Privacy Policy

1. Data Controller

Axera Innovations (U) Limited ("we", "us", "our") is the data controller responsible for the personal data processed through the Package for School Management (PSM) platform. We are registered with the Personal Data Protection Office (PDPO) of Uganda under the Data Protection and Privacy Act, 2019.

2. Legal Basis for Processing

We process personal data on the following legal bases:

• Contractual necessity: Processing required to deliver the PSM service under our agreements with schools
• Legitimate interest: Service improvement, security monitoring, and fraud prevention
• Legal obligation: Compliance with Ugandan education regulations, tax laws, and data protection requirements
• Consent: Marketing communications and optional analytics (where applicable)

3. Categories of Personal Data

School Staff & Administrators

• Names, contact details, employment information
• Login credentials and access logs
• Contract and payroll-related data

Students

• Personal details: name, date of birth, gender, nationality
• Academic records: marks, assessments, report cards, attendance
• Admissions data: previous schools, entry requirements
• Medical information (where provided by the school)
• Photographs for identification purposes

Parents & Guardians

• Names, contact details, relationship to student
• Financial transaction records (fee payments, pocket money)
• Communication history with the school

Usage Data

• System usage patterns and feature analytics
• Login records and session information
• Device and browser information

4. Children's Data

PSM processes data about minors (students) on behalf of schools. Schools act as co-controllers for student data and are responsible for obtaining appropriate consent from parents or guardians where required. We implement enhanced safeguards for children's data including strict access controls, data minimisation, and purpose limitation.

5. How We Use Your Information

• Provide, maintain, and improve the PSM service
• Process financial transactions and manage school accounts
• Communicate service updates, support, and notifications
• Generate academic reports, analytics, and dashboards
• Ensure platform security and prevent unauthorised access
• Comply with legal and regulatory obligations

6. Data Sharing

We may share personal data with:

• Service providers: Cloud hosting (Oracle Cloud), email delivery (Postmark), SMS (Twilio), payments (Yo! Uganda) — under data processing agreements
• Regulatory bodies: Ministry of Education and Sports (EMIS reporting), Uganda Revenue Authority, as required by law
• Schools: Each school accesses only its own tenant data within the multi-tenant platform

We do not sell personal data to third parties.

7. Cross-Border Data Transfers

Some of our service providers operate outside Uganda. Where personal data is transferred internationally, we ensure adequate protection through data processing agreements that include appropriate safeguards as required under the Data Protection and Privacy Act, 2019.

8. Data Retention

• Active accounts: Data retained for the duration of the service agreement
• After termination: School data retained for 90 days, then permanently deleted upon written confirmation
• Financial records: Retained for 7 years as required by Ugandan tax law
• Audit logs: Retained for 2 years for security purposes

9. Your Rights

Under the Data Protection and Privacy Act, 2019, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Request that we limit processing of your data in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise any of these rights, contact our Data Protection Officer (see below). We will respond within 30 days.

10. Data Breach Notification

In the event of a personal data breach that poses a risk to affected individuals, we will:

• Notify the PDPO within 48 hours of becoming aware of the breach
• Notify affected schools and individuals without undue delay
• Document the breach, its effects, and remedial actions taken

11. Cookies

PSM uses essential cookies required for the platform to function (authentication, session management, security tokens). We do not use advertising or tracking cookies. Third-party analytics cookies are used only with consent where applicable.

12. Data Protection Officer

For privacy-related questions, data subject requests, or to report concerns:

You also have the right to lodge a complaint with the Personal Data Protection Office of Uganda if you believe your data protection rights have been violated.