International Privacy Policy & Student Data Charter
Effective Date: October 1, 2026 · Compliant with GDPR, UK DPA 2018 & Ghana Data Protection Act 843
1.Introduction & Scope of Protection
Encore SMS International Ltd. ("we", "us", or "our") provides this Privacy Policy to transparently explain our practices regarding the collection, processing, protection, and retention of personal information belonging to students, parents, guardians, faculty, and administrative staff across educational institutions deploying our cloud platform.
Because our platform processes the records of minor children in primary, secondary, and higher education, we hold ourselves to the highest global data protection standards, including the UK General Data Protection Regulation (UK GDPR), EU GDPR, Ghana Data Protection Act 2012 (Act 843), and the principles of the US Family Educational Rights and Privacy Act (FERPA) and Children's Online Privacy Protection Act (COPPA).
2. Our Zero Student Data Monetization Guarantee
We make the following strict, legally enforceable guarantees regarding student data:
- We will never sell, rent, lease, or trade student personal records or parent information to any third party under any circumstances.
- We will never display behavioral advertisements or commercial marketing materials within student, parent, or administrative portals.
- We will never build commercial tracking profiles or sell telemetry to data brokers.
- Student academic and attendance records are processed solely for educational administration as instructed by the school.
3.Categories of Data Processed
| Category | Specific Data Fields | Purpose & Legal Basis |
|---|---|---|
| Student Records | Full legal name, date of birth, gender, enrollment date, student ID, photo, grade levels, and academic scores. | Academic administration, report cards, class rosters. (Contractual necessity). |
| Parent / Guardian | Name, mobile phone number, email address, relationship, and authorized pickup credentials. | Emergency notifications, gate push alerts, tuition fee billing. (Legitimate interest & safety). |
| Attendance Telemetry | Classroom roll calls, perimeter gate QR entry/exit timestamps, and carpool dispatch events. | Physical campus safety, guardian peace of mind, statutory attendance records. |
| Billing & Payments | Tuition fee invoices, Paystack transaction references, Mobile Money phone numbers (no credit card numbers stored). | Statutory tax compliance, fee collection, audit trail reconciliation. |
| Faculty & Staff | Staff full name, national ID (Ghana Card), tax numbers, bank account numbers, and payslip data. | Employment contracts, payroll calculation, statutory SSNIT and PAYE tax filing. |
4.Authorized Sub-Processors & Data Transfer
We engage a limited number of enterprise-grade sub-processors bound by strict Data Processing Agreements (DPAs):
- Supabase / AWS: Encrypted database hosting, backups, and Row Level Security isolation.
- Paystack: PCI-DSS Level 1 certified payment gateway handling Mobile Money and card transactions.
- Arkesel / Twilio: Transactional SMS carrier networks for OTP authentication and attendance alerts.
5.Statutory Retention Schedules
Personal data is retained in accordance with applicable educational and tax statutes:
- Academic Transcripts & Report Cards: Retained for 7 years following graduation or transfer (statutory education requirement).
- Financial & Billing Records: Retained for 7 years (statutory revenue authority requirement).
- Staff Payroll Records: Retained for 5 years following employment termination.
- One-Time Password (OTP) Codes: Automatically and permanently purged after 10 minutes.
- Raw Application Server Logs: Rotated and permanently purged every 90 days.
6.Data Subject Rights (GDPR & Act 843)
Under applicable privacy statutes, parents, adult students, and staff possess the right to: (a) request access to their personal records; (b) rectify inaccurate or incomplete records; (c) request erasure of non-statutory records ("Right to be Forgotten"); (d) object to processing; and (e) receive their personal data in a structured, portable digital format.
To exercise these rights, individuals should contact their school administration directly or reach our Data Protection Officer at dpo@encore-sms.com.