Privacy Policy

Last updated: 12 November 2026

This policy explains what personal data EIT School Manager collects, why, who sees it, and the choices you have.

1. Who we are and our role

EIT School Manager is provided by EIT Ghana Ltd. We process personal data in line with the Data Protection Act, 2012 (Act 843) of Ghana.

  • For school records (students, parents, staff, attendance, grades, fees) the school is the data controller and EIT Ghana acts as its processor, handling that data only on the school’s instructions.
  • For account, security and billing data (sign-in details, subscription and payment records) EIT Ghana is the controller.

Parents and guardians who want to exercise rights over their child’s school records should contact the school first.

2. What we collect

  • Account data: name, email, phone, role, school, and a securely hashed password (we never store passwords in readable form).
  • School records entered by schools: student profiles (which may include date of birth, gender, address, health or special-needs notes, photos), parent/guardian contacts, enrolment, attendance, timetables, exam results, fees and payments, and staff and payroll details.
  • Communications: a log of emails, SMS and other notifications sent through the Service (status and recipient). Password-reset links are never stored in this log.
  • Technical data: IP address, device and browser information, and security and audit logs.
  • Payment data: subscription status and payment references. Card and mobile-money details are handled by our payment provider, not stored by us.

3. How we use data

  • To provide, secure and support the Service, including sign-in and password recovery.
  • To send messages the school asks us to send (results, fee reminders, announcements) and service notices such as password-reset and security emails.
  • To process subscriptions and prevent fraud and abuse.
  • To maintain and improve the Service, and to meet legal obligations.

4. Lawful basis

We rely on performance of our contract with the school, our legitimate interests in running and securing the Service, legal obligations, and consent where required (for example where a school collects consent from parents for certain processing). The school is responsible for establishing a lawful basis for the student and parent data it enters.

5. Children’s data

Student records necessarily include information about children. We treat it with particular care: it is accessible only to authorised users of that school, is not used for advertising, and is never sold. Children do not create accounts with us; schools and their staff manage these records.

6. Who we share data with

We do not sell personal data. We share it only with service providers that help us run the Service, under appropriate safeguards:

  • Cloud hosting and infrastructure providers;
  • Email delivery (our mail servers), SMS (Arkesel), WhatsApp (Meta) and push notifications (Google Firebase);
  • Payments (Paystack);
  • Google, if you choose “Sign in with Google”.

We may also disclose data where required by law or to protect rights, safety and the security of the Service.

7. International transfers

Some of our providers may process data outside Ghana. Where that happens we take steps to ensure the data remains protected to a standard consistent with Ghanaian data protection law.

8. Security

  • Each school’s data is logically isolated from every other school’s.
  • Passwords are hashed; password-reset links are single-use, expire after 30 minutes, and only a hash of the link token is stored.
  • Traffic is encrypted in transit, and access is limited by role.
  • No system is perfectly secure. If a breach affecting your data occurs we will notify the school and the relevant authority as the law requires.

9. Retention

We keep school data while the school’s account is active. After closure we retain it for a limited period to allow recovery and to meet legal and accounting obligations, then delete or anonymise it. Audit and security logs are kept for as long as needed for security and compliance.

10. Your rights

Under the Data Protection Act you may request access to your data, correction of inaccurate data, deletion where applicable, and object to certain processing. To exercise a right, contact us or your school.

You may also complain to Ghana’s Data Protection Commission if you believe your data has been mishandled.

11. Cookies and local storage

We use only what is needed to run the Service: session cookies and browser storage to keep you signed in and to route you to your school’s workspace. We do not use advertising cookies.

12. Changes to this policy

We may update this policy. The “Last updated” date shows the current version, and we will notify school administrators of material changes. See also our Terms & Conditions.

13. Contact us