MyLittleLink Privacy Notice
Version
This English text is the binding version. Lees dit in Afrikaans
1. Who is responsible for your information
Your child's school uses MyLittleLink to run its day and to talk to you. Your school is the responsible party for your information and your child's information: the school decides what is recorded and why. MyLittleLink is the school's operator: we run the app for the school and process information only on the school's instructions.
MyLittleLink is provided by My Little Link (Pty) Ltd, a private company incorporated in South Africa, registration number 2026/532101/07, 195 Starling Avenue, Boskruin, Randburg, 2188, South Africa. Our Information Officer is Vernon Olivier, reachable at privacy@mylittlelink.com.
For a few things we are the responsible party ourselves, because we decide the purpose: keeping the platform secure (section 8), fixing errors (section 8), and handling enquiries and demo requests on our website (section 12).
2. What information is recorded, and why
We use plain words here. "Your child" means each child linked to you in the app.
2.1 Your child
| What | Why | Where it comes from |
|---|---|---|
| Name, date of birth, class, start date, profile photo | To run the school day and show you the right child | The school, from its enrolment form |
| Who may collect your child (name and, if you allow it, a photo), emergency contacts | So the school knows who is allowed at the gate and who to phone | You, or the school from your form |
| Allergies, medical notes, medication instructions, doses given, health profile, chronic conditions | To keep your child safe and to give medicine correctly. This is health information, which POPIA protects more strictly | You, and the staff who care for your child |
| Attendance (arrived, left, absent, late) | The school must keep an attendance register by law and for its funding | Staff marking the register |
| The daily log: meals, naps, nappies, mood, activities | So you see your child's day | Staff |
| Photos, short videos and voice notes of your child | So you see your child's day. See section 4 | Staff, through the app |
| Read-aloud audio of a log entry | So a log entry can be listened to instead of read | Made from the log text by our text-to-speech provider (section 9) |
| Observations, assessments, growth measurements (height, weight, dominant hand, foot and eye) | To track development. Growth measurements are recorded only if you have said yes to them | Staff; your separate consent for growth |
| Incident reports (an injury, a bite, an event the school must record) | The school's safety record, and so you are told what happened | Staff, reviewed by the principal |
| Absence notes and medical certificates you upload | So the school can excuse an absence and keep its attendance record | You |
| Documents about your child that you or the school upload | For enrolment and administration | You, or the school |
2.2 You (parent or guardian)
| What | Why |
|---|---|
| Name, email address, phone number, home language, profile photo | To sign you in, to reach you, and to show your name to the staff who care for your child |
| Your password (stored scrambled, never readable by anyone) | To sign you in |
| Your consent decisions, with the date, the exact wording you saw, and the internet address and browser you used | So the school can prove what you agreed to, and when |
| Messages, comments, reactions and photos you send | To carry your conversation with your child's teacher and principal |
| Notification settings, quiet hours, push subscription, Data Saver setting | To send you what you asked for, the way you asked for it |
| Fee statements, invoices and payments, if your school uses the app for fees | So you can see and pay what the school charges. We never see or store your card number (section 6) |
| Your mobile number, for the urgent nudge (section 7) and so the school owner, or a principal the owner allows, can phone you (section 3) | So a one-line WhatsApp message can reach you when nobody in your family has seen an urgent alert, and so the school can phone you |
2.3 Staff (educators, assistants, principals, owners, instructors)
| What | Why |
|---|---|
| Name, email, role, profile photo, home language | To sign you in and to show families who cares for their child |
| Everything you record about a child, with your name on it | The school's record must say who recorded what |
| Messages you send and receive | Your work conversations with families and colleagues, which the principal and owner can see |
| Clock-in and clock-out times and how you clocked in (kiosk, PIN, QR, phone) | Your working time record |
| Your phone's location at the moment you clock in on your own phone, if the school has switched on location checking | To confirm you were at the school when you clocked in. See the separate Staff Location Notice |
| Leave requests and the documents you attach (for example a sick note) | To manage your leave |
| Assigned classes, cover, delegated duties, tasks | To run the school day |
2.4 Technical information about everyone
| What | Why | How long |
|---|---|---|
A sign-in cookie called mll_session | To keep you signed in | 30 days, renewed while you use the app |
| Sign-in links (staff) and password-reset links (parents) | To sign you in safely | Sign-in link 24 hours; reset link 60 minutes; each used once |
| Failed sign-in attempts and lockouts: the email or name typed, the internet address and browser | To stop someone guessing a password. After 5 failed attempts an address is locked for 15 minutes | 30 days |
| Error reports when something in the app breaks: which screen, which school, which role, the technical error. Names, emails, phone numbers, message text and passwords are stripped out before the report is stored | To find and fix faults | 90 days |
| An audit trail of who opened sensitive records: health details, emergency contact numbers, incident reports, uploaded documents, medication details, and who ran an export or an erasure | So the school can show who saw what, and when | Kept permanently as part of the school's record; the reader's name is de-identified if that person is erased |
| Notification delivery records | So a notification can be resent if it fails | 30 days in your inbox |
3. Who can see what
- The staff who care for your child see your child's records and your name and messages. Which staff depends on their role and on the classes they are assigned to.
- The principal and the owner see every message between a parent and a member of staff. Nothing between you and a teacher is private from the principal. This is deliberate: it protects children and staff.
- Other families see your child only in a photo, video or voice note in which their own child also appears (for example a group photo at a party). They never see your child's name, records, health information or your messages. A parent's photo sent in a message is seen only by the child's own guardians, the teacher it was sent to, and the principal.
- Phone numbers are never shown between parents and staff, with one exception: the school owner, or a principal the owner allows, can open your mobile number from your child's family card to phone you, and the app records who opened it and when, for the school owner to see. A teacher never can. An emergency contact number you gave is opened the same way, by the same people, from your child's family card, and each opening is recorded and shown to the school owner too.
- Your email address can be opened from your child's family card by the school owner alone, and the app records who opened it and when.
- Nobody outside the school sees your child's records except the processors in section 9, each of which handles only what section 9 says.
4. Photos, videos and voice notes of your child
4.1Taking part in the daily photo feed is part of enrolling. Because this is a preschool, your child will sometimes appear in a photo that is mainly of another child. You agreed to this at enrolment, and it cannot be switched off while your child is enrolled. The only way to end it is to leave the school.
4.2Every photo is checked at the moment it is shown. If any child in a photo does not yet have the daily-feed agreement recorded (for example a family that has not finished signing up), the whole photo is hidden from every family. It is never cropped, blurred or partly shown.
4.3You only ever see photos your own child is in.
4.4Marketing use is a separate choice. The school may use your child's photo on its public page, in a brochure or on social media only if you said yes to that in the app. You can say no at any time and the school must stop using the photo from then on.
4.5Photos go only where the app sends them. A photo of a child never leaves the app through the app. Staff are not allowed to save a child's photo to their phone and share it elsewhere. If you download a photo of your own child, what you do with it is your responsibility.
4.6Announcements to the whole school never carry a photo of a child.
5. Messages and notifications
5.1Messages stay in the app. There is no WhatsApp group and no phone number exchange for talking to your child's teacher.
5.2A push notification on your phone may show a short preview: for a message, the sender's name and the message text; for the daily log, that your child's day was posted and which activities. For an incident, medication or health alert the notification says only that there is something needing you and your child's name, never the details. You can turn previews off completely in your notification settings, and you can turn off most notification categories. Safety notifications (urgent items, medication, care alerts) cannot be turned off.
5.3During your quiet hours (from 20:00 to 06:00 unless you change them) a new message waits and is delivered when quiet hours end. Other notifications are not pushed during quiet hours; they are waiting in your inbox in the app.
5.4The school may set how many months after a conversation ends it is archived from view. Messages are never deleted by the app, because they are part of the school's record.
6. Fees and payments (only if your school uses this feature)
6.1Your school sends statements and invoices through the app. The money is owed to the school, not to us.
6.2The app does not take payments. You pay your school directly, in the way your school tells you, so no payment provider receives your information from us.
7. The urgent nudge by WhatsApp
If there is an urgent alert about your child and nobody in your family has opened it in the app within five minutes, we send one fixed message to the mobile number of every guardian of that child: "Safety alert from your child's school. Your child's school has sent you an urgent message. Please open the MyLittleLink app and read it straight away." The message has one button, "Open MyLittleLink", which opens the app. It contains no child's name and no details. We send it by WhatsApp only: if your number is not on WhatsApp it does not reach you, and the school can see that it was not delivered. Replies are not read; a reply gets an automatic answer telling you to open the app. This is not optional: we send it because it protects your child and your own interest in being reached (POPIA section 11(1)(d) and 11(1)(f)), so there is no switch for it in the app. You may object in writing to our Information Officer on reasonable grounds relating to your particular situation (section 11(3)), and we will decide and tell you. Several urgent alerts inside ten minutes send you one message, and you receive at most ten in a day. We ask for your mobile number when you join, or at your next sign-in, and we do not confirm it belongs to you until a message is sent to it, so please keep it correct in Settings. Your number goes to the WhatsApp provider (Meta, outside South Africa) only to deliver that one message. The SMS fallback is switched off; if it is ever switched on, your number would also go to the SMS provider (SMSPortal, South Africa) for the same purpose, and this notice would say so first.
8. How we keep information safe
- Each school's data is separated inside the database so that one school can never read another's, enforced by the database itself and not only by the app.
- Every upload is scanned for viruses before it is stored.
- Photos and videos are stored privately. Every time one is shown, the app first checks who is asking and whether every child in it has the required agreement.
- Opening health details, emergency numbers, incident reports or documents is written to an audit trail the school's principal and owner can read.
- Connections are encrypted. Passwords are stored scrambled.
- Failed sign-ins are recorded and repeated attempts are locked out (section 2.4).
- Our own staff reach school data only to run, support or secure the service, and are bound to confidentiality.
- If we ever have reason to believe someone has gained unauthorised access to your information, we tell your school immediately so that the school can tell you and the Information Regulator, as POPIA requires. The school keeps a register of any such event.
9. Who else handles your information (our processors)
We use the following providers. Each one gets only what the line says. None of them may use your information for anything else.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Google Cloud (Google Cloud South Africa) | Runs our server and stores files | Everything in the app, stored encrypted | Johannesburg, South Africa (region africa-south1) |
| ClamAV, on our own server | Scans uploads for viruses | Each uploaded file, for the scan only | Our server, South Africa |
| Microsoft Azure AI Speech | Turns a log entry into read-aloud audio | The text of that log entry, and nothing else | Microsoft's South Africa North region, Johannesburg. Our settings refuse any other region |
| domains.co.za, our email host | Sends sign-in links, invitations and email notifications | Your email address and the email's content | South Africa (Johannesburg) |
| Your phone's push service (Google for Android and Chrome, Apple for iPhone and Safari, Mozilla for Firefox) | Delivers push notifications to your phone | An encrypted message only your phone can read | Worldwide; the service cannot read the content |
| SMSPortal (South Africa) | Not in use: the SMS fallback for section 7 is switched off; listed only because it can be switched on | Your phone number and the fixed message | South Africa |
| Meta (WhatsApp Business) | Sends the one-line WhatsApp in section 7 | Your phone number and the fixed message | Outside South Africa |
| Google (Gemini API, Google LLC) | Not in use yet: reads a supplier's slip for the kitchen, so the cook does not type its lines; listed because the school can switch it on | The slip only, which can show a staff member's name and part of a card number. It carries no child's information and no health information | Outside South Africa, on Google's paid terms, under which Google does not use it to improve its products |
| Our error-monitoring server (GlitchTip), run by us | Collects error reports | The scrubbed reports in section 2.4 | South Africa (africa-south1) |
We do not send any child's information to a processor outside South Africa. Three of the providers above work outside South Africa: your phone's push service, which receives an encrypted message it cannot read; Meta for WhatsApp, which receives your own mobile number and the fixed message, only to deliver the urgent nudge in section 7; and Google's Gemini, which would receive only a kitchen slip, and only once the school switches slip reading on. For staff there is one more, explained next, and only if the school links its payroll.
Staff leave and your school's payroll (SimplePay). If your school's owner links the school's SimplePay payroll to MyLittleLink, each day of your approved leave is sent to SimplePay, so that you are paid correctly and the office does not capture it twice. For each day we send only four things: the number SimplePay itself uses for you, the date, the type of leave, and the hours (a half day is half the school's working day). We never send your name, the reason for your leave, a note or any document, such as a sick note. When the school links SimplePay, we also read from SimplePay your employee number, the date you started (and the date you left, if you have), your leave balances and the leave days already recorded there, so that the leave you see in the app matches your payslip.
A sick leave day is health information, which POPIA protects more strictly, because it says you were ill on that date. Your sick leave days are sent only after your school's owner has agreed to it on the screen where the school matches its leave types to SimplePay's, and the app records that agreement. Until then, the school enters your sick leave in SimplePay itself.
SimplePay keeps its information on Amazon Web Services servers in Ireland, so your leave days leave South Africa. Ireland is in the European Union, where the GDPR applies: a law that protects personal information to a standard like POPIA's and has its own rules on sending it on to other countries. Our Information Officer has recorded that this is a lawful transfer for that reason, and that no authorisation from the Information Regulator is needed, because that authorisation is needed only when health information goes to a country that does not protect it well enough. Your school is responsible for your employment record, and SimplePay works for your school under the school's own agreement with SimplePay.
If your school has not linked SimplePay, we send your leave to no one: the school can download its own leave report for its payroll. If the school removes the link, sending stops at once.
Your staff details and your school's payroll (SimplePay). If your school has linked SimplePay and keeps your staff file in MyLittleLink, the office can add you to the school's payroll from your file, or send your changed details, so that nobody has to type them into SimplePay again. This never happens on its own: it happens only when your school's owner, or a principal the owner allows to open your sealed details, presses send for you, one person at a time, after your details have been checked, and only while the payroll consent in your staff file is signed. We then send to SimplePay only what the payroll needs: your first name and surname, your date of birth, your position, which identity document you have and its number (for a passport, the country that issued it), your income tax number if you have one, your bank account details (and, if you are paid into someone else's account, that person's name), your physical address, and, the first time, your employee number, your start date and the pay group the office chooses. We never send your email address, your phone number, your health or medical aid details, your salary, the office's notes, your emergency contacts, your leave or any document. Each time, the app records who sent it, when, and which details went, but never keeps a copy of what was sent. SimplePay keeps your details on its servers in Ireland, under your school's own agreement with SimplePay, and our Information Officer has recorded the same lawful basis for this transfer as for your leave days: the GDPR protects your information there to a standard like POPIA's, so no authorisation from the Information Regulator is needed. None of these details is health information, and nothing about a child is sent.
We use no advertising network, no analytics tracker, no third-party cookies and no content delivery network. Our fonts are served from our own server.
10. How long we keep information
| Information | How long |
|---|---|
| Daily-log photos and videos | 14 days after posting, unless you choose 28 or 90 days in your settings. If two children are in a photo, the longer of their families' choices applies. After that the file is permanently deleted |
| Photos attached to an incident or an observation | While your child is enrolled, and for one year after every child in the photo has left the school |
| The written daily log, observations and incident accounts, and read-aloud audio of them | Kept as part of the school's safeguarding record. No fixed period is set yet; the school's Information Officer decides. See section 11 for what happens on an erasure request |
| Consent decisions, medication given, care approvals, incident reports, and the audit trail | Kept permanently as the school's record. On an erasure request they are de-identified, not deleted |
| Messages | Kept; the school may archive them from view after a period it sets |
| Attendance register, absence notes and medical certificates | Kept for as long as the school's attendance and subsidy duties require, even after an erasure request (section 11) |
| Documents about your child | Rejected uploads: 30 days. Other documents: for the period the school sets, five years after your child leaves unless the school sets otherwise |
| Growth measurements | Kept with your child's assessments, as part of the school's record of your child's learning, while your child is enrolled and for one year after your child leaves the school, then deleted. Only the school owner may choose to keep them longer, up to ten years after your child leaves. They are also kept while the school has put your child's records on hold for a legal matter. On an erasure request they stay, with no name attached (section 11) |
| Your account | While your child is enrolled and until the school removes you, or until you ask for erasure |
| Staff leave documents | A sick note or other document attached to a leave request: 3 years after the leave ends, then permanently deleted. The school may set a longer period, up to 10 years. The leave request itself is kept as part of the employment record |
| Staff clock-in records and location | Clock-in and clock-out times are kept as the school's record of time worked for three years, as the law requires, and then deleted. The location recorded when you clock in is deleted 90 days after the clock-in, unless a query about that clock-in is still open; then it is kept until the query is closed. See the Staff Location Notice |
| Notifications in your inbox | 30 days |
| Failed sign-in records | 30 days |
| Error reports | 90 days |
| Your school's whole account after it stops using MyLittleLink | 30 days for the school to export, then the periods above run out and everything else is deleted or de-identified |
11. Your rights
You can, at any time, through your school's Information Officer (shown on the Permissions screen in the app) or through us:
- See the information held about you or your child. The school can give you a full export from the app.
- Correct anything that is wrong. Most of your own details you can change yourself in the app.
- Withdraw a consent you gave for an optional purpose: marketing use of photos, growth measurements, a pickup person's photo, emergency healthcare authorisation. Withdrawal takes effect from then on; it does not undo what was lawfully done before. The urgent nudge in section 7 is not a consent and has no switch; you may object to it in writing to our Information Officer on reasonable grounds relating to your particular situation (section 11(3)), and we will decide and tell you.
- Object to processing based on the school's legitimate interests, and the school must stop unless it shows a compelling ground.
- Ask for erasure. Because a preschool keeps a safety record of every child, erasure in MyLittleLink means de-identification: your child's name, birth date, photo, contact details, health profile and documents are removed or replaced with "[redacted]", and photos and videos of your child are permanently deleted. What stays, without any name in it, is the safety record: the consent history, medicine given, care approvals, incident reports, message audits, and the written daily-log, observation and incident accounts (and their read-aloud audio), which the school keeps as a safeguarding record. The school also keeps its record of your child's learning (assessments, growth measurements and progress reports), with no name in it. The school must keep its attendance register and the notes that excuse an absence, because its registration as a partial care facility and its subsidy conditions require it. When the school completes your request it tells you exactly what was removed and what was kept, and why. Only the school owner can run an erasure, and the app records every request, including refused ones.
- Complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, inforegulator.org.za.
A parent who is also a member of the school's staff must first be removed as staff before their own account can be erased, because one account cannot be half erased.
We never make a decision about you or your child by automated means alone that has a legal or similarly significant effect.
12. Our website and demo requests
If you ask for a demo on mylittlelink.com we keep your name, school, email address, phone number and any message you write, to contact you, for 12 months and then delete them. We send no marketing you did not ask for. The website sets no cookies and runs no tracker.
13. Children
We collect nothing from children directly. Everything about a child comes from the school or from a parent or guardian. Children do not have accounts.
14. Changes to this notice
We will tell your school, and your school will tell you in the app, before any change that affects how your information is used. The date at the top is the date of the version you are reading.
15. Contact
- Your school's Information Officer: shown on the Permissions screen in the app.
- MyLittleLink's Information Officer: Vernon Olivier, privacy@mylittlelink.com, 195 Starling Avenue, Boskruin, Randburg, 2188.
- MyLittleLink: My Little Link (Pty) Ltd, 195 Starling Avenue, Boskruin, Randburg, 2188, South Africa; support@mylittlelink.com; 066 219 0352.
- The Information Regulator (South Africa): details in section 11.