Plain-language summary: Zande is a management platform for ECD (Early Childhood Development) centres. We collect two types of information: (1) account information about centre operators who sign up to use Zande, and (2) personal information about learners and parents that is entered by centre operators into the system. ECD centres are legally responsible for the learner and parent data they collect. We process that data on their behalf. We do not sell any personal information to anyone.
Zande is operated by Vuhosi Capital (Pty) Ltd, a company registered in South Africa ("Zande", "we", "us", "our"). Our registered office is in Hazyview, Mpumalanga, South Africa.
This Privacy Policy explains how we collect, use, store, and protect personal information in connection with the Zande platform. It applies to:
We comply with the Protection of Personal Information Act 4 of 2013 (POPIA), which is the primary data protection law in South Africa. Where applicable, we also comply with the European Union's General Data Protection Regulation (GDPR) for users in the EEA, and the California Consumer Privacy Act (CCPA) for California residents.
South Africa's Information Regulator enforces POPIA. Their contact details are: inforeg.org.za | enquiries@inforeg.org.za | +27 10 023 5200.
When you register a Zande account, we collect and are directly responsible for:
| Information | Why we collect it | Retention |
|---|---|---|
| Centre name, email address, phone number | Create and manage your account; communicate with you about the service | Duration of account + 3 years after closure |
| Password (stored as a one-way cryptographic hash — we cannot read it) | Account authentication | Duration of account |
| Centre details: physical address, province, EMIS number, registration status | Appear on fee statements and DOE registers; required for service functionality | Duration of account + 3 years |
| Banking details: bank name, account number, branch code | Printed on PDF fee statements sent to parents; we do not process payments or debit your account | Duration of account + 3 years |
| Centre logo (if uploaded) | Branding on fee statements and enrolment portal | Duration of account |
Centre Operators enter personal information about their learners and parents into Zande. In this context:
Learner and parent data collected includes:
| Category | Fields |
|---|---|
| Child identity | Full name, date of birth, gender, home language, SA ID or birth certificate number |
| Child enrolment | Age group / class, start date, site/branch, attendance records (daily present/absent/late) |
| Child health information (Special Personal Information — POPIA Section 26) | Medical conditions, allergies, dietary needs, chronic medication, doctor/clinic name, medical aid details |
| Parent / Guardian | Full name, phone number, SA ID number (optional) |
| Emergency contact | Name and phone number |
| Financial records | Monthly fee amount, payment date, payment method, payment notes, waived fee records |
Children's data — POPIA Section 57: Learner records contain personal information of children, which is a specially protected category under POPIA. ECD Centre Operators must obtain the written consent of a parent or legal guardian before entering a child's personal information into Zande. The online enrolment portal includes an explicit consent step for this purpose. Centre Operators who manually add learner records confirm by using the service that they have obtained the required parental consent.
| Data | Legal basis (POPIA) |
|---|---|
| Centre Operator account data | Processing necessary for the performance of a contract (the Zande subscription agreement) |
| Learner identity, enrolment, and financial data | Consent of parent/guardian (obtained by the Centre Operator); performance of contract between centre and parent |
| Child health information | Explicit consent of parent/guardian (required by POPIA Section 26 for special personal information) |
| Attendance records | Legitimate interest of the ECD centre in meeting DOE regulatory reporting obligations; consent |
We do not sell personal information. We share personal information only in the following limited circumstances:
We do not share learner or parent data with third parties for marketing, advertising, research, or any purpose other than operating the Zande platform.
We implement the following technical and organisational measures to protect personal information:
No system is 100% secure. In the event of a data breach that poses a risk to data subjects, we will notify the South African Information Regulator within 72 hours and affected parties as soon as reasonably practicable, as required by POPIA Section 22.
Under POPIA, you have the following rights regarding your personal information:
| Right | What it means | How to exercise it |
|---|---|---|
| Right of access | Request a copy of personal information we hold about you | Email privacy@vuhosicapital.online |
| Right to correction | Request correction of inaccurate or incomplete information | Centre Operators: edit directly in Zande. Parents: contact your ECD centre. |
| Right to deletion | Request deletion of your personal information | Email privacy@vuhosicapital.online — we will action within 30 days |
| Right to object | Object to processing of your personal information in certain circumstances | Email privacy@vuhosicapital.online |
| Right to data portability | Receive your data in a structured, machine-readable format | Centre Operators: contact support for a full data export |
| Right to lodge a complaint | Complain to the Information Regulator if you believe your rights have been violated | inforeg.org.za | enquiries@inforeg.org.za |
Note for parents and learners: Learner records are controlled by the ECD centre, not by Zande directly. To access, correct, or delete your child's records, contact the centre operator in the first instance. If the centre does not respond, contact us at privacy@vuhosicapital.online and we will assist.
Zande uses only a single session cookie to keep you logged in. This cookie is:
We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. We do not place advertising cookies.
Zande data is hosted on a VPS server located in South Africa or within a jurisdiction with adequate data protection standards. We do not intentionally transfer personal information outside South Africa to countries that do not provide adequate protection. If this changes, we will update this policy and comply with POPIA Section 72 transfer requirements.
Zande processes personal information of children as part of its core function (ECD learner management). We take the following additional measures:
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). We do not sell personal information. California residents may exercise the same access, deletion, and portability rights described in Section 9. To exercise these rights, email privacy@vuhosicapital.online with the subject line "CCPA Request".
We may update this Privacy Policy from time to time. When we make material changes, we will notify Centre Operators by email and update the "Last updated" date at the top of this page. Continued use of Zande after the effective date of an updated policy constitutes acceptance of the changes.
For any privacy-related questions, requests, or complaints:
If you are not satisfied with our response, you may contact the Information Regulator of South Africa at inforeg.org.za.