OTE Learn is a learning management system. We process personal information to provide learning content, assessments, marking, reports, notifications, calendar items, support, guardian access, institution setup, and system security.

• We do not sell learner, teacher, guardian, or institution information.
• We do not use learner information for behavioural advertising.
• We use role-based access so users should only see information needed for their role.
• Guardian access is view-only unless the institution grants limited support-ticket rights.
• Assessment security events may be recorded where enabled, but an event alone does not prove cheating.
• Reports and transcripts should be protected and shared only with authorised users.
• Public pages such as Home, Privacy, Terms, Feedback, and Report Verification may be accessible without login.

OTE Learn is designed with South African legal and governance requirements in mind, including:

If there is a conflict between this notice and applicable law, applicable law prevails.

The responsible party depends on the context. In many education deployments, the school, college, training provider, or institution determines why learner, teacher, guardian, assessment, and report information is processed. OTE Learn or Esormot Edge may process information as a platform provider, operator, or responsible party depending on the specific service, contract, and configuration.

• Institution-controlled information: learner placements, classes, subjects, assessments, marks, reports, guardians, and staff roles.
• Platform-controlled information: platform operation, testing feedback, diagnostics, account security, technical logs, and service improvement where controlled by OTE Learn.
• Third-party controlled services: Microsoft, Google, email providers, and cloud services may have their own privacy terms for their services.

Users should contact the institution first for learner records, marks, guardian links, placement, class allocation, or school-managed records.

4.1 Account and identity information

• name, surname, email address, user identifier, SSO provider identifier, account status, login provider, and session details;
• current institution, institution membership, enrolment status, role, access permissions, and directory selection;
• authentication cookies, anti-forgery tokens, account claims, and security-related identifiers.

4.2 Learner and academic records

• student profile, institution, class, grade/programme, subjects, class-subject placements, and academic year;
• content access, assessment allocations, attempts, answers, submissions, marks, percentages, late penalties, released results, and reports;
• final results, progression decisions, academic rollover, approvals, transcript lines, report batches, and verification codes.

4.3 Teacher, marker, and administrator information

• teacher assignments, class-subject responsibilities, marking permissions, assessment creation permissions, and report permissions;
• actions taken inside the system, such as creating content, marking submissions, releasing results, managing guardians, or approving records.

4.4 Guardian and parent information

• guardian name, email, relationship type, linked learner, invite token, invite status, accepted date, and linked user account;
• guardian access flags such as viewing marks, reports, calendar, notifications, tickets, and creating support tickets where allowed.

4.5 Assessment security information

• attempt start, save, resume, submit, and timing information;
• copy, paste, right-click, page blur, tab visibility, and other assessment security events where enabled;
• submission status, attempt number, auto-marked values, manual overrides, dismissal reasons, and marking state.

4.6 Files and content

• learning content, documents, images, assessment files, student submissions, support attachments, reports, transcripts, logos, stamps, and signatures;
• file metadata such as file name, content type, path, date uploaded, uploader, and download logs where enabled.

4.7 Support, feedback, and communication

• support tickets, messages, comments, feedback form responses, testing notes, screenshots, bug reports, and user suggestions;
• emails, notifications, calendar reminders, invite messages, and report availability notices.

4.8 Technical and diagnostic information

• IP address, browser, device, operating system, user agent, page URL, timestamps, error logs, performance logs, and security logs;
• Azure, database, storage, email, and authentication service logs where enabled.

OTE Learn may be used by schools and may therefore process children’s information and learner education records. This requires extra care. Users must not upload unnecessary sensitive information.

Special personal information or sensitive learner information should only be processed where:

• there is a lawful basis, required permission, school authority, guardian authority, or other legal justification;
• the information is necessary for education, accessibility, learner support, safety, legal compliance, or institutional administration;
• access is restricted to authorised staff;
• the information is not exposed to unrelated users or guardians;
• retention is controlled and deletion/restriction is applied when appropriate.

Schools and administrators must avoid uploading health information, identity documents, disciplinary records, or other sensitive documents unless necessary and properly authorised.

• to authenticate users and manage SSO access;
• to connect users to institutions, classes, subjects, and roles;
• to display learning content and manage teaching activities;
• to create, allocate, write, submit, mark, and release assessments;
• to calculate marks, contributions, late penalties, outcomes, and reports;
• to provide guardian access to approved learner information;
• to send notifications, invitations, support messages, and report notices;
• to provide support and investigate bugs or errors;
• to protect assessment integrity, report integrity, and account security;
• to comply with legal, audit, school, contractual, and regulatory obligations;
• to improve the LMS during testing, pilot, and production phases.

Depending on the context, information may be processed because:

• the user or guardian consented;
• processing is necessary to deliver education, training, support, or LMS services;
• processing is necessary for a contract or pre-contractual steps;
• processing is necessary for legitimate institutional, educational, security, or administrative interests;
• processing is required for compliance with law;
• processing protects the legitimate interests of the learner, institution, platform, or another person;
• processing is authorised by a school, guardian, competent person, or applicable education governance process.

Where consent is used, consent can be withdrawn. Withdrawal does not affect processing that already happened lawfully, and some records may still be retained where required for academic, legal, audit, security, or dispute reasons.

We may share information with:

• the institution using the LMS;
• authorised teachers, markers, administrators, and support staff;
• authorised guardians linked to a learner;
• cloud hosting, storage, database, email, authentication, and diagnostic providers;
• Microsoft Forms or similar testing tools where users voluntarily submit feedback;
• professional advisers, auditors, legal advisers, or compliance providers;
• regulators, law enforcement, courts, or authorities where required or permitted by law;
• a successor provider if the LMS is sold, transferred, restructured, or replaced, subject to safeguards.

We do not sell personal information and do not disclose learner records for advertising.

Cloud, email, authentication, support, and form services may process or support information outside South Africa. Cross-border processing may occur through global cloud infrastructure, backups, support teams, identity providers, and email routing.

Where cross-border processing applies, we aim to use appropriate safeguards such as contractual protections, access control, encryption in transit, role limitation, supplier commitments, and processing only for the stated purposes.

• HTTPS/TLS for web traffic;
• SSO through Microsoft or Google where configured;
• role-based access and institution-based separation;
• private storage for sensitive files and reports;
• secure download endpoints instead of direct public file links where appropriate;
• report verification codes, hashes, and download logs where enabled;
• anti-forgery protection on forms;
• least-privilege access and access reviews;
• database backups and hosting controls where configured;
• secret management using user secrets, app settings, or Key Vault;
• logging, diagnostics, and security event review;
• direct-link protection for admin and teacher pages.

No system is completely risk-free. Users must protect their accounts, use the correct email address, log out on shared devices, and report suspected unauthorised access immediately.

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the incident may be a security compromise under POPIA.

We or the responsible institution may:

• investigate, contain, and document the incident;
• identify affected systems, users, and information;
• reset passwords, revoke sessions, disable accounts, rotate keys, or restrict access;
• notify affected users and the Information Regulator where required;
• use the Information Regulator eServices portal where applicable;
• take steps to reduce harm and prevent recurrence.

Records are kept only as long as reasonably necessary for education, legal, security, audit, report, dispute, institutional, operational, or backup purposes.

• Account records may be kept while the user has platform access and for a reasonable period after removal.
• Academic records may be kept according to institution and education record requirements.
• Assessment attempts and marks may be retained for appeals, reports, academic history, and integrity checks.
• Reports and transcripts may be retained as official records where required by the institution.
• Support tickets may be retained for service history and issue resolution.
• Security logs may be retained for investigation and audit purposes.
• Testing data may be reset, anonymised, archived, or deleted during development.
• Backup copies may remain until overwritten through normal backup cycles.

Subject to applicable law, a person may request to:

• know whether personal information is held;
• access personal information;
• correct inaccurate, incomplete, outdated, excessive, or misleading information;
• delete or destroy information where legally appropriate;
• object to certain processing on reasonable grounds;
• withdraw consent where consent is the basis for processing;
• object to direct marketing;
• complain to the institution, platform provider, or Information Regulator;
• request records under PAIA where PAIA applies.

Some requests may be refused or limited if records must be retained for academic, legal, contractual, security, audit, dispute, regulatory, or institutional reasons.

If your request is about learner records, marks, reports, guardian links, placement, or institution-controlled data, contact the institution first.

You may also contact the Information Regulator South Africa through its official channels: Information Regulator eServices.