How Pennant handles personal information, and what you can ask for.
Effective 3 September 2026 · Version 1.0 · Governed by the Protection of Personal Information Act 4 of 2013 (POPIA)
Pennant is school management software used by South African schools to keep notices, homework, attendance, marks, behaviour, reports and fee accounts in one place, and to carry messages between a school and the families it serves.
Pennant is operated by Craig Erasmus, trading as MoJuKo, of Cape Town, South Africa.
Our Information Officer is Craig Erasmus and can be reached at info@mojuko.com.
POPIA separates a responsible party — who decides why and how personal information is processed — from an operator, who processes it for the responsible party, on its instructions, under a contract. Pennant is both, depending on whose information it is.
Everything about a learner — name, date of birth, class, attendance, marks, behaviour, reports, fee account, and messages with staff — belongs to the school. The school decided to collect it, the school decides who on its staff may see it, and the school decides when it is deleted. For all of it, we are the operator: we process it under our agreement with the school and for no purpose of our own.
The practical consequence is worth stating plainly: if your question is about a learner's record, ask the school first. They can answer and act immediately. We cannot change a school's records because a parent asked us to — POPIA does not permit an operator to go around the responsible party, and a system that let us do so would be a worse system.
For a narrower set of information we answer directly: your Pennant account (name, honorific and position, email address, role), the device token that lets us deliver a notification to your phone, anything you send our support address, and the technical records we keep to run the service and investigate problems.
| Information | Examples | Who puts it there | Why it is there |
|---|---|---|---|
| Learner record | Name, date of birth, grade and class, the guardians linked to the learner | The school | To identify the right child and show each guardian only their own children |
| Attendance | Present, absent, late or excused, per day, with a note | School staff | Schools are required to keep a register; parents are told the same day |
| Academic | Marks, assessments, homework, term reports and teacher comments | School staff | To record progress and produce reports |
| Behaviour | Merits and demerits logged against the school's own code, with points and a category | School staff | To run the school's conduct system and keep parents informed |
| Fees | Fee accounts, invoices and payments as recorded by the school | The school | To show a parent what is owed and what has been paid |
| Messages | Messages between a parent and a member of staff; class posts and the private replies to them | You and school staff | To carry the conversation the app exists to carry |
| Your account | Name, email address, role and position, signature line | You, or the school when it invites you | To sign you in and decide what you may see |
| Notifications | A device token per installation, and a record of what was sent | Created automatically | To deliver a notification and to diagnose one that did not arrive |
| Technical | Sign-in times, the IP address you signed in from, error diagnostics | Created automatically | Security, fraud prevention, and fixing faults |
On fees. Pennant does not take payments. It records what the school tells it about a fee account. If a school later connects a payment gateway, the gateway handles the card or bank details and Pennant never receives them.
POPIA treats a child's personal information as a special case. Section 34 prohibits processing it at all unless one of the grounds in section 35 applies. A school relies on two of them: the prior consent of a competent person — a parent or guardian — and the fact that processing is necessary for the establishment, exercise or defence of a right or obligation in law, because a school is required to keep an attendance register and academic records.
Beyond what the law requires of the school, the product is built to keep a child's record narrow:
Pennant runs on Google Firebase — Firestore, Firebase Authentication, Cloud Functions and Firebase Cloud Messaging — which is part of Google Cloud. Google stores and transmits the information on our behalf under Google's data processing terms, and processes it only on our instructions. Google is currently our only sub-processor.
Your school's information is held in the United States, not in
South Africa. Our database runs in Google's nam5
multi-region — data centres in Iowa and Oklahoma, with a third in South
Carolina — and the functions that send notifications run in
us-central1.
Section 72 of POPIA permits personal information to leave South Africa where the recipient is bound by an agreement upholding principles for lawful processing substantially similar to those POPIA requires. Google Cloud's data processing terms are the agreement we rely on. We state the location plainly here because a school's governing body should not have to find it in a schedule.
We do not sell personal information, we do not share it with advertisers, and we do not use school data to train machine-learning models. We share it outside Google only where the law compels us to, and we will tell the affected school unless we are legally barred from doing so.
Our staff need to be able to run the service, so they can see the list of schools, a school's contact details, and counts of how many learners, staff and parents an account has. They cannot read learner records — not attendance, not marks, not behaviour, not reports, not fee accounts, and not messages. That limit is enforced by the same server-side rules that enforce every other permission, not by a policy our staff are asked to remember.
If a school asks us for help with a specific record, we will ask the school to grant access, do the work, and tell the school when it is done.
The school decides how long its records live, because they are the school's records and schools have their own retention obligations. POPIA requires that personal information not be kept longer than is necessary for the purpose it was collected for.
When a school closes its Pennant account we delete or return its records within 30 days of the account closing. Copies in our backups roll off within a further 30 days. If you close your own Pennant account, we delete the account and its device tokens; records the school entered about a learner remain the school's and stay with the school.
No system is perfect. If we have reasonable grounds to believe personal information has been accessed by someone unauthorised, POPIA section 22 requires us to notify the Information Regulator and the affected people as soon as reasonably possible, and we will.
Under POPIA you may:
How to exercise them. For anything about a learner, write to the school — they are the responsible party and they can act immediately. For your own account and anything else we hold as responsible party, write to info@mojuko.com. We will respond within 30 days. We may need to confirm who you are first, which protects you more than it inconveniences you.
Please tell us first — info@mojuko.com — because most problems are quicker to fix than to adjudicate. You do not have to, though. You can complain directly to the Information Regulator at any time:
The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead,
Johannesburg, 2191
POPIA complaints:
POPIAComplaints@inforegulator.org.za
General enquiries:
enquiries@inforegulator.org.za
Telephone: 010 023 5200 · Toll free: 0800 017 160
inforegulator.org.za
This page sets no cookies, runs no analytics, and loads nothing from any other website. Nobody is counting your visit.
When this notice changes we update the version and the effective date at the top. If a change materially affects you, we will say so in the app rather than relying on you to re-read this page.