Privacy Policy

01

Overview

EduNuvia is a multi-tenant school management platform. It supports admissions, student and staff records, academics, attendance, assessments, fees, communications, digital learning, school operations, reporting and related services.

We aim to process personal information lawfully, fairly, transparently and only for defined school or platform purposes. This policy is designed around Ghana’s Data Protection Act, 2012 (Act 843) and other applicable obligations. Where another law or contractual requirement provides stronger protection, that requirement should also be followed.

By using the platform, you acknowledge this policy. Where consent is legally required, consent will be requested separately rather than assumed from general platform use.

02

Our privacy roles

The school

For most learner, guardian, staff, academic and operational records, the school decides why the information is needed, who may use it and how long it should be kept. The school will usually act as the data controller for those records.

The platform operator

MySamuel generally processes school records to provide the service on the school’s instructions. It may act as a controller for platform administration, subscriptions, security, service support, fraud prevention and its own legal obligations.

The exact role can depend on the activity and applicable law. Schools must ensure that they have appropriate authority, notices, consents and governance arrangements for the information they upload or collect.

03

Information we process

The information depends on the modules a school enables and the role of the person using the platform. It may include:

Identity and contact details

Names, photographs, date of birth, gender, phone, email, addresses, identifiers and account details.

Student and guardian records

Admissions information, family links, emergency contacts, class placement, transfers and supporting documents.

Academic and learning information

Attendance, assessments, grades, report cards, transcripts, assignments, course activity and teacher feedback.

Staff and HR records

Employment information, roles, qualifications, leave, appraisals, attendance and staff documentation.

Health and safeguarding information

Medical conditions, allergies, emergency notes, incidents, consent records and other sensitive information authorised by the school.

Financial information

Fees, invoices, payment references, receipts, balances, scholarships and transaction status. Full payment credentials are generally handled by the configured payment provider.

Communications

Messages, notices, support requests, campaign records, delivery status and communication preferences.

Technical and security data

IP address, device/browser information, login activity, audit trails, security events, error logs and integration activity.

Please do not upload information that is not required for a legitimate school or platform purpose. Schools should restrict collection of sensitive information to authorised and necessary use cases.

04

How information is used

✓ Create and secure user accounts, verify identity and manage role-based access.

✓ Operate school admissions, academics, attendance, assessments, HR, finance, communications, learning and reporting.

✓ Deliver SMS, email, in-app notifications, receipts, reminders and school notices.

✓ Process subscriptions and school-configured payments, reconcile transactions and prevent fraud.

✓ Provide technical support, investigate errors, maintain backups and protect service availability.

✓ Maintain audit trails, enforce platform rules and meet legal, regulatory, contractual and safeguarding duties.

✓ Improve usability, performance and reliability using aggregated or appropriately protected information.

We do not sell personal information or use school records for unrelated advertising profiles.

05

Children and school records

The platform is designed for schools and therefore processes information about children and young people. Such information must be handled with heightened care and only by authorised persons for legitimate education, welfare, safeguarding or administrative purposes.

Schools are responsible for providing appropriate notices to parents, guardians, learners and staff, and for obtaining consent or another lawful authority where required. Parent and student portal access is restricted to linked records and permissions configured by the school.

Users should never share passwords, verification codes or sensitive learner information through unauthorised channels. Suspected safeguarding or privacy issues should be reported promptly to the school.

06

Sharing and service providers

Information may be disclosed only as reasonably necessary to:

Authorised school users: leadership, teachers, finance, HR, administrators and other staff according to assigned permissions.
Learners and families: students, parents and guardians for records they are authorised to access.
Service providers: hosting, storage, email, SMS, payment, identity, support and integration providers that help operate the service.
Authorities and professional advisers: where required by law, court order, safeguarding duty, audit, dispute resolution or protection of rights and safety.
Business continuity events: a lawful restructuring or transfer, subject to appropriate confidentiality and privacy safeguards.

Providers should receive only the information needed for their function and must be bound by suitable security, confidentiality and data-processing obligations.

07

Cookies and browser storage

The website uses cookies or similar browser storage for the following categories:

Essential

Session security, authentication, CSRF protection, load balancing and core platform operation.

Always active

Preferences

Optional display and usability choices remembered in the browser.

Your choice

Analytics

Optional usage measurement, only when an analytics service is configured and consent has been provided.

Your choice

Your privacy selection is stored locally in the browser. You can change it by selecting . Blocking essential storage may prevent sign-in or other core functions from working.

08

Retention and deletion

School records are retained according to the school’s instructions, education-sector requirements, financial and audit obligations, safeguarding needs, dispute requirements and configured retention rules.

Platform account, billing, security and support records are kept only for as long as reasonably necessary for the stated purpose or a legal obligation. When information is no longer required, it should be securely deleted, anonymised or isolated from ordinary use.

Deleted information may remain temporarily in encrypted or access-restricted backups until the relevant backup cycle expires. Some records may need to be preserved where deletion is restricted by law, an investigation or a legitimate school duty.

09

Security

We use administrative, technical and organisational safeguards appropriate to the nature of school information. Measures may include:

✓Tenant isolation and school-scoped access controls

✓Role and permission checks

✓Secure password hashing and session controls

✓Audit logs and security-event monitoring

✓Encrypted transport and protected storage

✓Backups, recovery procedures and integrity checks

✓Restricted provider and administrator access

✓Incident response and vulnerability management

No system can guarantee absolute security. Users must protect credentials, sign out from shared devices and immediately report suspected unauthorised access, loss, disclosure or misuse.

10

Your rights

Subject to applicable law and appropriate identity verification, your rights may include:

Be informed

Understand what information is collected and why.

Access

Request confirmation and a copy of personal information held about you.

Correction

Ask for inaccurate, incomplete or outdated information to be corrected.

Object or restrict

Raise a lawful objection or request that certain processing stop or be limited.

Deletion

Request deletion where the information is no longer required and no lawful retention duty applies.

Complain

Raise a concern with the school, the platform operator or the Ghana Data Protection Commission.

For a school record, submit the request to the school that collected or controls the information. The platform operator will assist the school where required. Requests may be declined or limited where identity cannot be verified or where law requires continued retention.

11

International processing

Some hosting, messaging, payment, support or integration providers may process information outside Ghana. Where this occurs, the school and platform operator should use appropriate contractual, technical and organisational safeguards and comply with applicable restrictions on cross-border processing.

12

Changes to this policy

We may update this policy to reflect new platform features, providers, laws or security practices. The effective date at the top will be revised when material changes are published. Where appropriate, users or schools will receive an additional notice.

✦

Contact us

Contact the relevant school first for school-managed records. For platform privacy, security or account questions, use the details below.

Platform operator

MySamuel

Privacy contact

info@EduNuvia.online

Ghana Data Protection Commission

You may contact the Commission where you believe a data protection concern has not been resolved.

Visit the official DPC website