Privacy Policy

Last updated: 24 October 2026

1. Who we are

MyQIA is the staff app of Qurtuba Islamic Academy ("QIA", "we"). QIA is the responsible party for the personal information processed through the app under the Protection of Personal Information Act, 2013 (POPIA).

Questions about this policy can be sent to our Information Officer at contact@teamqia.co.za or on 011 608 0527.

2. Who the app is for

MyQIA is only for QIA staff. Accounts are created by the school. The app is not directed at children and nobody can sign up through it.

3. Information we process

• Account and profile: name, username, email address, cellphone number, employee number, ID number, department, position and employment details. This is provided by QIA's HR team.
• Sign-in and security: password (stored only as a one-way hash), sign-in times, failed sign-in attempts, and the IP address and device type used for each session.
• Leave: leave applications, dates, balances and any medical certificate or supporting document you attach. A medical certificate may contain health information.
• Recognition and appraisals: contributions you submit, KPI self-assessments, reviewers' scores and comments, and the certificates issued to you.
• Purchase and payment requests: request details, amounts, supplier quotes, supplier banking confirmations, supporting documents and proof of payment.
• Travel reimbursement claims: trip dates, routes and distances, the amount claimed and the approvals given.
• Event plans: event plans and debriefs you write, reviewers' comments, the arrangements assigned to staff for each event, and attachments.
• Staff sign-in and sign-out: the time you sign in and out at school, taken from the school's server clock; which of the school's sign-in points you used; whether you arrived on time, in the grace period, late or seriously late and by how many minutes; any override or correction HR makes, with its reason; and an identifier for the phone registered for your sign-in, so that nobody can sign in for you on another phone.
• Photos and files: only those you choose to attach, from your camera, photo library or files.
• Notifications: a push notification token for your device so that we can tell you when something needs your attention.
• Activity records: who did what and when on each request, kept as an audit trail.

Location and Bluetooth. When you tap Sign in or Sign out, MyQIA uses your phone's location permission (and, on Android, its nearby-devices permission) for a few seconds to detect the school's sign-in beacon. It does not record your GPS position, does not track where you are, and never uses location in the background or at any other time. What is stored is only the sign-in point you used and the time.

Face ID and fingerprint. Your face or fingerprint confirms it is you when you sign in or out at school, and, if you turn it on, when you sign in to the app. The check happens entirely on your device: the app is only told whether it matched, and your biometric data never reaches us.

The app does not collect your contacts, microphone audio or browsing history. It shows no advertising, uses no advertising identifier and does not track you across other companies' apps or websites.

4. Why we use it

We use this information to run leave, recognition, appraisal, purchase, travel and event-planning processes; to record staff attendance and apply QIA's late-coming rules; to let approvers and Finance act on your requests; to send you notifications and emails about them; to keep your account secure; and to keep the records QIA needs as an employer. Processing is based on your employment relationship with QIA and on QIA's legal obligations and legitimate interests.

5. Who can see it

Your information is visible only to QIA staff whose role requires it, for example your approvers, HR, management and Finance. Your sign-in and sign-out records are seen by you, HR and the Super Admin. On final approval, the details of a purchase request or travel claim are emailed to QIA's accounts department, and event plans are emailed to the event's reviewers. We do not sell your information or share it with anyone for marketing.

We use these service providers to run the app, and they process data only on our instructions:

• Vercel hosts the app's server.
• Neon hosts the database where records and attached files are stored.
• Google Firebase Cloud Messaging and Apple Push Notification service deliver push notifications.
• Google (Gmail) sends system emails such as password resets and notifications.

Some of these providers store data outside South Africa. Where they do, we rely on their contractual and security commitments to protect it as POPIA requires.

6. Security

All traffic between the app and our server is encrypted (HTTPS). Passwords are hashed, and sign-in tokens are kept in your device's secure storage. Access to records is limited by role, and every change to a request is logged.

7. How long we keep it

We keep your information, including your sign-in and sign-out records, for as long as you are employed by QIA, and afterwards for as long as South African employment, tax and financial record-keeping laws require. After that we delete or anonymise it.

8. Your rights and account deletion

Under POPIA you may ask to see the personal information we hold about you, ask us to correct or delete it, or object to how we process it. To do so, email contact@teamqia.co.za.

Your account is closed when you leave QIA. You can also ask us to delete your account and its data at any time. See Delete your MyQIA account. We keep only the records the law requires us to keep.

You may also complain to the Information Regulator (South Africa) at inforeg.org.za.

9. Changes

If we change this policy, we will update the date above and, for significant changes, let staff know in the app.

10. Contact