Draft — review with your legal adviser before publishing
POPIA / Data Privacy
Last updated: 7 October 2026
Cooco is designed with South Africa's Protection of Personal Information Act (POPIA) in mind. This page summarises our approach. It is informational and should be reviewed by a qualified adviser before being relied upon.
Responsible party vs operator
A centre using Cooco is the responsible party for the personal information of its children, parents and staff. Cooco acts as an operator, processing that information on the centre's instructions.
Purpose limitation
Personal information in Cooco is used to run the centre's operations — enrolment, attendance, finance, learning and communication — and not for unrelated purposes.
Access control
Access is controlled by role. Parents see only their own children. Staff see only what their role allows. Sensitive actions are recorded to an audit trail.
Security safeguards
Cooco uses tenant isolation, secure authentication and backups to protect personal information. We keep these statements factual and claim no certifications we do not hold.
Data subject requests
Requests to access, correct or delete personal information held in a centre's Cooco workspace should be directed to that centre as the responsible party.
Questions about this page? Email hello@coco.co.za.