Simply Models
Book a class
Legal

Privacy Policy

Last updated: 6 May 2026

Simply Models KZN ("we", "us", "the studio") respects your privacy and is committed to protecting your personal information in line with the South African Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, how we look after it, and the rights you have over it.

1. Who we are

Simply Models KZN is a modelling, pageant and etiquette school operating from 9 Pinnacle Park, Ballitoville, KwaZulu-Natal, South Africa. The owner and information officer is Melissa (melissa@simplymodels.co.za).

The Simply Models platform (this website, the admin portal at /admin, and the upcoming mobile app) is built and operated on our behalf by Effekt Studios (franco@effektstudios.com) using Firebase (Google).

2. Information we collect

From parents & adult students

  • Name, surname, email, phone number
  • Account credentials (passwords are stored hashed — we never see them)
  • Class enrollments and attendance
  • Invoice and payment records (we do not store full card numbers — payment is handled by PayFast)
  • Messages you send in the app
  • Push-notification device tokens

From children (under 18)

  • Name, age, gender
  • Class enrollments, attendance and teacher notes
  • Photos and videos taken during classes (only with explicit parental consent)
  • Class reviews submitted by students aged 13+

For children under 13, no separate account is created — the child's profile is held under their parent or legal guardian's account, and all interactions are mediated by that account.

For students aged 13–17, a separate login may be issued with parental approval. Parents retain visibility of their child's activity, messages and notes.

For students aged 18+ who request independence from their parent's account, identity verification (front + back of an official ID) is collected to confirm the request before unlinking.

Automatic information

  • Standard server logs (IP address, user agent, timestamps)
  • Anonymous analytics about how the site and app are used

3. How we use your information

  • To run classes — enrollments, schedules, attendance, billing
  • To communicate with you — newsletters, event invitations, class updates, messages
  • To collect payments and issue invoices
  • To create and share photos / videos of class work, but only with explicit consent (and in the case of minors, parental consent)
  • To improve our service and detect abuse
  • To comply with legal obligations

4. Lawful basis for processing

We process your personal information based on one or more of: your consent, performance of our service contract with you, our legitimate interest in running the studio, and our legal obligations.

5. Who we share information with

  • Google Firebase — hosting, authentication, database, file storage, push notifications.
  • PayFast — South African payment gateway, handles card payments. We do not see or store card numbers.
  • Behold.so (optional) — embeds our public Instagram feed on this website.
  • Instagram / Facebook — only when you explicitly share content to your own social account, or when we share publicly with consent.
  • Law enforcement — only where required by law.

We do not sell your personal information.

6. Storage location & security

Your data is stored in Google Firebase. While most regions are configurable, our Cloud Functions run in the europe-west2 (London) region, and Firestore data follows Google's regional defaults. We use industry-standard encryption in transit (TLS) and at rest, role-based access controls, and audit logs for sensitive actions.

7. How long we keep your information

  • Account data — for as long as your account is active
  • Invoices and payment records — 5 years (SARS / VAT requirements)
  • Class media (photos / videos) — until you withdraw consent, or 3 years, whichever is sooner
  • Messages — 3 years from last activity
  • Server logs — 90 days

8. Your rights under POPIA

You have the right to:

  • Access the personal information we hold about you
  • Correct or update it
  • Withdraw consent (where consent is the basis of processing)
  • Object to processing
  • Request deletion of your account and data — see /data-deletion
  • Lodge a complaint with the Information Regulator (inforegulator.org.za)

9. Children's information

We take particular care with children's data. Photos and videos of minors are not shared publicly without explicit parental consent. Parental consent is captured up-front, can be withdrawn at any time, and is stored on the parent's account record.

10. Cookies & tracking

The marketing website uses minimal cookies — only those required for the site to function. We do not use third-party advertising trackers.

11. Changes to this policy

If we make material changes, we will notify you by email and update the "Last updated" date above.

12. Contact

To exercise any of your rights, ask a question, or raise a concern, email melissa@simplymodels.co.za or write to the studio at 9 Pinnacle Park, Ballitoville, KZN.