent every act by a recipient.

6. Service providers, legal disclosure and international processing

Providers may process the minimum information needed for hosting, storage, backups, email delivery, maintenance and security on our instructions, under suitable confidentiality, security and processing arrangements. We may disclose information when legally required or otherwise lawfully justified, including responding to a valid legal process or protecting rights and safety. We apply the applicable POPIA safeguards where information is processed outside South Africa. We do not represent that all processing takes place in South Africa.

Website analytics: Google Analytics 4 is our selected service for website activity measurement. Where enabled, it is used to understand page visits and feature usage, not to send members’ names, email addresses, profile details or private content. Google may process pseudonymous identifiers, browser/device information and activity data. See Cookies & Browser Storage for more information. This processing is not described as completely anonymous.

7. Email, invitations and matching alerts

ClickTrack currently sends system and feature notifications, not marketing emails. These include verification, password and security emails, message notifications, member invitations and matching alerts. Matching email alerts can be changed under My Profile → Notifications. Member invitations use the name/email supplied by the inviter; receiving an invitation does not subscribe you to promotional mail. Contact info@smudge.co.za about unwanted invitations.

If marketing emails are introduced later, we will provide appropriate notice, establish the required lawful basis, obtain consent where required and offer an appropriate unsubscribe or objection mechanism before sending them. Account registration is not blanket permission for future marketing.

8. Retention, removal and account closure

We retain information only for as long as needed for stated purposes, lawful recordkeeping, security, complaints or disputes. You can edit available profile fields and request correction or deletion through info@smudge.co.za. Deactivation retains the account and its information; it is different from permanent deletion.

Ordinary account-closure requests have a target completion period of up to 60 calendar days from submission, subject to earlier action where reasonably practicable and any shorter legal requirements. Identity verification and other people’s rights may affect what can lawfully be removed. Delete from my view in chat hides your view; the other participant’s copy remains.

System backups are retained for up to three weeks. After information is deleted from the live system, residual copies in rolling backups expire within a further three weeks. This period runs from live deletion, not from deactivation or submission of a deletion request. Backup expiry does not delete copies held by other members or records separately retained for a lawful obligation, security, complaints or disputes. Such retained records remain restricted to their justified purpose. This backup period is separate from Google Analytics cookie lifetimes and analytics-data retention.

9. Your rights and complaints

Subject to applicable law, you may request access to personal information, correction of inaccurate information, deletion where justified, objection to relevant processing and withdrawal of consent for processing based on consent. We may verify identity before acting and explain any lawful limitation. Contact the Information Officer above. You may also complain to South Africa’s Information Regulator: inforegulator.org.za/complaints/. For requests for records under PAIA, contact the Information Officer at info@smudge.co.za. We will explain the applicable access procedure.

10. Security, children and changes

We use reasonable organisational and technical safeguards appropriate to the information and risks; no service can promise absolute security. Security incidents will be assessed and notifications made where required by law. ClickTrack registration is for adults aged 18 and over. Do not publish confidential pupil records or children’s personal information without a lawful basis and any required permissions. Report concerns through the privacy contact or available report tools. Material privacy changes will be explained, and any newly required consent obtained. The version and effective date appear above. Any account-request target does not postpone legal duties or security notifications.