Data Processing

1. Roles and Responsibilities

• Data Controller: the school or institution that determines the purposes and means of processing student and staff data.
• Data Processor: Learn Tech, which processes personal data only on documented instructions from the data controller.

We do not make decisions about how student data is used beyond what is necessary to provide the platform functionality requested by the school.

2. Categories of Data Processed

• Student data: names, date of birth, attendance records, academic performance, and fee payment information.
• Staff data: names, email addresses, phone numbers, and role assignments for teachers, administrators, and bursars.
• Parent/guardian data: names, email addresses, and phone numbers used for communication about student progress.
• Operational data: school settings, class structures, fee schedules, and configuration data entered by administrators.

3. Purpose of Processing

We process personal data solely to provide the school management services requested by the data controller, including:

• Recording and reporting student attendance.
• Managing academic grades, reports, and transcripts.
• Tracking fee payments and generating receipts.
• Sending notifications to parents and staff about school matters.
• Generating administrative reports for school management.

4. Sub-Processors

We use third-party sub-processors to deliver our service, including cloud hosting providers and email delivery services. Each sub-processor is contractually bound to maintain appropriate security measures and process data only as instructed by us on behalf of the data controller.

Current sub-processors include cloud infrastructure providers and transactional email services. We will notify data controllers of any material changes to our sub-processor list.

5. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• AES-256 encryption for sensitive data at rest.
• TLS encryption for all data in transit.
• Role-based access controls limiting data access to authorized users.
• Regular security audits and vulnerability assessments.
• Automated backups with encrypted storage.

6. Data Transfers

Our infrastructure is hosted in secure data centers. When data is processed outside the originating country, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent transfer mechanisms.

7. Data Retention and Deletion

We retain personal data only for as long as necessary to provide the service. When a school terminates its account:

• School administrators can export all data within 90 days.
• After 90 days, all personal data is permanently and irreversibly deleted.
• Aggregated, anonymized statistics may be retained for service improvement.

8. Data Subject Rights

Data subjects (students, parents, staff) should direct rights requests to the school administrator, who acts as the data controller. We will assist the data controller in fulfilling requests to:

• Access personal data held in the platform.
• Correct inaccurate data.
• Export data in a portable format.
• Delete data subject to legal retention requirements.

9. Data Breach Notification

In the event of a personal data breach, we will notify the affected data controller without undue delay and no later than 72 hours after becoming aware of the breach. We will provide sufficient information to allow the data controller to meet any obligations to report or inform data subjects.

10. Contact

For questions about how we process data, contact us at inquiry@learntech.co.tz.