Privacy Policy
Last Updated: March 31, 2026
SwimOS is committed to protecting your personal information in accordance with the Protection of Personal Information Act (POPIA) of South Africa and the principles of the General Data Protection Regulation (GDPR). This Privacy Policy explains how we collect, use, store, and protect your data.
1. Introduction
SwimOS ("we," "us," "our") is a Software-as-a-Service (SaaS) platform built exclusively for swim schools. We provide tools for lead management, trial bookings, student enrolment, team scheduling, and business analytics.
We are committed to safeguarding the personal information of all users, leads, and data subjects who interact with our platform. This Privacy Policy governs our data practices and is designed to be compliant with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa and aligned with the principles of the General Data Protection Regulation (GDPR).
By using SwimOS, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.
2. Information We Collect
Personal Data
- Full name and email address
- Phone number
- Physical or business address
- Child's name, age, and swimming skill level (for bookings)
- Payment information (processed securely via Stripe)
Business Data
- Swim school name and contact details
- Subscription plan and billing history
- Staff and instructor profiles
Lead Data
- Prospective student contact information
- Lead source (Facebook Ads, Google, referral, etc.)
- Enquiry notes, preferred days and times
- Lead pipeline status and activity history
Usage Data
- IP address and browser/device type
- Pages visited and time spent on platform
- Feature usage analytics
- Error logs and performance data
3. How We Collect Data
- Direct Input:Information you provide when registering, completing onboarding, adding leads, or filling out any form within the platform.
- Automated Tracking:Cookies and analytics tools collect usage data automatically as you navigate the platform.
- Third-Party Integrations:When you connect services such as Facebook Ads or Google Calendar, we receive data from those platforms in accordance with their own privacy terms.
4. Purpose of Processing
We process personal information only for the following specified purposes:
- Managing leads and student enquiries (CRM functionality)
- Scheduling trial lessons and class bookings
- Sending automated reminders and follow-up communications
- Enabling Google Calendar and WhatsApp integrations
- Processing subscription payments via Stripe
- Providing customer support and platform maintenance
- Improving platform features based on usage analytics
- Complying with legal and regulatory obligations
5. Legal Basis for Processing (GDPR Alignment)
Consent
Where you have provided explicit consent for us to process your data, such as subscribing to communications or connecting third-party integrations.
Contractual Necessity
Processing required to deliver the SwimOS platform services you have subscribed to, including account management and billing.
Legitimate Interest
Processing that is in our legitimate business interest, such as platform analytics and service improvement, provided it does not override your fundamental rights.
Legal Obligation
Processing necessary to comply with applicable South African law or any legal requirement.
6. POPIA Compliance Principles
SwimOS processes personal information in accordance with all eight conditions for lawful processing under POPIA:
7. Data Sharing
We do not sell, rent, or trade your personal information to any third party. We may share your data only in the following circumstances:
- Service Providers: Stripe (payments), Google (calendar sync), Twilio/Meta (messaging), Base44 (platform hosting and infrastructure)
- Within Your Organisation: Swim school owners and authorised staff can access data scoped to their own school only
- Legal Obligations: Where required by South African law, court order, or regulatory authority
All service providers are contractually required to process data only on our instructions and in accordance with applicable data protection laws.
8. International Data Transfers
As a cloud-based platform, your data may be processed and stored in countries outside South Africa, including the United States and European Union. Where personal information is transferred internationally, SwimOS ensures that appropriate safeguards are in place to protect your data, consistent with the requirements of POPIA Section 72 and GDPR Chapter V.
These safeguards may include contractual data processing agreements with our service providers and reliance on standard contractual clauses where applicable.
9. Data Retention
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:
- Active account data is retained for the duration of your subscription
- Data is deleted within 90 days of account termination upon request
- Billing records may be retained for up to 7 years to meet tax and accounting obligations
- Lead data is retained for the period it remains relevant to your swim school's operations
You may request deletion of your personal data at any time by contacting us at swimos@shinemarketingservices.com.
10. Your Rights (POPIA + GDPR)
You have the following rights with respect to your personal information:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data ("right to be forgotten").
Right to Object
Object to the processing of your data for specific purposes.
Right to Withdraw Consent
Withdraw consent at any time without affecting prior processing.
Right to Data Portability
Receive your personal data in a structured, machine-readable format.
To exercise any of these rights, contact us at swimos@shinemarketingservices.com or submit a request via the Data Requests page in the app.
12. Data Security
SwimOS implements industry-standard security measures to protect your personal information, including:
- Encryption of data in transit (HTTPS/TLS)
- Encryption of sensitive data at rest
- Role-based access controls limiting data visibility to authorised users only
- Secure authentication and session management
- Regular security assessments and updates
While we take every reasonable precaution, no method of transmission over the internet is completely secure. We encourage you to use strong passwords and to report any suspicious activity immediately.
13. Children's Privacy
The SwimOS platform is designed for use by swim school businesses and their adult staff — it is not intended for direct use by children. Any data relating to children (e.g. a child's name, age, or swimming level for a booking) is entered by their parent or legal guardian and is handled with the highest level of care.
We do not knowingly collect personal information directly from children under the age of 18. If you believe a child's data has been collected without appropriate parental consent, please contact us at swimos@shinemarketingservices.com and we will promptly review and address the matter.
14. Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, SwimOS will:
- Notify the Information Regulator (South Africa) within 72 hours of becoming aware of the breach
- Notify affected data subjects without undue delay where the breach poses a high risk
- Document all breaches, including those not subject to notification
This process is consistent with both POPIA Section 22 and GDPR Article 33/34 requirements.
15. Contact Information
For any privacy-related questions, data access requests, or concerns, please contact our Privacy team:
SwimOS Privacy Team
swimos@shinemarketingservices.comYou may also submit a formal data request via our Data Requests page.
