Privacy Policy

Who we are

Wesbury Schools Group (“we”, “us”) is an independent school group on the KwaZulu-Natal South Coast, South Africa. We operate this website (wesburyschools.com) and the official Wesbury Schools Group accounts on Facebook, Instagram, TikTok and X. Under the Protection of Personal Information Act 4 of 2013 (“POPIA”), Wesbury Schools Group is the responsible party for the personal information described in this policy. If you have any questions about this policy, please contact the school office via the contact details on our Contact page.

What information we collect

We collect personal information in the following ways:

• Admissions and enrolment. When you enquire, apply or enrol a learner, we collect the details needed to process the application and manage enrolment — for example, parent or guardian names and contact details, learner names and dates of birth, and the other information you provide on our application and enrolment forms.
• Website visitors. If you contact us through a form on this website, we collect the information you submit, such as your name, contact details and message. We also use cookies and similar technologies on this website; you can manage non-essential cookies through the cookie settings on our website (see Cookies and analytics below).
• Campaign reference details. When you follow a link we have published — for example in a social media post or an advertisement — the link may carry campaign tags (such as utm_source, utm_medium, utm_campaign and utm_content) or an advertising click identifier (such as Google’s gclid or Meta’s fbclid). We note those tags, the name of the website that referred you (for example “instagram.com” — not the full address), and the page you landed on, so that we can understand which of our campaigns lead to enquiries and applications. These reference details are kept in your own browser for up to 180 days. They reach us only when you submit an enquiry or application, in which case they are stored with that submission so that admissions can see which campaign it came from; they are not shared with the analytics services described below. This capture does not depend on your cookie choice — the analytics services described below do.
• Social media. When you interact with our official accounts on Facebook, Instagram, TikTok or X — for example by liking, commenting, sharing or sending a message — the platform shares basic interaction data with us, such as your public profile name and the content of your interaction. How those platforms process your information is governed by their own privacy policies.

We also operate an internal scheduling tool, “Wesbury Social – Postiz”, which publishes posts to the school’s own social media accounts. The tool stores only the school’s own platform access tokens and the content scheduled for publication. It does not collect, read or store any information from members of the public.

Cookies and analytics

On your first visit we show a cookie banner and nothing that measures how you use the website is loaded until you choose Accept. If you decline, no analytics cookies are set and no analytics service is used. Your choice is remembered in your own browser, in a local storage entry named wesbury-cookie-consent. You can change your choice at any time through the Cookie settings control at the bottom of this website — including switching from Accept to Decline, which stops all further analytics collection immediately. If you accept and later decline, any analytics cookies already set remain in your browser but are not used while your choice is Declined.

The cookies and similar technologies we use are:

• Google Analytics (Google) — loaded, and its cookies set, only after you accept. It helps us understand which pages are viewed and which forms are started, completed or fail. Its cookies, _ga and _ga_RM6PZ2SYDX, distinguish your browser from other visitors and last up to two years. See how Google uses this data.
• Microsoft Clarity (Microsoft) — loaded only after you accept. It records how visitors move through and interact with our pages — scrolls, mouse movements, clicks — and produces heatmaps so we can improve the website. Its cookies, _clck and _clsk, support that measurement; _clck lasts about a year and _clsk about a day. See Clarity’s privacy information.
• Cloudflare (website protection and performance) — our hosting network sets a short-lived _cf_bm cookie (about half an hour) to help protect the website against abusive automated traffic; it is always active because the website cannot operate securely without it. Cloudflare also measures aggregate page performance for us: this measurement is cookieless, does not identify you, and records only the page address, a random identifier created anew for each page load, how you arrived at the page, and performance timings.

Google and Microsoft process the analytics data described above on our instructions, as service providers. That data can include device, browser and usage information, the pages you view and the actions you take on them. These services are operated from outside South Africa — see Cross-border transfers below.

Why we use it, and on what basis

We process personal information only for proper, defined purposes, relying on the lawful grounds POPIA allows:

• to respond to enquiries and to process applications and enrolment — because it is necessary to take steps at your request, to perform the enrolment contract, and to comply with our legal obligations as a school;
• to communicate with parents and guardians about school life and important notices — because it is necessary for the enrolment contract and our legal obligations;
• to publish photographs and videos of school life — with the consent of a parent or guardian (see Children’s information below);
• to manage, moderate and secure our website and social media channels — because it is in our legitimate interests to do so; and
• to send you direct marketing about the school — only where you have opted in (see Direct marketing below).

Children’s information

Our learners are minors, and POPIA gives children’s personal information special protection. Photographs and videos of learners and school life are published on this website or on our social media accounts only where consent has been given in the enrolment contract, or where we have otherwise obtained written consent from a parent or guardian, as POPIA requires. A parent or guardian may withdraw this consent at any time by contacting the school office via the contact details on our Contact page, and we will stop using the learner’s image in future publications.

Who we share it with

We do not sell personal information, and we do not share it with anyone for their own marketing. We share it only with the service providers who help us operate: Meta Platforms (Facebook and Instagram), TikTok and X, when we publish to and interact on those platforms; Cloudflare, which hosts this website and stores application information for us; Amazon Web Services, which sends our application and admissions email; and Documenso, which provides the secure guardian e-signing service used to complete online applications. We may also disclose personal information where the law requires or allows it.

Cross-border transfers

Some of these providers operate outside South Africa, so personal information may be transferred to and stored in other countries. Where that happens, we transfer it only as POPIA section 72 allows — for example, where the recipient is bound by laws or binding agreements that protect the information in a way similar to POPIA, or where you have consented to the transfer.

Security and retention

We apply reasonable technical and organisational measures to protect personal information against loss, unauthorised access, disclosure or destruction. We keep personal information only as long as is necessary for the purposes set out in this policy, or for as long as the law requires us to retain school records. After that, it is deleted or de-identified.

Your rights

You have the right to:

• ask for access to the personal information we hold about you — and, if you are the parent or guardian of a learner, about your child;
• ask us to correct or delete personal information;
• object to the way we process personal information; and
• withdraw consent, where we rely on consent.

To exercise any of these rights, contact the school office via the contact details on our Contact page. If you believe we have not handled personal information properly, you may complain to the Information Regulator of South Africa — see inforegulator.org.za.

Direct marketing

We send direct marketing, such as newsletters or admissions updates, only to people who have opted in to receive it. You may opt out at any time, using the unsubscribe link in any message or by contacting the school office via the contact details on our Contact page.

Changes to this policy

We may update this policy from time to time. Any changes will be published on this page with a new “Last updated” date, so please check back occasionally.