1. Introduction
EDUPLATFORM SOFTWARE SERVICES ("we," "our," or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our school management platform.
2. Data We Collect
We collect the following categories of personal data:
- Account Information: name, email address, phone number, password (hashed)
- Student Data: name, date of birth, class, parent contact details, attendance records, grades, wallet transactions
- Staff Data: name, email, phone, role, department, employment history
- Usage Data: login timestamps, IP addresses, browser user agent, audit logs of actions performed
- Payment Data: subscription plan details, transaction references (we do not store card numbers)
3. Legal Basis for Processing (GDPR & Data Protection Act 2012 (Act 843))
We process your personal data based on the following legal grounds:
- Consent: You have explicitly consented by accepting this Privacy Policy during registration
- Contractual Necessity: Processing is necessary to provide our school management services
- Legal Obligation: We may process data to comply with applicable laws and regulations
- Legitimate Interests: For security, fraud prevention, and improving our services
4. How We Use Your Data
- To provide and maintain the school management platform
- To process attendance, grading, fee management, and wallet transactions
- To send SMS notifications for attendance, payments, and important alerts
- To generate reports and analytics for school administration
- To communicate with you about your account, billing, and support requests
- To comply with legal obligations and regulatory requirements
5. Data Sharing and Disclosure
We do not sell your personal data. We may share data only:
- With Hubtel (our payment processor) for subscription billing — limited to transaction amounts and references
- With Hubtel SMS for sending notification messages to provided phone numbers
- With our hosting providers (Render, Vercel) who process data on our behalf under strict data processing agreements
- When required by law or to protect our legal rights
All third-party processors are contractually bound to protect your data and process it only in accordance with our instructions.
6. Data Security
We implement appropriate technical and organizational measures including:
- Encryption of data in transit via HTTPS/TLS
- Password hashing using bcrypt
- JWT-based authentication with httpOnly cookies
- Role-based access control (teaching, non-teaching, headteacher, admin, accountant)
- Rate limiting to prevent abuse
- Audit logging of all create, update, and delete actions
- Two-factor authentication option for enhanced account security
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. Upon account deletion or anonymization, we remove or anonymize personal data within 30 days, except where retention is required by law (e.g., financial transaction records must be kept for 6 years under Ghanaian law).
8. Your Rights
Under the Data Protection Act 2012 (Act 843) and applicable privacy laws, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Rectification: Request correction of inaccurate or incomplete data
- Erasure: Request deletion or anonymization of your personal data ("right to be forgotten")
- Restriction: Request restriction of processing of your personal data
- Objection: Object to processing of your personal data for certain purposes
- Portability: Request transfer of your data to another service provider
- Withdraw Consent: Withdraw your consent at any time (without affecting the lawfulness of prior processing)
To exercise these rights, visit your Settings page — Data & Privacy tab, or contact us at [email protected].
9. Children's Data
We collect data about children (students) only as part of our school management service, with consent from the school acting as the data controller. Parents or legal guardians may request access to their child's data or deletion through the school administration.
10. International Data Transfers
Your data is hosted on servers in the United States (Render, Vercel) and may be processed in other jurisdictions where our service providers operate. We ensure appropriate safeguards are in place through data processing agreements and standard contractual clauses.
11. Data Protection Officer & Contact
If you have questions, concerns, or complaints about our data practices or wish to exercise your rights, please contact our Data Protection Officer:
You also have the right to lodge a complaint with the Data Protection Commission (DPC) of Ghana at www.dpc.gov.gh.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be notified via email or through the platform. Continued use of the service after changes constitutes acceptance of the updated policy.