Privacy policy

1. About this policy

IWAT School Solutions is an online school management system made by Iwat Digital Solutions ("we", "us"). Schools use it to run admissions, registers, marks and report cards, fees, messages to parents, online learning and more. Learners, parents, guardians and staff use it through accounts their school gives them.

This policy explains what personal information is held in IWAT School Solutions, why, who it is shared with, how long it is kept and the choices and rights you have. It applies to the website and app at iwatsolutions.com, the school websites we host, and the messages (SMS, WhatsApp and app notifications) sent through the system.

2. Who is responsible for your information

Each school decides what information it records about its learners, parents and staff and what it uses it for. For that information the school is the data controller, and we are the data processor: we store and process it only on the school’s instructions and to provide the service.

We are the data controller for a small amount of information we collect for ourselves: details of school staff who contact us or sign their school up, billing records for paid plans, and technical logs used to keep the service secure.

If you have a question about how your school uses your information, please contact the school first. You can always contact us as well (see section 13).

3. What information is held

• Learners: name, photo, date of birth, gender, admission number, registration number, Learner Identification Number (LIN), class and stream, house, clubs, boarding place, attendance, marks, assessments, report cards, online-learning progress, quiz answers and work handed in, fees and payments, library loans, meal and ID card records, and any health, sick-bay or discipline notes the school chooses to record.
• Parents and guardians: name, relationship to the learner, phone numbers, email, address if recorded, messages and payments made, and the learners they are linked to.
• Staff: name, photo, contact details, role, teaching assignments, and — where the school uses payroll — salary, deductions, bank or mobile money details and tax numbers.
• Admission applicants: the details given on the school’s online application form.
• Our public school directory (iwatsolutions.com/schooldirectory): each school’s name, location, ownership, day or boarding, EMIS number, and the school’s office and head teacher contact names and phone numbers, taken from school lists and from schools themselves. Anyone named can ask us to correct or remove their details using the link on the school’s page.
• Directory applications: the learner’s name, gender, date of birth, the class wanted and previous school, and the parent or guardian’s name, phone and email, given on a school’s directory page.
• Schools signing themselves up: the details of the person signing up, and the documents they upload to show they own or run the school. These documents are seen only by our team, are used only to check the sign-up, and are never published.
• Messages: the text and delivery status of SMS, WhatsApp messages and app notifications the school sends, and chat messages, files and call records between people at the school.
• Account and security information: email or phone used to sign in, password (stored only as a one-way hash), sign-in times, the device and browser used, IP address, and an audit log of changes made in the system.

Some of this is sensitive, such as health information, discipline records and information about children. Schools are asked to record only what they need, and access to it is limited to the staff whose role requires it.

4. How the information is used

• To run the school: admissions, classes, timetables, registers, assessment and report cards, fees, receipts, payroll, boarding, library, health and welfare records.
• To keep families informed: messages, alerts (for example absence, fee balances, payment receipts and results), announcements and the results-check link.
• For online learning: courses, lessons, quizzes and assignments, progress tracking, and — if the school switches it on — copying courses and enrolments to Moodle.
• For online exams: the time each attempt starts and ends, and a log of events such as leaving the exam page, leaving full screen, or trying to copy or paste. If the examiner turns on the camera rule for an exam, the learner’s device asks for permission and small still photos are taken now and then during the exam. Photos and the event log are seen only by the learner’s teachers and school leaders, and are used only to check that the exam was taken fairly. No video is recorded and no face recognition is used.
• To support learners: early-warning lists and insights built from attendance, marks and fees, seen only by the class teacher and school leaders.
• To keep accounts and data secure, prevent misuse, fix problems and make backups.
• To bill schools for paid plans and to contact school leaders about the service.

We do not sell personal information, and we do not use it for advertising or to build marketing profiles.

Schools rely on their duties as schools, on consent from parents or guardians, or on their legitimate interests to process this information, as allowed under the Data Protection and Privacy Act, 2019 of Uganda. Where information about a child is collected, the school is responsible for having a parent or guardian’s consent where the law requires it.

5. Who the information is shared with

Information is shared only as needed to provide the service, and only with these kinds of providers:

• Schools in the directory: an application made from a school’s directory page goes to that school. If the school is not on IWAT School Solutions, our team contacts the school and passes on the details on the family’s behalf.
• Hosting and storage: our servers, databases, file storage and backups run with cloud providers (currently Railway and S3-compatible storage), and Cloudflare protects and speeds up the website.
• SMS: Africa’s Talking, using the school’s own account, receives the phone number and message text.
• WhatsApp: Meta Platforms (WhatsApp Business Platform), using the school’s WhatsApp Business account, receives the phone number and message text. Delivery and read receipts come back from Meta. See section 6.
• Mobile money: MTN Mobile Money and Airtel Money receive the phone number and amount needed for each fee payment.
• App notifications: the browser’s push service (for example Google, Apple or Mozilla) delivers notifications; it receives only an encrypted notification.
• AI drafting (only if the school switches it on): Anthropic receives marks, attendance and totals to draft report comments and summaries. Learner names and admission numbers are not sent, and Anthropic does not use this to train its models.
• Moodle (only if the school switches it on): learner and teacher names, school email or username, class enrolments and course content are copied to the Moodle site the school uses.

We may also disclose information if the law requires it, to protect someone’s safety, or to the school itself. If we ever change ownership, the new owner would have to keep to this policy.

6. WhatsApp messages

Schools can send messages and alerts to parents and staff on WhatsApp from the school’s own WhatsApp Business number. When a school connects WhatsApp through IWAT School Solutions, Meta gives us permission (an access token) to send messages and manage message templates for that school’s WhatsApp Business account only. The token is stored encrypted and is used only to send the school’s messages and receive delivery reports.

We receive from Meta the delivery status of each message (sent, delivered, read or failed) so the school can see whether messages arrived and send an SMS instead when they did not. If the school keeps using the WhatsApp Business app on the same number, Meta may also share message activity on that number with the system, which is used only to show the school its own messages.

Parents and staff can ask the school to stop WhatsApp messages at any time; the school can switch WhatsApp off, or send by SMS only. Replying "STOP" to the school’s number, or blocking it in WhatsApp, also stops them. Meta’s own handling of WhatsApp information is described in WhatsApp’s privacy policy.

7. Where information is stored

Our cloud providers may store and process information on servers outside Uganda, for example in Europe or the United States. Where this happens we use providers that protect information to a standard at least equivalent to Ugandan law, under written agreements, as required by the Data Protection and Privacy Act, 2019.

8. How long information is kept

• School records are kept for as long as the school uses IWAT School Solutions, or for as long as the school instructs us. Schools can archive learners who leave and delete records they no longer need.
• When a school stops using the service, we delete or return its information within 90 days, unless the law requires us to keep it longer.
• Backups are encrypted and kept for 30 days, after which they are deleted automatically.
• Security and audit logs are kept for up to 2 years.
• Directory applications are kept for up to 2 years, then deleted. Sign-up documents are kept for as long as the school uses the service, or for 1 year after a sign-up is turned down.
• Exam photos and exam event logs are kept with the exam attempt for as long as the school keeps that exam.
• Billing records for paid plans are kept for as long as tax law requires.

9. How information is protected

• Connections to the website and app are encrypted (HTTPS).
• Passwords are stored only as one-way hashes. Payment, messaging and other keys are encrypted at rest.
• Each school’s information is kept separate, and access inside a school is limited by role (for example, health notes are visible only to authorised staff).
• Sign-ins are rate-limited, important changes are written to an audit log, and backups are encrypted and tested.
• Files such as lesson videos and handed-in work open only through short-lived signed links.

No system is perfectly secure. If a breach affecting personal information happens, we will tell the affected schools without delay so they and we can inform the Personal Data Protection Office and the people affected as the law requires.

10. Children

Many people whose information is held are children. Learner accounts are created by the school, not by children signing themselves up. Children’s information is used only to educate and care for them and to keep their families informed. Parents and guardians can see their own children’s information through their parent account, and can exercise the rights in section 11 on their child’s behalf.

11. Your rights

Under the Data Protection and Privacy Act, 2019 you have the right to:

• ask what information is held about you (or your child) and get a copy;
• ask for information that is wrong or incomplete to be corrected;
• ask for information to be deleted when it is no longer needed or was collected unlawfully;
• object to, or ask to limit, some uses of your information, including messages you do not want;
• withdraw consent you have given, where the use relies on consent;
• complain to the Personal Data Protection Office (PDPO) of Uganda.

Because schools control most of the information, please start with your school. We will help the school respond, normally within 30 days. You can also contact us directly and we will pass your request to the right school.

12. Deleting your information

To have your information deleted, ask your school’s office, or email us at the address below with your name, your school and the phone number or email on your account. We will confirm your identity, work with the school, and confirm when it is done. Some records (for example fee receipts or exam results) may have to be kept for a period by law; if so we will tell you.

If you connected a WhatsApp Business account or a Facebook account to IWAT School Solutions, you can also remove our access at any time in your Facebook or Meta Business settings (Business Integrations), or by pressing Disconnect in School settings → WhatsApp. We then delete the stored access token.

13. Contact us

Questions, requests or complaints about privacy:

14. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows when it last changed. If the changes are significant, we will tell schools before they take effect.