| Abbreviation | Meaning |
|---|---|
| CAPS | Curriculum and Assessment Policy Statement |
| PAIA | Promotion of Access to Information Act 2 of 2000 |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| The Regulator | The Information Regulator (South Africa) |
| The Service | Mark Maker, accessible at markmaker.co.za |
PAIA gives effect to the constitutional right of access to information. This manual explains what records Mark Maker holds, how a person may request access to them, and what to expect from that process.
Mark Maker is an online service that generates CAPS and IEB-aligned test papers, memoranda and practice material for South African schools. It is operated by Gabriel Katz as a sole proprietor. Because a natural person who carries on a business is a private body under PAIA, this manual is published in terms of section 51 of the Act.
This manual also records the information required by section 51(1)(c) read with section 17 of POPIA regarding the processing of personal information.
| Name | Gabriel Katz |
|---|---|
| Capacity | Owner and Information Officer |
| Postal and street address | 155 North Road, Sandown, Sandton, 2196, Johannesburg, South Africa |
| support@markmaker.co.za |
Mark Maker is operated by a single person and has no employees. No Deputy Information Officer has been designated. Requests should be directed to the Information Officer above.
| support@markmaker.co.za |
| Physical address | 155 North Road, Sandown, Sandton, 2196, Johannesburg, South Africa |
|---|---|
| Postal address | 155 North Road, Sandown, Sandton, 2196, Johannesburg, South Africa |
| support@markmaker.co.za | |
| Website | https://markmaker.co.za |
The Information Regulator has compiled a guide, in terms of section 10 of PAIA, to assist any person who wishes to exercise a right under PAIA or POPIA. The guide is available in all official languages.
| The Information Regulator (South Africa) |
|---|
|
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 P.O. Box 31533, Braamfontein, Johannesburg, 2017 Website: https://inforegulator.org.za General enquiries: enquiries@inforegulator.org.za PAIA complaints: PAIAComplaints@inforegulator.org.za POPIA complaints: POPIAComplaints@inforegulator.org.za |
A copy of the Guide is kept at our address at 155 North Road, Sandown, Sandton, in English and in Afrikaans, and is available there for public inspection during normal office hours. It may also be requested from the Information Officer by email.
A request for access to a record, other than a record containing your own personal information, may attract a request fee and an access fee as prescribed by the PAIA Regulations. Where a fee is payable you will be notified of the amount before the request is processed. No fee is charged for a request by a data subject for a record of their own personal information.
The Information Officer will decide on the request and notify you of the decision within 30 days of receiving it. Where the request is refused, the notice will state the reasons for refusal and your right to lodge a complaint with the Information Regulator or to apply to a court.
Access to a record may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA. These include, among others, the mandatory protection of the privacy of a third party who is a natural person, the commercial information of a third party, and information that is legally privileged.
| Category of record | Type of record | Available on website | Available on request |
|---|---|---|---|
| Privacy compliance | Privacy Policy | Yes | Yes |
| Service terms | Terms of Service | Yes | Yes |
| Access to information | This PAIA Manual | Yes | Yes |
| Product information | Public website content describing the service, features and pricing | Yes | Yes |
| User's own data | A user's own account information and generated papers, which they may export from within the application at any time | Within the user's account | Yes |
| Category of record | Applicable legislation |
|---|---|
| PAIA Manual | Promotion of Access to Information Act 2 of 2000 |
| Privacy Policy and records of processing | Protection of Personal Information Act 4 of 2013 |
| Accounting records, tax returns and invoices | Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991; Tax Administration Act 28 of 2011 |
| Consumer transaction records and terms | Consumer Protection Act 68 of 2008 |
| Electronic transaction and communication records | Electronic Communications and Transactions Act 25 of 2002 |
| Subject | Categories of records |
|---|---|
| User accounts | Email addresses, hashed passwords, account role (teacher or student), school membership and role where applicable, account status |
| Generated content | Test papers, memoranda and practice material generated by users, together with the subject, grade, topic and date of each |
| Usage and billing | Plan or tier, credit and generation counts, subscription status, transaction records |
| School accounts | School name, seat allocation, membership lists, department assignments and role designations |
| Account security | Records of devices used to sign in, stored as a one-way hash together with a short description and date |
| Correspondence | Support enquiries and related correspondence with users |
| Business and financial | Accounting records, invoices, supplier and service-provider agreements, tax records |
| Compliance | This manual, the Privacy Policy, the Terms of Service and related compliance records |
Mark Maker processes personal information in order to:
| Category of data subject | Personal information that may be processed |
|---|---|
| Teachers | Email address, hashed password, role, school and department membership where applicable, material generated and its subject, grade and topic, usage and billing records, device sign-in records, support correspondence |
| Students, including learners under 18 | Email address, hashed password, role, practice material generated and its subject, grade and topic, usage records, device sign-in records. Where a data subject is a child, processing is undertaken on the basis of the consent of a competent person as required by section 35 of POPIA |
| School administrators and heads of department | Email address, role in the school, departments headed, and the information above in their capacity as users |
| Service providers and suppliers | Contact details and account details necessary to receive the service |
Mark Maker does not knowingly process special personal information as contemplated in sections 26 to 33 of POPIA.
| Category of personal information | Recipients or categories of recipients |
|---|---|
| Account, generated content and usage records, for hosting and database services | Supabase (database and authentication), Vercel (application hosting) |
| The content of a request submitted for generation | Anthropic (AI generation of papers and memoranda) |
| Email address and message content, for transactional email | Resend (email delivery) |
| Transaction and subscription information | Paystack (payment processing) |
| Technical signals from the browser, for bot protection at sign-up and sign-in | Cloudflare (Turnstile bot protection) |
| Diagnostic information relating to a fault | Sentry (error monitoring) |
| Subject, grade, topic, type, mark total and date of material generated by a member of a school | That school's administrator and the head of department of a department to which the member belongs. The content of the material is not disclosed |
| Any personal information | A court, regulator or other authority where disclosure is required by law |
Personal information is stored and processed outside the Republic by the service providers listed above:
| Recipient | Location | Categories of personal information |
|---|---|---|
| Supabase | Data hosted in the European Union (eu-west-1). The contracting entity is Supabase Pte. Ltd, registered in Singapore | Account information, generated content, usage and billing records, school records, device records |
| Vercel | International, including the United States | Technical and log data arising from use of the application |
| Anthropic | United States | The content of a generation request, which may include text a user has supplied |
| Resend | International | Email addresses and the content of transactional emails |
| Cloudflare | International | Technical signals from the browser at sign-up, sign-in and password reset |
| Sentry | Currently hosted in Sentry's European Union region. Sentry's terms permit processing in the United States and in any country where Sentry or its sub-processors operate, so this describes our present configuration rather than a contractual restriction. | Diagnostic information relating to a fault, from which personal information is removed before transmission |
| Paystack | Africa and international | Transaction and subscription information |
These transfers are made in accordance with section 72 of POPIA, on the basis that the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection, and that the transfer is necessary for the performance of the contract with the data subject.
The following safeguards are implemented to protect the confidentiality, integrity and availability of personal information:
Written agreements are in place with every operator that processes personal information on our behalf, as required by section 21 of POPIA. With Supabase, Anthropic, Resend, Cloudflare and Paystack the data processing addendum forms part of the terms accepted when the service was taken up; with Sentry a separate addendum has been signed. Paystack's addendum is written to POPIA directly and records Paystack as the operator and Mark Maker as the responsible party. Each agreement obliges the operator to maintain appropriate security measures and to hold its own sub-processors to an equivalent standard.
One exception is recorded for completeness. Our hosting provider Vercel makes its data processing addendum available only to customers on its Enterprise and Pro plans, and Mark Maker is currently on a free plan. Vercel processes hosting and log data rather than stored personal information. The agreement will be concluded when the account is upgraded.
Where a security compromise occurs, affected data subjects and the Information Regulator will be notified as required by section 22 of POPIA.
This manual is available:
It is available in English. A copy in another official language may be requested and will be provided where reasonably practicable.
This manual will be reviewed and updated whenever the business, the records it holds or its processing of personal information changes materially, and in any event at least once a year. The date of the most recent update appears at the top of this manual.