Privacy and POPIA Notice

Draft for NHC review. Subject to confirmation and approval by the schools.

Privacy and POPIA Notice

New Horizon College Bethlehem and New Horizon College Harrismith
Prepared for review 7 November 2026. Not yet an approved policy of the schools.

1. About this notice

This notice explains how New Horizon College Bethlehem and New Horizon College Harrismith (together “New Horizon College”, “NHC”, “the school”, “we”, “us” or “our”) collect, use, share and protect personal information, as required by the Protection of Personal Information Act 4 of 2013 (“POPIA”).

It applies to:

• learners and prospective learners, most of whom are children;
• parents, guardians and other people responsible for a learner’s fees or care;
• staff, educators, contractors, volunteers and job applicants;
• visitors to our campuses; and
• people who use our websites: nhc.co.za, bethlehem.nhc.co.za (Bethlehem campus) and harrismith.nhc.co.za (Harrismith campus) (together, “the Websites”).

New Horizon College Bethlehem and New Horizon College Harrismith are two separate companies. Each school is responsible for the personal information it processes about its own learners, parents, staff and visitors. Please also read our Website Terms of Use and Cookie Policy.

2. Who we are and how to contact us

New Horizon College Bethlehem
Company registration number: 2013/190672/08
Registered with the Free State Department of Education as an independent Combined school (New Horizon College CI/S), EMIS 445802165. Accredited by Umalusi, accreditation number 23 SCH01 01022, valid until 31 December 2033.
Campus: 2 Eden Plot, Bethlehem
Postal: PO Box 2424, Bethlehem, 9700
Phone: 058 303 4714
Email: bhm@nhc.co.za

New Horizon College Harrismith
Company registration number: 2004/005915/08
Registered with the Free State Department of Education as independent schools New Horizon College PI/S (Primary), EMIS 441705213, and New Horizon College SI/S (Secondary), EMIS 441705204.
Campus: Bertha Frame Avenue, Harrismith, 9880
Postal: PO Box 57, Harrismith, 9880
Phone: 058 623 1077
Email: admin@nhc.co.za

3. Privacy requests and the Information Officer

POPIA requires each responsible party to have an Information Officer and to register that person with the Information Regulator. For a company, PAIA and POPIA treat the company’s chief executive officer or equivalent officer, or a person that officer duly authorises, as its Information Officer. The person appointed or authorised for each company, and their published contact details, are still to be confirmed by each company.

Until the schools publish their Information Officer details, please send privacy requests, questions and complaints to the office of the campus your request relates to (bhm@nhc.co.za or 058 303 4714 for Bethlehem; admin@nhc.co.za or 058 623 1077 for Harrismith). The campus office will forward your request internally. These are general contact points for routing requests. They are not a statement of who the Information Officer is.

4. Children’s personal information

Most of our learners are under 18. POPIA gives children’s personal information extra protection. We only process a child’s personal information where POPIA allows it, for example:

• with the consent of a competent person (a parent or legal guardian);
• where it is needed to establish, exercise or defend a right or obligation in law; or
• where it is needed to comply with an obligation under law.

The parent or guardian who completes the application or enrolment documents acts on the learner’s behalf. Where appropriate, learners should also be told in an age-appropriate way how their information is used.

5. Personal information we collect

5.1 Learners and prospective learners

• Name, date of birth, identity or passport number, gender, home language, nationality and, where relevant, study permit details.
• Contact details and home address.
• Previous schools, reports, academic records, assessments, marks and progress reports.
• Attendance, behaviour and disciplinary records.
• Sport, culture and extra-mural participation and achievements.
• Photographs and video recordings (see section 9).
• Login details, where a learner uses a school platform that needs a login.

Special personal information, which POPIA protects more strictly, is collected only where it is needed and the law allows it. This may include:

• health information, allergies, medication, medical aid details, disabilities and learning support needs, including reports from health or support professionals;
• religious or belief information, where relevant to school activities;
• race or ethnic origin, only where the law requires it, for example for reporting to education authorities; and
• information about alleged or actual misconduct, where needed for safeguarding or discipline.

5.2 Parents and guardians

• Names, identity numbers, relationship to the learner, and custody or guardianship arrangements, including court orders where relevant.
• Contact details, home and work addresses, occupation and employer.
• Fee account, banking and payment details, and information needed for fee arrangements.
• Communications with the school.

5.3 Staff, contractors, volunteers and job applicants

• Name, identity number, contact details, address, date of birth and nationality or work permit details.
• CV, qualifications, references, employment history and professional registration, for example with the South African Council for Educators (SACE).
• Employment contract, salary, tax number, banking details, leave, performance and disciplinary records.
• Results of background checks that the law requires or allows for people who work with children.
• Health information needed for employment law, leave or workplace safety.
• Race, gender and disability information where employment equity law requires it.

Job applicants: we use your information to assess your application.

5.4 Website users

When you use the Websites, we may collect:

• information you enter into our forms, such as your name, contact number, email address and message;
• information in an application form or job application you send to us;
• technical information such as your IP address, browser and device type, and pages visited;
• information used by any spam-protection service on our forms; and
• information collected through cookies, as explained in our Cookie Policy.

The Websites are intended for adults (parents, guardians, applicants and the public). Children should ask a parent or guardian before sending us personal information through the Websites.

5.5 Visitors to our campuses

Where we keep visitor registers or use CCTV on campus, we collect the information recorded in them, such as a visitor’s name, identity number, vehicle registration, reason for visit and camera images.

5.6 Where we get personal information from

Mostly directly from you, or from a learner’s parent or guardian. We may also receive it from previous schools, health and support professionals (with consent), referees, background screening providers, education authorities, examination and assessment bodies, and public sources.

6. Why we use personal information and our lawful basis

We only process personal information for specific, lawful purposes, relying on one or more of the grounds in section 11 of POPIA: consent; concluding or performing a contract; a legal obligation; protecting the legitimate interest of the person concerned; or our legitimate interests.

7. Who we share personal information with

We do not sell personal information. We share it only when needed, with:

• education authorities, such as the Free State Department of Education, and examination or assessment bodies, where applicable;
• other schools, when a learner transfers;
• health and support professionals, in an emergency or with consent;
• service providers who help us run the school or the Websites, where they need the information to provide their service to us;
• tour, transport and event partners, only as needed for a trip or event;
• professional advisers, such as our auditors, attorneys and insurers;
• debt collection services, where applicable; and
• authorities, such as SARS, the police, courts, social services or the Information Regulator, when the law requires it, including mandatory reporting of suspected child abuse.

The schools use systems and tools to support administration and communication, including SAMS (school administration), Sage Pastel Partner and Pastel Payroll (accounting and payroll) and the D6 Communicator app (parent communication). The Websites are developed by NetMechanic. Naming a system here does not mean the provider receives or processes personal information on our behalf.

Where a service provider does process personal information on our behalf (an “operator” under POPIA), POPIA requires it to keep the information confidential and secure, and requires a written agreement with it (sections 20 and 21).

8. How long we keep personal information

We keep personal information only for as long as we need it for the purpose it was collected for, or for any longer period required or allowed by law, for example under education, tax, labour and company record-keeping laws. Photos and videos used to promote the school are kept in line with the consent given (see section 9).

When information is no longer needed, it should be destroyed, deleted or de-identified securely, as POPIA requires.

9. Photographs and video

We take photos and videos of school life, including sport, culture, events and classes. We use them:

• internally, for school records, yearbooks and displays; and
• publicly, on the Websites, social media, newsletters, adverts and printed material, with the consent of the learner’s parent or guardian. Where the school’s application or registration documents include a photo consent section, that consent applies.

Parents and guardians can withdraw this consent at any time by contacting their campus office. If consent is withdrawn, the images should not be used in new material and reasonable steps should be taken to remove them from the Websites and the schools’ social media pages. Printed material that has already been distributed may not be recoverable.

Parents and visitors who take photos at school events should respect other families’ privacy and should not post photos of other people’s children online without permission.

10. Transfers outside South Africa

Some service providers, such as cloud email or storage services, may store information on servers outside South Africa. Where this happens, POPIA (section 72) allows personal information to be transferred outside South Africa only in specified circumstances, for example where the recipient is bound by laws or agreements that give adequate protection, where it is needed to perform a contract, or with consent.

11. How we protect personal information

As POPIA requires, we take appropriate and reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access or use.

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, POPIA (section 22) requires the Information Regulator and the people affected to be notified, subject to the exceptions in that section.

12. Your rights

You (or, for a learner, the parent or guardian) have the right to:

• ask whether we hold personal information about you and request a copy (see our PAIA Manual);
• ask us to correct or update information that is inaccurate or out of date;
• ask us to delete or destroy information we are no longer allowed to keep;
• object to processing based on legitimate interests, and to direct marketing;
• withdraw consent at any time (this does not affect processing that took place before withdrawal, and may affect services that need the information); and
• complain to the Information Regulator.

To exercise these rights, contact your campus office (see section 3). We may need to confirm your identity first.

13. Direct marketing

Under section 69 of POPIA, electronic marketing (such as open day invitations to people who are not current parents) may only be sent if you have opted in, or where you are an existing parent and it relates to the school’s own similar services. POPIA requires every such message to include a way to opt out.

14. Complaints

If you are unhappy with how we handle your personal information, please contact your campus office first. You may also complain to the Information Regulator. Its current contact details are published on its website: https://inforegulator.org.za

15. Changes to this notice

We may update this notice from time to time. The latest version will be published on nhc.co.za, together with the date it was last updated.