Website Privacy & Cookies Policy

This notice applies to this website, our contact channels and the Summerhill application and Book-a-Tour forms hosted at forms.summerhill-school.co.za. It explains how we collect, use, share, store and protect personal information and complements our internal school privacy practices, enrolment documents and PAIA Manual.

• Contact enquiries: name, surname, email address, telephone number, selected department and the content of your message when you contact us through an available website channel or by email.
• Book-a-Tour forms: parent or guardian contact details, learner name, current school and grade, gender, school phase of interest, proposed admission year, preferred tour date and how you heard about Summerhill.
• Online applications: learner and parent or guardian identity and contact details; dates of birth; nationality, gender, religion and population group; schooling and sibling information; medical aid, allergies, medical conditions, medication and doctor details; emergency contacts; employment and financial information; admission choices; identity documents, reports and other supporting records; proof of payment; and a learner photograph where requested.
• Technical information: device, browser, usage and security information, IP address, requested pages and consent choices collected through server logs, cookies and browser storage.

We do not display form submissions or application information publicly.

We usually collect application information directly from a parent, guardian or authorised applicant. Required fields are identified on the relevant form. If required information is not provided, we may be unable to arrange a tour, respond fully to an enquiry or process an application.

We process information on one or more lawful grounds under POPIA:

• Consent for optional information, non-essential cookies, direct marketing where applicable and the processing of children’s or special personal information where consent is required.
• Contract or steps before a contract when processing applications, admissions and enrolment.
• Legal obligations for statutory reporting and record keeping.
• Legitimate interests in responding to enquiries, preventing misuse, maintaining website security and improving our services, where those interests do not override your rights.

We use the information for the purpose for which it was collected, including tour coordination, admissions assessment, school administration, correspondence, security, legal compliance and consent-based website measurement. We do not sell personal information or make admission decisions solely by automated means.

We use personal information to respond to enquiries, arrange school tours, process applications, manage admissions, communicate with parents or guardians and operate the website securely.

We share information only where reasonably necessary for these purposes, where required by law, with your consent, or with operators that provide services under our instructions and appropriate confidentiality and security requirements. Our current website technology and operators include:

• Replit: hosting and delivery of the public React/Vite website, including operational and security logs.
• WordPress and Gravity Forms: operation of the separate Summerhill application and tour-booking website, form validation, file uploads and, where selected, “save and continue” functionality.
• WordPress/form hosting and email providers: hosting the forms website and delivering submission notifications and correspondence to authorised School staff.
• Google Workspace: authorised internal processing and storage using services such as Google Drive, Sheets and email.
• Google Analytics: consent-based measurement using property G-0GWM4WCB2B. Advertising storage, Google Signals and ad personalisation are disabled by this website.
• Google Maps: the interactive map is blocked until functionality and embedded-content consent is given.
• WordPress-hosted media: delivery of selected logos, photographs and documents from Summerhill’s WordPress domains may disclose standard request information such as an IP address and browser details to the relevant hosting provider.
• External websites: accreditation bodies, the JOL website and Summerhill’s Facebook and Instagram pages receive information only when you choose to follow those external links.
• Payments: application fees are currently paid by EFT. We do not collect or store card details on this website.

Operators acting for Summerhill may process information only for the agreed service and must protect it appropriately. Independent external services may also process information under their own privacy notices.

Children’s information, health information, religious information and population-group information may be special personal information under POPIA. We collect it from a parent, legal guardian or other authorised person where it is necessary for admissions, learner safety, support, statutory reporting or school administration and where a lawful basis and any required consent are in place. We may request proof of authority or guardianship. Learner images are published only with appropriate permission.

We retain information only for as long as required for its purpose and applicable legal duties:

• Contact and tour enquiries are normally deleted within 12 months after administrative follow-up, unless they become part of an application or enrolment record.
• Incomplete “save and continue” Gravity Forms entries are retained only for the period configured on the forms website or until the continuation link expires.
• Unsuccessful applications may be retained for up to 24 months for audit and follow-up purposes.
• Successful application information becomes part of the learner record and follows the School’s retention schedule and applicable law.

Information is securely deleted or anonymised when it is no longer required.

We use administrative, technical and physical safeguards, including HTTPS encryption, role-based and least-privilege access, restricted admissions access, software updates, backups and multi-factor authentication for administrators where available. No internet transmission or storage system is completely secure. Security incidents are assessed and handled under our breach procedures, including notification to the Information Regulator and affected people where required by POPIA.

Subject to applicable law, you may ask whether we hold your information, request access to it, request correction or deletion, object to processing, or withdraw consent where consent is the lawful basis. You may also object to direct marketing and lodge a complaint with the Information Regulator. Contact the Information Officer at the email address above. We may need to verify your identity or authority before acting on a request. Formal record-access requests may also be made under PAIA.

Replit, Google and other technology providers may process or store information outside South Africa. Where personal information is transferred across borders, we take reasonable steps to meet section 72 of POPIA, including using recipients subject to adequate data-protection laws, binding agreements or other lawful safeguards.

Cookies and browser storage help the website remember privacy choices, maintain security, display optional external content and understand site usage. The consent manager stores your choice in local browser storage for up to 180 days. Non-essential services remain off until you consent.

• Essential storage: the consent record and technologies required for security and delivery of the website.
• Analytics: if accepted, Google Analytics may use cookies such as _ga and related identifiers to measure visits, viewed pages and technical usage information.
• Functionality and embedded content: if accepted, Google Maps may load and set or read its own technologies.
• Marketing: this category is available in the preference manager, but no marketing or advertising technology is currently enabled on this website.

You can accept, reject or select individual categories in the consent banner. You can change or withdraw consent at any time using the small cookie-settings icon at the bottom of the page. Withdrawal does not affect processing that was lawful before withdrawal. You can also clear or block cookies in your browser, although this may affect some features.

We will send electronic direct marketing only where permitted by POPIA and other applicable law. Marketing messages will identify Summerhill and provide a reasonable way to unsubscribe. Service, admissions and school-administration messages are not marketing communications.

Send privacy questions, requests or complaints to the Information Officer at info@summerhill-school.co.za.

If we cannot resolve your concern, you may contact the Information Regulator (South Africa) at inforegulator.org.za or POPIAComplaints@inforegulator.org.za. Its offices are at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

We may update this notice from time to time. Material changes will be posted on this page together with a revised “Last updated” date.