This policy explains how we handle your personal information. It follows the Protection of Personal Information Act 4 of 2013 (POPIA).
Many Study Market users are under 18. We have written this in plain language so that young people and parents can understand it.
1. Who is responsible
Mark Goulding, an individual (sole proprietor) trading as Study Market, runs Study Market. We are the "responsible party" under POPIA. That means we decide why and how your personal information is used.
- Address: 145 Wilton Avenue
- General contact: hello@studymarket.co.za
- Privacy contact: privacy@studymarket.co.za
- Information Officer: Mark Goulding
2. What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Email, password (or Google sign-in), first name, surname | To create and secure your account, and to contact you | Needed for our agreement with you |
| Date of birth | Only to work out whether you are under 18. Never shown publicly | Legal duty and protecting children |
| "What brings you here" | To understand how people use Study Market and improve it | Our legitimate interests |
| Parent or guardian name and email (under-18s) | To ask for consent, and to send safety and consent emails | Consent and protecting children |
| Profile details you choose to add: school, grade, curriculum, marks, bio, profile photo | To build your profile and help buyers and tutees trust you | Your consent |
| School report you upload (sellers) | To confirm your marks so we can show a "Verified" tick | Your consent (and your parent's, if you are under 18) |
| Listings: titles, descriptions, prices, files | To run the marketplace and deliver notes to buyers | Needed for our agreement with you |
| Orders, payments and earnings records | To process sales, refunds and payouts, and for accounting and tax | Agreement and legal duty |
| Bank account details for payouts: bank, branch code, account type, account number and holder name | To pay sellers and tutors by EFT. The account number is stored encrypted, only admins making a payout can see it, and only the last 4 digits are shown in your account | Agreement |
| Card and payment details | Entered on Yoco's secure checkout, not on Study Market. We never see or store your card number | Agreement |
| Marketing choice (sellers and tutors) | To know whether we may feature you in our marketing | Your consent (and your parent's, if you are under 18) |
| Tutor details: subjects, rate, area, availability, phone/WhatsApp, email | To match tutors with tutees | Agreement and consent |
| Tutee request details: subject, grade, need, area | To match tutees with tutors | Agreement |
| Reviews and ratings | To show feedback on notes and tutors | Our legitimate interests |
| Records of files opened and downloaded | To apply the refund rule and the download limit, and to prevent leaks | Our legitimate interests and agreement |
| Copyright complaints and related messages | To handle takedowns and repeat infringement | Legal duty and our legitimate interests |
| Technical information such as IP address and browser details | To run, secure and protect the site from bots and abuse | Our legitimate interests |
| Your email preferences | To respect what you want to receive | Consent and legal duty |
| Messages you send us | To help you and keep a record | Our legitimate interests |
Giving us information is voluntary. But we cannot provide some features without it. For example, we need a bank account to pay out earnings. Marketing is always optional: you can sell and tutor without agreeing to it (see section 5).
3. Where information is shown
Some information is public. Some is private.
Public (on your profile or listings, if you add it and you are allowed to publish): your name, school, grade, curriculum, bio, profile photo, marks, "Verified" tick, listings, reviews, and tutor subjects, rate and area.
Never public: your date of birth, your email address, your phone number, your bank details and your school report.
Tutoring contact details (name, phone/WhatsApp, email) are shared only between a tutor and a tutee after the tutor accepts a request. We also block contact details in public text.
Watermarks: the notes you buy carry your name, email address and order number. Anyone who gets a copy of your file can see them.
4. Children's information
Under POPIA, a child is someone under 18. Section 35 of POPIA allows us to process a child's personal information only in limited cases. We rely on two of them:
- A parent or guardian's consent (a "competent person"). This covers everything a child does as a seller or tutor: publishing listings and a profile, showing their name, school, photo and marks, uploading a school report, receiving payouts and accepting tutoring requests.
- What is necessary to exercise a right or meet an obligation in law. Before the parent confirms, we keep only what we need to run the child's account and to deliver and keep records of notes they buy: their name, email, date of birth, the parent's contact details, their orders and their library. We do not publish any of it.
For users under 18:
- We ask for a parent or guardian's name and email when they sign up.
- The parent receives a consent link.
- Until the parent confirms, the child can browse, buy notes, set up a profile and draft listings. Nothing about them is public. They cannot publish listings, upload a school report or accept tutoring requests.
- A child is only ever featured in our marketing if both the child and the parent separately agree. Both choices are optional.
- A parent can withdraw consent at any time. This pauses the child's listings and tutor profile and removes the child from marketing.
- For tutees under 18, the tutoring introduction email also goes to their parent.
We use a parent's details only for consent, safety and tutoring introductions, and to answer their questions. We do not use children's information for advertising.
A parent can also ask us to see, correct or delete their child's information. See For Parents.
5. Marketing use of seller information
Being featured in our marketing is optional. You can sell and tutor without agreeing to it.
There is a difference between your listings and our marketing:
- Your listings and profile always show your name, school, photo (if you add one) and marks. That is how buyers decide whose notes to trust, so it is part of selling, not marketing.
- Our marketing means featuring you on our homepage, in emails to other users, or on social media such as TikTok and Instagram. We only do this if you opted in. For sellers under 18, the parent or guardian must also agree.
We never use a seller's date of birth, contact details or bank details in marketing.
You can switch marketing off at any time in your account settings, or by emailing privacy@studymarket.co.za. A parent can withdraw it for their child. We then stop new use straight away and remove existing posts we control where we reasonably can. Your listings are not affected.
6. School report verification
Sellers can upload a school report so that we can show a "Verified" tick on their marks.
- An AI model (Cloudflare Workers AI) reads the report and suggests the marks. Cloudflare processes it for us only; it is not used to train AI models.
- An admin checks and confirms the marks. A person makes the final decision.
- The report file is stored privately. Only admins can see it.
- We delete the report file 30 days after the verification decision.
- We keep only the verified marks, the term and the year.
7. Who we share information with
We do not sell personal information. We share it only as needed:
| Who | What they do for us |
|---|---|
| Cloudflare | Hosting, our database, file storage, AI (Workers AI) and bot protection (Turnstile) |
| Yoco | Card and instant EFT payments, and refunds |
| Resend | Sending emails |
| Only if you choose Google sign-in |
These companies are "operators" under POPIA. They process information for us, under agreements that require them to protect it, and only for the purposes we set.
We also share information:
- with the other person in a tutoring match, after acceptance (name and contact details)
- with a tutee's parent, in the introduction email, for under-18 tutees
- with other users, where you chose to make it public (see section 3)
- with a copyright complainant, a regulator, the police or a court, where the law requires it or where we need to protect our rights or other people's safety
- with a buyer or investor if our business is sold, as long as the information stays protected
8. Sending information outside South Africa
Cloudflare runs a global network. Resend is based in the United States. Yoco and Google may also process information outside South Africa. So your information may be processed outside South Africa.
Under section 72 of POPIA we send personal information to another country only if:
- the recipient is bound by law, a binding agreement or binding corporate rules that give similar protection to POPIA, or
- you consent, or
- it is necessary to carry out our agreement with you, or for steps you asked for.
9. How long we keep information
| Information | How long |
|---|---|
| Account, profile, listings and library | While your account is open |
| School report file | Deleted 30 days after the verification decision |
| Verified marks, term and year | While your account is open |
| Orders, payments and earnings records | 5 years, as required by tax law (the Tax Administration Act 28 of 2011) |
| Parent or guardian consent record | While the child's account is open, and for as long afterwards as we need it to prove consent |
| Copyright complaint records | As long as needed to apply our repeat infringer policy and to deal with legal claims |
When you delete your account, we remove or anonymise everything else, apart from what we must keep by law. Other buyers keep the notes they bought from you.
10. Keeping information safe
We take reasonable steps to protect your information. These include access controls, private storage for sensitive files such as school reports, bot protection and using trusted providers. No system is perfect. If there is a security breach that puts your information at risk, we will tell the Information Regulator and the people affected, as POPIA requires.
Please also protect yourself: use a strong password and do not share it.
11. Your rights
You can:
- ask what information we hold about you, and get a copy
- ask us to correct information that is wrong or out of date
- ask us to delete information we no longer need or have no right to keep
- object to us processing your information on grounds of our legitimate interests
- withdraw consent you gave (this does not undo what we did before, but we will stop going forward)
- download your data from your account
- delete your account
- complain to the Information Regulator
To use these rights, email privacy@studymarket.co.za. We may need to confirm who you are first. For a child's information, a parent or guardian can make the request. We will reply within a reasonable time.
12. Direct marketing and emails
Transactional emails always send. These include receipts, sign-in and security emails, consent emails, refund and payout updates, and tutoring introductions. We need them to run your account.
Non-essential emails include review prompts, bundle prompts, price suggestions and summaries. Every one of them says how to stop them. You can switch them off at any time in your account settings, or by emailing privacy@studymarket.co.za.
We send direct marketing by electronic message only as section 69 of POPIA allows. That means to people who have given us consent, or to existing customers about similar products, and you can always opt out. We do not send marketing emails to children unless their parent has agreed.
13. Cookies
We use a session cookie, a cart cookie and a discount-code referral cookie. We do not use advertising or analytics cookies. Read the Cookie Notice.
14. Third-party sites
Study Market may link to other sites, such as Google sign-in. We do not control them. Please read their privacy policies.
15. Information Officer and the Regulator
Our Information Officer is Mark Goulding. Contact: privacy@studymarket.co.za.
If you are not happy with how we handle your information, please tell us first. You also have the right to complain to the Information Regulator (South Africa):
- Email: complaints.IR@inforegulator.org.za
- Website: inforegulator.org.za
16. Changes to this policy
We may update this policy. The version date is at the top. If we make an important change, we will tell you by email or on the site. If a change affects how we use a child's information, we will ask the parent again where POPIA requires it.