For organizations using South Dune, not for South Dune itself. Each organization (gym, studio, school, club) is the Responsible Party for its members' personal information and must adapt and publish this notice for its own members. Replace every [bracketed] field with your own details. Have this notice reviewed by an attorney before relying on it, particularly where children, consent, or special personal information are involved.

Privacy Notice for Parents & Guardians

Organization: [Organization Name] Effective date: [DATE] · Notice version: 1.0

This notice explains what personal information [Organization Name] collects about your child (a "Member") when they join or participate in our activities, how we use it, who we share it with, and your rights as their parent or legal guardian.

We use software called South Dune, operated by Pitonix Digital Pty Ltd, to help us manage member records, scheduling, attendance, and billing. South Dune acts as our Operator (data processor) for this information. We remain responsible for deciding why and how your child's personal information is processed.

1. What we collect, and why

Data	What it's used for	Who can see it
First and last name	Identifying your child on the roster, scheduling, and session attendance	Staff with roster access
Date of birth	Age-categorization only — placing your child in the correct age group for sessions. It is not used for public materials and is not shown to ordinary staff where a computed age or age-band is sufficient.	Owners and Administrators only
Group tags (for example, "Swimming" or "Junior")	Grouping members for scheduling, session organization, and attendance generation	Staff with roster access
Emergency contact details	Contacting a responsible adult in the event of an incident during a session	Staff with roster access
Attendance records	Recording session participation and, where applicable, usage-based billing	Staff with roster access; billing-related records may also be accessible to authorized Accountant users
Billing account name and postal address	Invoicing and account administration	Owners, Administrators, and authorized Accountant users

We collect only information that we reasonably require for the purposes described in this notice.

2. We do not collect health, medical, or dietary information through South Dune

South Dune does not provide us with a dedicated field for health, medical, allergy, or dietary information. Our staff are instructed not to enter this type of information into free-text or other fields in the system.

We do not knowingly collect health information about a Member through South Dune.

If you become aware that health-related information about your child has been entered into the system — including in a name, note, or group-tag field — please contact us using the details below. We will assess the information and take appropriate steps to remove it where appropriate.

If your child has a medical condition, allergy, dietary requirement, or other health or safety need that our staff must know about, please communicate this to us directly and separately, for example in person, by telephone, or using a dedicated paper or secure form provided by us, rather than entering it into South Dune.

Nothing in this section prevents us from processing health or other special personal information where applicable law requires or permits us to do so and the appropriate safeguards and authorisations are in place.

3. Contact details we do — and do not — collect about your child

We collect an emergency contact for the purpose of reaching a responsible adult if an incident occurs during a session.

We do not use the child's own contact details for account communication, billing, marketing, or other communications through South Dune.

Where communication about the child's membership is required, it is directed to the appropriate adult account holder or responsible adult rather than to the child.

4. Billing address

Where an address is collected, it is the billing or postal address of the adult account holder responsible for payment.

It is used for invoicing and account administration. We do not require a residential or postal address for the Member solely because the Member participates in our activities.

5. Our legal basis for processing your child's information

Because this involves personal information about a child, we will process your child's information only where we have a lawful basis to do so under applicable law.

Where POPIA requires prior consent from a competent person for the processing concerned, we will obtain that consent from the child's parent or legal guardian before processing the information.

Our Parental/Guardian Consent Form records the consent we obtain where consent is required and explains the purposes for which the child's information will be used.

If we introduce a new purpose for processing your child's information that requires additional consent, we will seek that consent before proceeding where required by law.

Processing of the adult account holder's own information, including billing and payment information, may also be necessary to establish or perform our agreement with that adult.

6. How long we keep this information

We retain your child's personal information while your child is an active Member and for up to 24 months after their last recorded activity, such as attendance, billing, or package assignment, unless a longer or shorter period is required or permitted by applicable law.

After the applicable retention period:

• If your child has billing or financial history, we will remove or anonymize personal profile information that is no longer required, such as the child's name, date of birth, emergency contact information, and group tags. Financial and transaction records may be retained where required or reasonably necessary for accounting, tax, audit, dispute resolution, fraud prevention, legal, or regulatory purposes.
• If your child has no billing or financial history, their member record may be deleted when it is no longer required for a lawful purpose.
• Where financial records must be retained, we will seek to retain them in a form that does not unnecessarily identify the child once the child's identifiable profile information is no longer required.

Retention periods may therefore differ between a Member's personal profile and financial records.

7. Your rights as parent or guardian

Subject to applicable law, you may ask us to:

• provide access to the personal information we hold about your child;
• correct inaccurate or incomplete information;
• request deletion or removal of your child's information where we are legally permitted to do so;
• withdraw consent for future processing where processing is based on your consent; and
• ask us to explain how your child's information is being processed.

Some requests may be subject to legal, financial, security, regulatory, or other lawful limitations. For example, we may need to retain certain financial or transaction records where required by law or reasonably necessary for legitimate legal or accounting purposes.

To exercise your rights or make a privacy-related request, contact:

[Organization Name] [Organization contact email] [Organization contact phone]

We may need to verify your identity and your authority to act on behalf of the child before fulfilling a request.

We will respond within the period required by applicable law and will explain where we are unable to fulfil a request, in whole or in part.

8. Who we share this information with

We may share or provide access to your child's personal information with:

• South Dune, operated by Pitonix Digital Pty Ltd, our software provider and Operator, which stores and processes the information on our instructions and on our behalf;
• our payment processor, where applicable, for billing and payment processing;
• authorized staff and service providers where access is reasonably necessary to provide our services or perform the purposes described in this notice; and
• law enforcement, regulators, or other authorities where disclosure is required or permitted by law.

We do not sell your child's personal information or share it for third-party advertising.

Some service providers used by us or by South Dune may process personal information outside South Africa. Where this occurs, the relevant transfer will be handled in accordance with applicable data protection laws, including POPIA.

9. Security

We use reasonable technical and organizational measures designed to protect your child's personal information against unauthorized access, loss, misuse, alteration, or disclosure.

South Dune uses role-based access controls and organization-level data isolation to restrict access to member information. Access to particular information depends on the user's role and permissions. For example, the child's date of birth is restricted to Owners and Administrators within the Platform.

We cannot guarantee that any information system is completely secure. If we become aware of a security compromise involving your child's personal information, we will take appropriate steps to contain and investigate the incident and provide notifications where required by applicable law.

10. Questions or concerns

[Organization Name] [Contact email] · [Contact phone] [Postal or physical address, if required]

If you have questions or concerns about how we process your child's personal information, please contact us first using the details above.

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa or, where applicable, another relevant supervisory or regulatory authority.