Operator agreement for schools

1. Parties

This agreement is between:

• The school: [name of the school], registration or EMIS number [number], of [physical address], whose information officer is [name and email address]; and
• SyncFac: SyncFac (Pty) Ltd, registration number 2026/728471/07, trading as CornyBits, at the address in the CornyBits terms of use, whose information officer is reached at support@cornybits.com.

The school is the responsible party for the personal information of its staff and learners processed in its school workspace. SyncFac is its operator.

2. Definitions

• POPIA means the Protection of Personal Information Act 4 of 2013 and its regulations.
• Personal information, processing, responsible party, operator, data subject and information officer have the meanings POPIA gives them.
• The service means CornyBits as licensed to the school: the management app, the play and display app, and the server they use.
• School workspace means the CornyBits organisation SyncFac sets up for the school, with its education mode on.
• Staff means the school's teachers and other people with a staff account in the school workspace. Learners means the people on the school workspace's class lists and the people who join games in it.
• Sub-operator means a third party SyncFac uses to process the school's personal information.
• Academic year end means 31 December, or another date the school sets in its school workspace.

3. Subject matter, nature and purpose

• SyncFac processes personal information only to provide the service to the school: keeping the school's class lists, letting learners sign in with their picture codes, running live and assigned lesson games, showing them on the school's screens, keeping their results and the class reports, applying the reading and time settings teachers choose, letting staff sign in and manage the school workspace, exchanging class lists and results with the systems the school links (clause 9), sending staff the emails the service needs (invitations, verification links and sign-in codes), support, security and backups.
• The processing consists of collecting, storing, organising, showing on the school's screens and devices, retrieving, exporting at the school's request, anonymising and deleting that information.
• SyncFac does not use the information for marketing or profiling, does not sell it, does not use it to train AI models, and does not combine it with information from outside the school workspace, apart from the class lists the systems the school links send (clause 9).

4. Data subjects and categories of information

The service does not collect learners' email addresses, birth dates, photos or contact details, and learners never get accounts. Learners under 18 are children under POPIA, so their personal information is processed only on the school's authority (clause 14).

A learner's reading and display settings and extra time can show that the learner has a learning need, so SyncFac treats them as sensitive. Only the school's staff who can see the class and the learner's own signed-in device receive them; other learners and the screen never see who has them. They are never sent to Prefect, a learning platform or EventSync, and never included in an export.

5. Processing only on the school's instructions

• SyncFac processes the personal information only with the school's knowledge and authorisation, and on its documented instructions: this agreement, the settings the school chooses in its school workspace, and written instructions from the school's information officer or a person the school names in writing.
• If SyncFac believes an instruction would break POPIA or another law, it tells the school and need not follow that instruction.
• If a law requires SyncFac to process the information in another way, SyncFac tells the school first, unless that law forbids it.

6. Confidentiality (section 20)

• SyncFac treats the school's personal information as confidential and does not disclose it, unless the law requires it or the proper performance of the service needs it.
• Only SyncFac's people who need access to provide the service or support the school have it, and each is bound to keep the information confidential.

7. Security safeguards (sections 19 and 21)

SyncFac keeps these measures in place for the school's personal information:

• Encryption in transit: every connection between a device and the service is encrypted.
• Access control: each organisation's games, packs and learners are kept in a separate database; staff see only what their role allows; staff, learners and screens use separate, short-lived credentials that work only for their own purpose.
• Two-step sign-in: available to every staff member, and the school can require it for all of its staff.
• Audit log: staff actions are recorded with who did what and when.
• Backups: kept for 30 days and then deleted.
• Hidden until revealed: answers and captions waiting for the teacher's approval are never sent to learners' devices or the screen before they are revealed or approved.

SyncFac reviews these measures when the service or the risks to it change, and keeps them at least this strong.

8. Where the information is kept

• The school's personal information is stored in South Africa: the servers, databases, files and backups are hosted by xneelo, and staff emails are sent through Afrihost, both in South Africa.
• SyncFac does not transfer the school's personal information outside South Africa, except to a system the school itself links, at its instruction (clause 9).

9. Sub-operators

• xneelo, South Africa: hosts the servers, databases, stored files and backups.
• Afrihost, South Africa: sends staff emails. Learners have no email address in the service.

SyncFac uses sub-operators only under written terms that require them to keep the information secure and confidential. It tells the school in writing at least 30 days before it adds or replaces a sub-operator. The school may object in that time; if the objection cannot be resolved, the school may end this agreement and its licence.

Drafting questions with AI. If the school's licence includes drafting quiz questions with AI and staff use it, SyncFac sends a brief to the AI provider it has selected, Anthropic or OpenAI, in the United States. The brief is only the topic and the settings (how many questions, which kinds, the difficulty and an optional South African focus), an optional CAPS grade, subject and term, and optional teaching material a teacher pastes in or uploads as a PDF and confirms is teaching material. It never contains a name, an email address, school details, learner data, learners' own work or answers: a topic that looks like contact details or a link, and material that contains an email address, a phone number or the name and initial or reference of a learner on the school's class lists, are refused before anything is sent. The material is kept only until the drafts are ready. These providers therefore receive no personal information under this agreement.

Systems the school links. The school may link its school workspace to Prefect, SyncFac's school administration system, or to its own learning platform: Google Classroom, or an LTI 1.3 platform such as Moodle, Brightspace, Canvas or Blackboard. Linking one is the school's instruction to exchange this information with it:

• Prefect sends class lists (each learner's preferred name, surname initial and Prefect's id for them) and invites teachers (their name and email address). SyncFac sends back the results of each finished game played by a class from Prefect: for each learner, Prefect's id, the score, the marks available, how many questions they answered and their place, with the game's title, date and subject and Prefect's ids for the class and the teacher. It never sends a learner's name.
• A learning platform sends its class lists (each learner's preferred name, the first letter of their surname and the platform's own id for them). SyncFac sends each learner's mark as a percentage against the platform's id for them, and the announcements and assignments a teacher asks for.
• These systems are the school's choice, not SyncFac's sub-operators, and the school's own terms with each govern what it does with the information. A system hosted outside South Africa, such as Google Classroom, receives the marks and ids there: linking it is the school's instruction to send them there.
• Reading and display settings and extra time are never sent to any of them.

10. Security compromises (sections 21 and 22)

If SyncFac has reasonable grounds to believe that the school's personal information has been accessed or acquired by an unauthorised person, it tells the school's information officer without undue delay, and tells them:

• what happened and when, as far as it is known;
• which kinds of personal information, and roughly how many staff and learners, are affected;
• the likely consequences;
• what SyncFac has done and will do about it, and what it recommends the school and the people affected do;
• who the unauthorised person is, if SyncFac knows; and
• the person at SyncFac to contact about it.

SyncFac updates the school as it learns more, and helps it notify the Information Regulator and the people affected. The school, as the responsible party, decides on those notifications.

11. Requests from staff, learners and parents

• A request to see, correct or delete personal information in the school workspace, or an objection, that reaches SyncFac is passed to the school promptly. SyncFac does not answer it itself unless the school asks it to.
• SyncFac helps the school answer each request. Staff with permission can remove a learner's details from a game, remove a learner from a class (which deletes them from the class list as clause 12 describes) and export results from the management app; SyncFac does what the school needs beyond that.

12. Retention and deletion

• At the academic year end, learners' names and the words they typed (typed answers, blanks and captions) are removed from the school's games that ended before it. Scores stay.
• Class lists are not removed at the academic year end. A learner stays on a class list, with their settings, quizzes and results in the class report, until a teacher removes them from the class, Prefect or the school's learning platform removes them, or the school workspace is closed. Archiving a class keeps its list.
• Removing a learner from a class deletes their row on the class list, including the picture code, reading and display settings and extra time, removes their name and words from their games while keeping the scores, and keeps their quizzes without their name.
• A learner Prefect removes is erased at once, or within seven days if they are in a game being played. When the Prefect link ends, the classes and learners it brought in are deleted. Prefect's ids on results are removed at the academic year end.
• When the school disconnects a learning platform or stops a course, the learners it brought in are removed in the same way, usually within minutes and at the latest within 30 days.
• If the school closes its school workspace, SyncFac deletes its games, learners, packs, files, screens and staff access within 90 days of the request, keeping only the billing records that tax and accounting law requires.
• Backups are kept for 30 days, so deleted information leaves them within 30 days.
• Before it closes the workspace, the school can export the results it wants to keep.

13. Information and audits

• SyncFac answers the school's reasonable written questions about how it meets this agreement, and gives the school the information it reasonably needs to show that SyncFac does.
• SyncFac helps the school answer questions from the Information Regulator about the school workspace.

14. The school's responsibilities

• The school has a lawful basis for the processing it instructs, including any consent of a competent person that POPIA section 35 requires for children's personal information, and tells its staff, learners and parents how the service is used.
• The school keeps its instructions and settings lawful, keeps its staff accounts to the people who need them, and does not put learners' personal information, such as photos, into packs or questions.

15. Term and termination

• This agreement starts when both parties have signed it and runs for as long as SyncFac processes personal information for the school.
• Either party may end it by written notice if the other materially breaches it and does not put the breach right within 30 days of being told about it in writing.
• When the school's licence ends, the school workspace is closed and its information deleted as clause 12 sets out. Clauses 6, 10, 11 and 12 continue to apply until that is done.

16. General

• This agreement forms part of the school's licence for CornyBits. Where it differs from the CornyBits terms of use or privacy notice about the school's personal information, this agreement applies.
• A change to this agreement is valid only in writing signed by both parties.
• Notices go by email to each party's information officer at the address in clause 1.
• South African law governs this agreement.

17. Signatures