Introduction

Important information and who we are

Welcome to School Of New Africa Ltd’s Privacy and Data Protection Policy (“Privacy Policy”).

At School Of New Africa Ltd (“SONA”, “we”, “us”, or “our”) we are committed to protecting and respecting your privacy and Personal Information in compliance with the United Kingdom General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 and all other mandatory laws and regulations of the United Kingdom.

This Privacy Policy explains how we collect, process and keep your data safe. The Privacy Policy applies to the Personal Information processed by or on behalf of SONA. This covers the SONA Card, SONA App, SONA Website and other SONA features.

Personal Information means information which on its own or in combination with other information can be used to identify you. We may change this privacy policy from time to time by updating this document. If we are making a major change, we will notify you by email or an in-app message.

If you have any questions regarding this privacy policy, you can contact us at support@schoolofnewafrica.com or write to our Data Protection Officer at School Of New Africa Ltd, 17a Electric Lane, Brixton, London, SW9 8LA, United Kingdom.

Who are we?

School Of New Africa Ltd is a company established in the UK with its registered office at 17a Electric Lane, Brixton, London, SW9 8LA, United Kingdom (Company No. 13787499). This Company is registered with the UK Information Commissioner’s Office under number ZB492852.

Your Data Controller

We act as a data controller which means we decide on the purpose for which your Personal Information is processed. However, each of our partners may be data controllers for the purposes of their own privacy policies. See http://www.ico.org.uk/ for more information on cookies and Personal Information.

IDT Financial Services Limited (“IDT”) is the issuer of the card associated with your SONA account. Accordingly, IDT is a joint controller of some of your Personal Information as it relates to, and is required for, the administration and operation of the card. A copy of IDT’s privacy policy may be found at http://www.idtfinance.com/privacypolicy.pdf.

Notice for Parents or Guardians

As a parent or guardian who has signed up a Young Person, under the age of 18, to use the SONA service, you are giving us permission to collect, use and share their data in the ways specified in this policy.

By providing a set of verified contact details for a Young Person, parents and guardians are explicitly giving their permission for their children to be contacted in the ways described below.

We encourage parents and guardians to explain to their children how their information will be used, as set out in this policy.

We are reliant on you providing accurate information in order to implement our Privacy Policy and cannot be held responsible if you circumvent age-restrictions by providing incorrect age information.

The Personal Information We Collect

We collect Personal Information from you when you sign up and use our services. When you log into the SONA app or use the SONA website. We also collect data when you contact SONA or when we need to contact you. This includes:

Information that you provide to SONA when you sign up or activate a card

• Account holder and cardholder Personal Information such as: Name, date of birth, gender, relationship to account holder or cardholder, email address, postal/billing address and mobile number
• Payment information such as: debit card number, expiry date, CVC, bank account number
• Personal documentation provided on request such as: Passport, Driving License, utility bill, bank statement

Information you provide in contact/correspondence with SONA

• Information you give to us in telephone calls, emails, instant messages, text messages or other means of communication
• Media (should you choose to enable these features once available)
• Profile photos
• Other photos, e.g., to tag transactions, capture receipts
• Contact information you provide if you refer friends or family to use SONA or gift to a SONA card. You confirm that you have the consent of anyone whose contact information you provide for this purpose

Technical information collected automatically when you use SONA

• Information collected when visiting SONA’s website such as:
  • IP address, browser type, operating system, browser language, time zone, service provider, system settings, system tokens/keys
  • Information about activities you undertake, such as the pages you visit, searches you make, marketing or links you click
  • Information collected when using the SONA app such as: mobile device, a unique device identifier, operating system version, mobile carrier

Usage data collected when you use SONA

• Information related to individual transactions, e.g.
• Loading information: time and date of load, load type, notes
  • Purchase information: retailers used, value of transactions, category of retailer, time of transaction
  • Withdrawals: cash machine used, how much has been withdrawn, time of withdrawal
  • Savings: amount saved, savings goal name, when saved, frequency of automatic saving
• SONA App usage information, e.g.
  • Pages visited; functions selected
  • Login attempts
• All communications between SONA and users or directly between users, including gifters
  • Communications via text message, in-app messages from SONA-to-SONA users, messages on transfers or loads
• If you enable features of SONA that are location-enabled, we may collect and process information about the location of your device, e.g.
  • Location of the mobile device, or other technologies such as nearby Wi-Fi access points, mobile transmitters and sensor data Note: You will only be able to use location-based services if you have opted-in to do so and you will be able to switch them off again at any time you wish
• We may also store and access information on your device, e.g.
  • Application data caches, browser web storage

Testing/pre-release research initiatives

• We may require additional information if you choose to take part in a pilot program, e.g.
  • Personal Information, device information and other types of data which will be specified as part of the pilot

How We Use Your Personal Information

We use your information to fulfil our contract with you, provide you with our services, meet our legal obligations, protect your vital interests and where necessary for the public interest. This includes:

• To create your SONA account and send you SONA cards that you have ordered
• To enable you to use the SONA card and app. This will let you load, spend and withdraw funds on the SONA card, manage savings, review transactions and make transfers
• To enable you to easily, safely and simply manage money as an extended family (for example, letting family members know about children’s upcoming birthdays to make birthday gifting easier)
• To enable you to access, manage, spend, save, send and withdraw your money through the prepaid debit card, app and all types of notifications
• To enable you to make choices about money, stay connected with each other, and help young people to grow up and feel empowered, for example, by sharing data insight, tips and advice
• To contact you regarding your account
• Provide you with essential services communications, e.g. suspicious activity on your account, billing, responding to enquiries, etc
• Send you usage alerts to notify you of relevant account activity, e.g. allowance switched on/off, attempted card use at non-permitted merchants
• To provide you with customer service when we notice a problem
• To verify your identity and to identify, prevent, detect or tackle financial crime, including fraud, money laundering and other unauthorised conduct. We may also access, use and store any identity verification or other check made, and do anything else required for these purposes
• To understand your use of the service so we can provide a safe, reliable and convenient SONA experience. We will also use your data to make sure content is presented on your device in the most effective manner
• We may access, read, preserve, and disclose information that we reasonably believe is necessary to comply with law or a court order; enforce or apply our conditions of use and other agreements; or protect the rights, property, or safety of SONA, our employees, our customers, or others
• We will use your data to carry out our obligations to you or any other users of the SONA service, perform any services you have requested and allow you to participate in interactive features of the service when you choose to do so. For example, if you contribute money to a Young Person’s account, we may communicate data about you and your gift to the relevant account-holder (parent / guardian of the Young Person)
• When you contact the SONA Support team for assistance via any means we may keep a record of your communications to respond to your query and to improve our service to you. Your call may be recorded for training or quality purposes.

We use your information for our legitimate interests where those interests are not outweighed by your interests or rights

• We may use your contact details to communicate to you SONA updates which let you know about changes to the SONA service
• We may also use anonymised data collected to improve our service, for example to carry out statistical analysis, including data analytics, developing and analysing data metrics and publishing the results in an aggregated form.
• To ensure a consistent SONA experience we will use information collected when you use SONA via our apps or website using such technologies as cookies and pixel tags. This information may be used to customise any messaging you are presented with. Please see the SONA Cookie Policy for further information.

We use your information, with your consent to:

• Contact you by email, SMS or in-app message to inform you of relevant offers and other marketing-related items from SONA
• Contact you by email, SMS or in-app message to inform you of relevant offers and other marketing-related items from carefully selected third-parties

You have the right to remove your consent for these purposes at any time by using the unsubscribe/ opt-out function displayed in our communications to you.

Cookies

Cookies are data files containing small amounts of information which are downloaded to the device you use when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. We use cookies in order to ensure our website and app function correctly and to improve our understanding of how you use our service in order to make improvements. You can find full details on the types of cookies we use at our SONA Cookie Policy.

How We Share Your Personal Information

We share your Personal Information with the joint data controller IDT Financial Services Limited who issue the SONA card.

We use third-party providers who process Personal Information on our behalf to help us provide the following services:

• Collecting debit card data for loading SONA Cards and loading chargebacks
• Processing SONA Card transactions and transaction chargebacks
• Identity verification and fraud monitoring
• SONA Card manufacturing
• Customer-service
• IT infrastructure, including cloud computing services
• Marketing to customers where we have consent
• Develop our service
• Back-up and store our data

We have agreements in place with all third-party providers to make sure your information is properly protected. Third-party providers will only process your data for the reasons we have agreed with them.

If we need to transfer your Personal Information to a country other than the UK, we will have appropriate safeguards in place.

We may add additional services from time to time, in which case we will update this Privacy Policy.

To comply with the law or in the public interest

Should we believe our service is being used illegally, we may provide evidence to the authorities to enable them to investigate suspected illegal activity. We will also disclose Personal Information (which may include purchase and location data) if we are required to do so by law. We may pass on data in an emergency where in good faith we believe that revealing Personal Information is needed to protect the safety of you or someone else.

Business Transfers

We may share customer information if we choose to buy or sell assets. Also, if we (or some of our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information would be one of the assets transferred to a third party in those circumstances. You will be notified via email and/or a prominent notice on our website of any change in ownership.

How We Store and Secure Your Personal Information

The Personal Information that we collect from you will be stored in the United Kingdom (“UK”) but will also be transferred to and processed in countries outside the UK. Your Personal Information is also processed by staff operating outside the UK who work for us or one of our third-party service providers or partners.

We will take appropriate technical and organisational measures to protect against unauthorised or unlawful processing, accidental loss or destruction of, or damage to Personal Information. We implement a variety of security measures to ensure the security of your Personal Information on our systems, including:

Using industry standard security technology and procedures to protect your information

• High-security password protection on internal SONA systems
• Encryption of our services using SSL (Secure Sockets Layer)
• Training of our employees on information security
• Continual review of our policies and procedures in response to advances in technology and security best practice

SONA App access password protection

• Built-in password protection on the SONA App for parents / guardians and Young People to gain access to their account

Limiting access to your data

• Measures to ensure access to SONA systems is limited to approved

SONA team members to undertake their job

• All employees undergo data protection training and sign confidentiality agreements

Unfortunately, no transmission of data over the internet is guaranteed to be completely secure. It may be possible for third parties not under the control of School Of New Africa Ltd to intercept or access transmissions or private communications unlawfully. While we strive to protect your Personal Information, we cannot ensure or warrant the security of any Personal Information you transmit to us. Any such transmission is done at your own risk. If you believe that your interaction with us is no longer secure, please contact us.

Keeping Your Information Up to Date

If you are a SONA Parent / Guardian or Young Person, most of your Personal Information can be accessed by logging into your account and some can be changed directly. However, for compliance reasons, certain types of information cannot be changed or deleted online. To request an amendment of this information you will need to contact us (see Contact us page) so we can verify your identity.

How Long We Retain Your Information

We will only retain your Personal Information for as long as reasonably necessary to fulfil the purposes we collected it for. We may retain your Personal Information for a longer period than usual in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

We retain your Personal Information after you have closed your account for the purposes for which it was originally collected, or for which it was further processed, but we will not retain any of your Personal Information for more than six years after the termination of our business relationship.

Your Rights and How You Are Protected by Us

Your legal rights

Under certain circumstances, you have the following rights under data protection laws in relation to your Personal Information:

• Right to be informed. You have a right to be informed about our purposes for processing your Personal Information, how long we store it for, and who it will be shared with. We have provided this information to you in this policy.
• Right of access. This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it (also known as a “data subject access request”). See below for more details on how you can make a data subject access request.
• Right to rectification. You have a right to request correction of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Right to erasure. You have the right to ask us to delete or remove Personal Information where there is no good reason for us continuing to process it, where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Right to object. You can object to the processing of Personal Information we hold about you. This effectively allows you to stop or prevent us from processing your Personal Information. Note that this is not an absolute right and it only applies in certain circumstances, for example:
• Where we are processing your Personal Information for direct marketing purposes.
• Where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.
• In some cases, we may continue processing your data if we can demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Right to restrict processing. You have the right to request the restriction or suppression of your Personal Information. Note that this is not an absolute right and it only applies in certain circumstances:

 (i) If you want us to establish the data’s accuracy.

 (ii) Where our use of the data is unlawful but you do not want us to erase it.

 (iii) Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.

 (iv) You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Right to data portability. You have the right to request the transfer of your Personal Information to you or to a third party. If you make such a request, we will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

If you wish to make a request under any of these rights, please contact us at support@schoolofnewafrica.com. No administration fee will be charged for considering and/or complying with such a request unless the request is deemed to be excessive in nature.

We will respond to requests to exercise these rights within one calendar month from receipt of your request.  If we need more information from you to be able to deal with your request (eg ID documents), the time limit will begin once we have received this. If your request is complex or you make more than one, the response time may be a maximum of three calendar months, starting from the day of receipt.

You can also contact us by writing to us via support@schoolofnewafrica.com if you would like to close your account.

Opting Out of Marketing Promotions

SONA may communicate with you about important activity which has taken place on your account, for example, to alert you about suspicious transactions or problems with your account and send you alerts regarding your SONA account usage, for example, when money is loaded or allowance is paid. These notifications are designed to keep you informed about important account activity and may alert you to suspicious activity. You cannot opt-out of these communications.

You can ask us to stop sending you marketing messages at any time by using the unsubscribe/ opt-out function displayed in our communications to you.

Where you opt out of receiving these marketing messages, we will continue to retain other Personal Information provided to us as a result of interactions with us not related to your marketing preferences.

Keeping Your Own Information Secure

We encourage parents / guardians to speak to their Children about PIN and password security to ensure ongoing safety while using SONA. Parents /guardians should ensure their Children understand that they should never share the PIN or password for their SONA App or SONA Card. We recommend they do not write down their PIN but if they need to, this must be kept securely and separately from their SONA Card and the device that they use to access the SONA App. Equally, parents and guardians must follow good password management practice themselves and not write down or share their SONA password. If we believe your SONA account passwords/PINs have not been kept secret, we may not be responsible for losses incurred on your account.  

Third Party Links

This Site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Site, we encourage you to read the privacy policy of every website you visit.

IDT Financial Services Limited (“IDT”) is the issuer of the card associated with your SONA account. Accordingly, IDT is a joint controller of some of your personal information as it relates to, and is required for, the administration ond operation of the card. A copy of IDT’s privacy policy may be found at http://www.idtfinance.com/privacypolicy.pdf.

Contact Us

We welcome your questions, comments, and concerns about this Privacy Notice or your Personal Information. Please send us any feedback to support@schoolofnewafrica.com.