Last updated: 1 August 2026
Sparked School Ops (“Sparked Ops”) is a school management platform used by schools to manage pupil records, attendance, academic reporting, admissions, and school fees, and to send school notifications to parents and guardians.
Sparked Ops is operated by Melzara (Pty) Ltd (“we”, “us”, “our”), a company registered in South Africa.
Our contact details:
You can contact our Information Officer at any time about personal information held in Sparked Ops.
Sparked Ops is provided to schools. The information in the platform about pupils, parents and guardians is placed there by the school.
Under the Protection of Personal Information Act, 2013 (“POPIA”):
We are the responsible party only for the accounts of the school staff who log in to use the platform, and for our own business records.
If you are a parent, guardian or pupil and you want to see, correct or delete information held about you in Sparked Ops, please contact your school in the first instance. Your school can action most requests directly in the platform. We will assist any school that asks us to.
From school staff who use the platform: name, email address, role at the school, login credentials, and a record of significant actions taken in the system.
From schools, about pupils: name, date of birth, class or grade, subjects taken, academic results and report cards, attendance and absence records, admissions application details, and the fees, invoices, statements and payments associated with that pupil.
From schools, about parents and guardians: name, relationship to the pupil, phone number (including WhatsApp number), and email address where provided.
We do not use tracking cookies, third-party analytics, advertising pixels, or any other behavioural tracking on the Sparked Ops platform.
We process this information for one purpose: to provide the Sparked Ops service to the school that placed it there. In practice that means:
We will not use personal information held on behalf of a school for any other purpose without that school's instruction.
Sparked Ops can send messages to parents and guardians over WhatsApp on a school's behalf. This section explains how that works.
Each school connects its own WhatsApp Business Account.Messages are sent from the school's own WhatsApp business number, not from ours. The school authorises this connection.
We only send transactional school notifications. Every message corresponds to something that happened at the school, and uses a pre-approved message template. The message types are:
We do not send marketing or promotional messages,and we do not message anyone outside a school's own parent and guardian body.
Who receives messages.Only the phone numbers a school holds on record for a pupil's parent or guardian. We do not obtain numbers from any other source and we do not share them with other schools.
Meta processes these messages.Messages are delivered through the WhatsApp Business Platform, operated by Meta Platforms, Inc. Meta processes the message content and the recipient's phone number in order to deliver the message. Meta's handling of that information is governed by its own terms and privacy policy.
Message records. We keep a log of messages sent, including the recipient number, the template used, the time, and whether delivery succeeded or failed. This is needed so the school can confirm a notification was actually delivered.
To stop receiving messages, contact your school and ask to be removed or to have your contact number updated. The school controls which numbers are on record.
Sparked Ops holds information about pupils, most of whom are under 18.
Pupils do not create their own accounts and we do not collect information directly from them. All pupil information is entered by the school, which holds it as part of its ordinary educational and administrative record-keeping, and which is responsible under POPIA for the lawful basis on which it does so.
Notifications about a pupil are sent to that pupil's parent or guardian, not to the pupil.
Information is stored on Supabase, which uses encryption in transit (TLS) and at rest (AES-256). Passwords are hashed by Supabase using bcrypt and are never stored in readable form.
Access is restricted by row-level security policies enforced at the database level, so that a user at one school cannot access another school's records, and so that different staff roles see only what their role permits.
Credentials that authorise us to send messages on a school's behalf are stored with additional column-level restrictions that prevent them from being read by ordinary application users.
While we take reasonable steps to protect information, no online service can guarantee absolute security. If a security incident affects personal information, we will notify the affected school, the affected individuals, and the Information Regulator as required by POPIA.
We use the following third-party operators to deliver the service. Each is required to keep information confidential and to use it only for the purposes we specify.
Some of these operators are located outside South Africa and Zimbabwe. We have satisfied ourselves that each provides an adequate level of protection for personal information.
We do not sell, rent, or trade personal information to anyone for any purpose.
We may disclose personal information if legally required to do so — for example, in response to a court order or a lawful request from a regulator.
Individuals have the following rights in relation to their personal information:
Because your school is the responsible party for pupil, parent and guardian information, requests about that information should go to your school first. Contact our Information Officer if your school is unable to assist, or if your request concerns information we hold as responsible party.
Schools and families in Zimbabwe have equivalent rights under the Data Protection Act, 2021, and may complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe as the Data Protection Authority.
If you believe personal information has not been handled in line with POPIA, you can lodge a complaint with the Information Regulator of South Africa:
We would prefer the chance to address your concern first, so please consider contacting our Information Officer before approaching the Regulator. You are free to go directly to the Regulator at any time.
We may update this policy as the Sparked Ops service evolves. The “Last updated” date at the top shows when it was last changed. We will notify schools of significant changes.