Privacy policy

1. Who is responsible

A school that uses SkulTab decides what information it keeps about its learners, parents and staff. The school is the data controller for those records, and SkulTab handles them on the school's instructions, as its data processor.

For the details of the people who open and manage an account with us, and visitors to our website, SkulTab is the data controller.

2. What we handle

• Account details: the name, email address, phone number and role of each person who signs in, and a protected (hashed) form of their password.
• School records entered by the school: learners' names, admission numbers, classes, dates of birth, attendance, marks and report cards; parents' and guardians' names and contact details; fee bills, balances and payments.
• Payment details received from M-Pesa, banks and other providers so that a payment can be matched to a learner: amount, date, reference, and the payer's name and phone number where the provider sends them.
• Messages sent through the system, and their delivery status.
• Technical records: sign-in times, the device and internet address used, and a log of who changed what, kept for security and accountability.
• Support conversations, when someone writes to us in the chat.

3. Why we handle it

• To provide the service the school has signed up for.
• To keep accounts and school records secure, and to investigate misuse.
• To bill the school for its subscription.
• To answer questions and fix problems.
• To meet legal duties.

4. Children's information

Most learners are children. Their information is entered by the school, which is responsible for having a parent's or guardian's consent, or another lawful reason, for keeping it. We handle it only so the school can run, never for advertising or profiling.

5. Who we share it with

We do not sell personal information. We pass it on only where the service needs it:

• payment providers, such as Safaricom M-Pesa, banks and payment gateways, to receive and confirm payments;
• messaging providers, to deliver SMS, WhatsApp and email on the school's behalf;
• hosting and infrastructure providers that store and run the system;
• an AI provider that helps answer questions in the support chat. Only what is typed in the chat is sent, so please do not put learners' personal details in it;
• authorities, where the law requires it.

6. Where it is kept and how it is protected

Each school's records are kept separate from every other school's. Access needs a sign-in, permissions limit what each member of staff can see and do, passwords are stored hashed, connections are encrypted, and changes are logged.

Some of the providers we use may store or process data outside Kenya. Where that happens, we rely on the safeguards the law requires.

No system is perfectly secure. If a breach affects personal data, we will tell the school and the Data Protection Commissioner as the law requires.

7. How long we keep it

We keep a school's records for as long as its account is open. After an account is closed, records are removed or made anonymous within a reasonable time, unless the law requires us to keep them for longer, as it does for some financial records.

8. Your rights

Under the Data Protection Act you can ask to see the personal information held about you, have it corrected, object to how it is used, and ask for it to be deleted where there is no reason to keep it.

Parents, learners and staff should ask the school first, since the school controls its own records and has tools in the system to export, correct or anonymise them. Account holders can ask us directly.

You can also complain to the Office of the Data Protection Commissioner.

9. Cookies

We use a sign-in cookie to keep you signed in, and store a few preferences in your browser. We do not use advertising cookies.

10. Changes and contact

We may update this policy, and will tell school administrators about changes that matter.

Questions and requests about personal data can be sent through the support chat on our website or inside the system.