Privacy Policy

SparkQuest is a South African learning platform designed to help children learn through curiosity, exploration and engaging CAPS-aligned learning experiences.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you use SparkQuest, and the choices and rights available to you.

• SparkQuest (Pty) Ltd
• Registration number: 2026/698512/07
• Cape Town, South Africa
• Website: sparkquest.co.za
• Privacy enquiries: info@sparkquest.co.za

For purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), SparkQuest is the responsible party where we determine why and how personal information is processed.

This Privacy Policy applies to personal information we process about:

• Parents and guardians who create or manage SparkQuest accounts;
• children who have learner profiles connected to those accounts;
• people who communicate with SparkQuest, including through WhatsApp;
• visitors to the SparkQuest website;
• prospective subscribers and customers; and
• other people who interact with SparkQuest.

Different features may involve different types of information. We aim to explain those differences clearly rather than treating every SparkQuest interaction as the same.

Children’s privacy deserves particular care.

POPIA places specific restrictions on processing children’s personal information. Processing may take place in circumstances permitted by POPIA, including where the required prior consent has been obtained from a competent person, such as an appropriate Parent or guardian.

SparkQuest has therefore been designed around Parent- or guardian-managed family accounts.

Parents and guardians create and manage learner profiles and exercise the relevant account and privacy controls on behalf of their learners.

Learners have separate learner access through mechanisms such as Spark PIN and Spark Pass, rather than needing to manage an adult-style account themselves.

We aim to collect and use only the learner information reasonably necessary to provide, secure and improve the SparkQuest learning experience.

We do not sell children’s personal information.

SparkQuest is a learning environment, not an open social network. Learners do not have open public profiles, uncontrolled social feeds or the ability to receive messages from strangers.

The information we process depends on how you use SparkQuest.

Parent and guardian information

This may include:

• name;
• email address;
• contact information;
• preferred language;
• account and authentication information;
• communication preferences;
• subscription and plan information;
• WhatsApp number and WhatsApp communication preferences where applicable;
• support enquiries and correspondence with SparkQuest.

Learner information

A Parent or guardian may provide information needed to create and manage a learner profile, such as:

• learner name;
• grade;
• learning language or language preferences;
• subject and learning selections; and
• relevant learning preferences.

Learning and progress information

As a learner uses SparkQuest, we may process information such as:

• Quests and Discoveries undertaken;
• learning activities and responses;
• results and progress;
• mastery information;
• XP and learning achievements;
• activity or streak information;
• Growth Dimension progress; and
• learning-friction or support signals used to help us understand and improve the learning experience.

This information helps SparkQuest provide learning experiences, record progress and support appropriate personalisation.

Access and authentication information

We process information needed to securely operate Parent and learner access, including authentication, sessions and learner-access mechanisms such as Spark PIN and Spark Pass.

We do not publicly expose learner credentials.

Communications

Where you communicate with SparkQuest, we may process the information contained in that communication and the information needed to respond to it.

This includes support enquiries and, where enabled, WhatsApp communications.

Technical and security information

We may process limited technical information required to operate and protect SparkQuest, such as authentication events, session information, system and security logs and technical records associated with errors or suspicious activity.

We primarily collect personal information:

• directly from Parents or guardians when they create or manage an account;
• when a Parent creates or manages a learner profile;
• when a learner uses SparkQuest;
• when you communicate with us;
• through WhatsApp where you have chosen to use that channel;
• automatically where technical information is necessary to authenticate, secure or operate SparkQuest; and
• through service providers where necessary to deliver a feature you have chosen to use.

We do not purchase children’s personal information for marketing purposes.

We use personal information for purposes including:

• creating and managing SparkQuest accounts;
• creating and managing learner profiles;
• providing CAPS-aligned learning experiences;
• providing appropriate learning pathways and personalisation;
• recording and displaying learning progress;
• allowing Parents to manage their learners;
• securing Parent and learner access;
• communicating with Parents;
• delivering requested WhatsApp communications;
• administering subscriptions and plans;
• providing support;
• generating requested Explorer imagery;
• operating and maintaining SparkQuest;
• improving the learning and product experience;
• detecting and preventing misuse;
• protecting the security and integrity of SparkQuest; and
• meeting applicable legal and recordkeeping obligations.

We do not use children’s personal information for targeted advertising.

Depending on the information and purpose involved, SparkQuest processes personal information on one or more grounds permitted by applicable law.

These may include:

• consent;
• consent or authority provided by an appropriate Parent, guardian or other competent person in relation to a child;
• processing necessary to provide a service requested by the Parent;
• processing necessary to perform or administer an agreement;
• compliance with legal obligations;
• protection of legitimate interests as permitted by POPIA; and
• other grounds permitted by applicable law.

Where processing depends on consent, consent may generally be withdrawn, subject to applicable law and any processing that is independently permitted or required.

Withdrawing consent for one optional feature or communication does not necessarily require deletion of the entire SparkQuest account.

Parents and guardians have control over learner profiles connected to their family account.

An important distinction exists between archiving and permanently deleting a learner.

Archive a learner

Archiving is reversible.

The learner’s access is disabled and the learner no longer occupies an active learner seat, but their learning history is retained so that the Parent can restore the learner later.

Permanently delete a learner

Permanent deletion is irreversible.

SparkQuest requires appropriate Parent authentication before permanent learner deletion.

Once completed, the learner’s associated SparkQuest product data, learning information, learner access information and applicable stored learner files are permanently removed through our deletion process.

Our Data Deletion page explains this in more detail.

SparkQuest may offer features that use artificial intelligence to create personalised Explorer imagery.

If a Parent or learner chooses to use such a feature, information or an image submitted for that purpose may be processed by an AI service provider so that the requested image can be generated.

We use this processing to provide the requested feature and associated technical, safety and security functions.

We do not use an Explorer image to make legal or similarly significant automated decisions about a learner.

Parents and learners should avoid including unnecessary sensitive personal information when using AI-enabled features.

As SparkQuest introduces additional AI-enabled functionality, we will review the privacy implications and update our disclosures where necessary.

Parents may choose to communicate with SparkQuest or receive eligible communications through WhatsApp.

Where WhatsApp is used, we may process:

• the Parent’s WhatsApp number;
• communication and consent preferences;
• messages exchanged with SparkQuest;
• delivery and message-status information; and
• limited technical information necessary to operate, troubleshoot and secure the service.

Parents can change applicable WhatsApp preferences or opt out.

Opting out of WhatsApp does not delete your SparkQuest account.

Where we send optional promotional communications, we will provide appropriate ways to manage or withdraw those preferences.

Essential service, account or security communications may still be necessary even where promotional communications have been declined.

We do not sell Parent or learner personal information.

We use carefully selected service providers to operate SparkQuest. Depending on which features are used, providers may support:

• cloud hosting;
• databases;
• authentication;
• file storage;
• transactional and account email;
• WhatsApp Business communications;
• AI image generation; and
• technical website resources.

We aim to provide service providers only with information reasonably necessary for the relevant service.

Our currently verified technical integrations include services supporting SparkQuest’s cloud infrastructure, Meta’s WhatsApp Business Platform and AI image generation.

Some service providers or their infrastructure may be located outside South Africa or may process information in other countries.

Where personal information is transferred outside South Africa, SparkQuest will handle those transfers in accordance with applicable data-protection requirements.

Because SparkQuest processes children’s personal information, we will separately assess international transfers involving children’s information against POPIA’s requirements, including any applicable prior-authorisation requirements.

We do not intend to retain identifiable personal information indefinitely.

Retention depends on what the information is, why we need it and whether an account remains active.

Active account and learner information

Parent, learner and learning information is generally retained while the relevant account or learner profile remains active, unless it is deleted earlier.

Archived learner information is retained because Archive is intentionally reversible.

WhatsApp information

Our current operational retention periods include:

• message content — up to 180 days;
• raw WhatsApp webhook information — up to 30 days;
• Meta message identifiers — up to 90 days;
• successful operational metadata — up to 24 months, with anonymisation after 180 days where possible; and
• failure information — up to 12 months.

Cold conversation identifiers and Parent associations may be anonymised after approximately 180 days where there is no open reply window or unresolved failure.

Permanent account deletion triggers accelerated severance or redaction of relevant WhatsApp information rather than simply waiting for the ordinary retention periods.

Subscription and accounting information

Current learner seat information is removed where applicable during account deletion.

Limited historical subscription or accounting information may be retained in de-identified or otherwise appropriately limited form where reasonably necessary for legal, tax or accounting purposes.

We do not retain identifiable learner information merely because an anonymous historical entitlement record needs to be preserved.

Security and audit records

Limited security and audit records may be retained where reasonably necessary to protect SparkQuest, investigate security incidents, demonstrate appropriate system activity or meet legal obligations.

Where a customer account has been permanently deleted, surviving technical references may be de-linked from the information that previously identified that customer.

Anonymised information

Information that has been genuinely anonymised so that it can no longer reasonably be linked to an identifiable person may be retained for statistical, operational or analytical purposes.

Parents can request deletion of their entire SparkQuest family account through the account settings.

A family-account deletion applies to the Parent account and all learner profiles associated with it.

Once the request is securely confirmed:

• normal family-account operation is restricted immediately;
• learner access is disabled;
• outbound WhatsApp communication is stopped; and
• a 30-day cooling-off period begins.

During the cooling-off period, the Parent may cancel the deletion request after securely authenticating again.

If cancelled, SparkQuest restores the relevant account and learner-access settings to their previous state, except where a credential or setting had independently been disabled or revoked.

Once permanent deletion begins after the cooling-off period, the request can no longer be cancelled.

Permanent deletion removes the Parent account and associated learner information from the active SparkQuest systems covered by our deletion process.

Certain limited records may survive in de-identified, anonymised or otherwise restricted form where reasonably necessary for legal, accounting, security or legitimate recordkeeping purposes.

Our Data Deletion page explains the process and distinctions in more detail.

We use technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Our safeguards include controls relating to:

• authentication;
• server-side authorisation;
• Parent and learner access;
• role and permission boundaries;
• restricted administrative functionality;
• session management;
• logging;
• data lifecycle and deletion; and
• security monitoring and operational controls.

No online system can responsibly guarantee absolute security. We therefore review and improve our safeguards as SparkQuest evolves.

If SparkQuest becomes aware of a security compromise involving personal information, we will respond in accordance with applicable legal requirements.

SparkQuest currently uses browser storage required for functional purposes such as authentication, learner sessions and limited interface preferences.

Our current public website does not use third-party behavioural advertising trackers or advertising analytics.

We are separately developing our Cookie Policy and cookie-information experience.

If the technologies used by SparkQuest change, we will update our disclosures and consent mechanisms where appropriate.

We may from time to time communicate with Parents about SparkQuest products, features, news or offers where permitted by law.

Where consent is required for electronic direct marketing, we will seek it as required.

You can opt out of eligible marketing communications using the method provided in the communication or through available account controls.

Opting out of marketing does not prevent us from sending communications reasonably necessary for:

• account administration;
• authentication;
• security;
• requested services;
• support; or
• important changes affecting your SparkQuest service.

We do not direct behavioural advertising to children.

Subject to POPIA and other applicable law, you may have rights to:

• ask whether SparkQuest holds personal information about you;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion or destruction where applicable;
• object to certain processing;
• withdraw consent where processing depends on consent; and
• complain about how personal information has been processed.

Parents and guardians can exercise relevant controls over their own and their learners’ information through SparkQuest or by contacting us where appropriate.

If you have a privacy question or concern, we encourage you to contact SparkQuest so that we can investigate and respond.

Privacy enquiries: info@sparkquest.co.za

You also have the right to approach the Information Regulator (South Africa) regarding the processing of personal information.

The Information Regulator provides prescribed processes for POPIA complaints, including an online complaint mechanism.

Use the current official Information Regulator details:

• Information Regulator (South Africa)
• Woodmead North Office Park
• 54 Maxwell Drive
• Woodmead
• Johannesburg

• Postal: PO Box 31533, Braamfontein, Johannesburg, 2017
• Telephone: 010 023 5200
• Toll-free: 0800 017 160
• Email: enquiries@inforegulator.org.za

You can find the prescribed complaint process on the official Information Regulator website.

SparkQuest may contain links to third-party websites, resources or services.

Where you leave SparkQuest and use a third-party service independently, that service’s own terms and privacy practices may apply.

A link from SparkQuest does not mean that we control the third party’s privacy practices.

We encourage Parents to review relevant third-party privacy information where appropriate.

SparkQuest will continue to evolve.

We may update this Privacy Policy when our services, technology, practices or legal obligations change.

Where a change materially affects how we process personal information, we will take reasonable steps to bring it to the attention of affected users where appropriate.

The Last updated date at the top of this page will indicate the latest revision.

For questions, privacy requests or concerns:

• SparkQuest (Pty) Ltd
• Registration number: 2026/698512/07
• Cape Town, South Africa
• Website: sparkquest.co.za
• Email: info@sparkquest.co.za