Privacy Policy

1. Introduction

ST. GONZAGA SECONDARY SCHOOL (hereinafter the "School") is committed to protecting the privacy and personal data of every individual who uses its web-based School Management System (SMS) (the "System"). The System is accessible online through a production web environment and may also operate in a controlled local network during development or testing phases.

This Privacy Policy explains what personal information we collect, why we collect it, how it is used, how it is protected, and what rights you have over your data. It applies to all users of the System, including administrators, teachers, and any authorised staff who interact with student records, academic data, or system settings.

By accessing or using the System, you acknowledge that you have read and understood this Privacy Policy. This policy complies with:

• The Uganda Data Protection and Privacy Act, 2019 (DPPA 2019)
• The Uganda Data Protection and Privacy Regulations, 2021
• Global data protection best practices (GDPR-inspired structure)

2. Definitions

Personal Data

Any information that identifies or can be used to identify a living individual — names, ID numbers, photographs, and online identifiers.

Data Subject

The individual whose personal data is processed — primarily students, teachers, and administrative staff.

Data Controller

ST. GONZAGA SECONDARY SCHOOL, which determines the purposes and means of processing personal data within the System.

Data Processor

Any entity that processes personal data on behalf of the Data Controller (e.g., the hosting provider).

Processing

Any operation on personal data — collection, recording, storage, use, modification, retrieval, disclosure, erasure, or destruction.

Minor / Child

Any person under the age of 18 years, in accordance with the Children Act (Cap. 59) of Uganda.

Academic Records

Marks, grades, examination results, report cards, teacher comments, and related academic performance information stored in the System.

Activity Log

A system-generated record of user actions including logins, data changes, report generation, and exports — stored with IP address, device info, and timestamp.

Session

A temporary authenticated connection between a user's device and the System, valid until logout or 15-minute inactivity timeout.

3. Information We Collect

We collect the minimum personal data necessary to operate the System effectively.

3.1 Student Personal Data

• Full name (surname and other names)
• Sex / gender  |  Date of birth
• Nationality and home district / region
• Student identification number (auto-generated)
• Academic year, education level, class, and stream
• Enrolment status (active, promoted, archived, graduated)
• Payment reference code (pay code), where applicable
• Passport-size photograph (optional, uploaded by authorised staff only)
• Academic records: marks, grades, scores, teacher comments, report cards

3.2 Teacher and Staff Personal Data

• Full name  |  Gender  |  Email address
• Username  |  Hashed password (plain-text passwords are never stored)
• Professional role / position  |  Employment status
• Teacher identification number (auto-generated)
• Subject assignments and class responsibilities

3.3 System-Generated Technical and Activity Data

• IP address of the user's device at the time of each action
• User-Agent string (browser and device type)
• Session identifiers (managed server-side; regenerated on each login)
• Timestamps of all significant user actions
• Activity log entries: LOGIN, LOGOUT, PAGE_VIEW, CREATE, UPDATE, DELETE, RESULT_GEN, PRINT, EXPORT
• Session inactivity tracking (15-minute auto-logout for teacher/class_teacher roles)

4. How We Use Your Information

1. Student enrolment, class assignment, and academic record management.
2. Generating academic reports, report cards, and performance analysis.
3. Authenticating users and managing role-based access (admin, teacher, class teacher).
4. Enforcing session security, including automatic logout after inactivity.
5. Maintaining activity audit logs for accountability and internal auditing.
6. Enabling authorised teachers to enter and manage marks and academic comments.
7. Supporting bulk student uploads, promotions, archiving, and academic calendar management.
8. Facilitating printing and export of academic reports and data by authorised users.
9. Maintaining System performance, security, and reliability.

5. Legal Basis for Processing Personal Data

5.1 Legitimate Purpose (Educational Function)

The primary basis for processing student and staff data is the legitimate educational and administrative function of the school, as recognised under Ugandan education law.

5.2 Consent

For sensitive personal data or student photographs, we obtain informed consent from the relevant individual or, for minors, their parent or legal guardian. Consent may be withdrawn at any time.

5.3 Contractual Necessity

For teachers and staff, processing personal data is necessary to perform the functions defined in their professional engagement with the school.

5.4 Legal Obligation

Certain records may be retained or disclosed pursuant to applicable Ugandan laws, UNEB regulations, or lawful orders from competent government authorities.

5.5 Vital Interests

In exceptional circumstances, personal data may be processed to protect the vital interests of a student or other individual (e.g., an emergency requiring medical or welfare intervention).

6. Data Sharing and Disclosure

We do not sell, rent, trade, or transfer personal information to third parties for commercial purposes. Data may only be shared in the following limited circumstances:

6.1 Internal Access (Role-Based)

• Administrators can access all modules, including student records, staff records, and activity logs.
• Teachers can access only the student records and marks for their assigned classes and subjects.
• No user can access data beyond their designated role permissions.

6.2 Authorised Third Parties

• [Hosting Provider] — Server infrastructure provider; bound by a data processing agreement.
• Technical Support Personnel — Bound by confidentiality; access only anonymised or test data where possible.

6.3 Legal and Regulatory Disclosure

Data may be disclosed when required by law, court order, or lawful request from a government authority (UNEB, Ministry of Education, or law enforcement acting under a valid legal instrument).

7. Data Storage, Retention & Security

7.1 Where Your Data Is Stored

All personal data is stored in a MySQL relational database (utf8mb4 charset) hosted on a secure server provided by [Hosting Provider]. Data is timestamped in East Africa Time (EAT, UTC+3).

7.2 Data Retention Periods

Data Category	Retention Period
Active student records	Duration of enrolment + minimum 7 years
Archived student records	Retained indefinitely (read-only)
Teacher / staff records	Duration of employment + minimum 5 years
Activity logs	Minimum 2 years
Session data	Destroyed on logout or after 15-minute inactivity

7.3 Security Measures

• Password Hashing: All passwords are stored using PHP PASSWORD_DEFAULT (bcrypt). Plain-text passwords are never stored or logged.
• Session Security: Session IDs are regenerated on every login. Sessions expire after 15 minutes of inactivity for teacher roles.
• Prepared Statements: All database queries use PDO prepared statements to prevent SQL injection.
• Role-Based Access Control (RBAC): All pages enforce strict role checks; unauthorised access returns HTTP 403.
• Input Validation & Sanitisation: All user inputs are validated and sanitised before processing or display.
• Activity Audit Logging: Every significant action is logged with IP address, device info, and timestamp.
• File Upload Controls: Photo uploads are restricted to permitted file types (JPEG, PNG) and stored in controlled directories.
• Error Handling: In production mode, detailed error messages are suppressed and logged server-side only.
• .htaccess Restrictions: Server-level configuration files restrict directory access and enforce security headers.

8. Your Rights as a Data Subject

Under the Uganda DPPA 2019, you have the following rights:

1. Right of Access — Request a copy of the personal data we hold about you (or your child).
2. Right to Rectification — Request correction of inaccurate or incomplete data.
3. Right to Erasure — Request deletion where data is no longer necessary and no legal obligation requires retention.
4. Right to Object — Object to processing in certain circumstances.
5. Right to Restriction — Request temporary suspension of processing while a dispute is resolved.
6. Right to Data Portability — Request your data in a structured, machine-readable format where feasible.
7. Right to Withdraw Consent — Withdraw consent at any time without affecting prior lawful processing.
8. Right to Lodge a Complaint — Submit a complaint to the Personal Data Protection Office (PDPO) at NITA-U.

To exercise any of these rights, contact: stgonzassk@gmail.com. We will acknowledge within 5 working days and respond fully within 30 days.

9. Cookies and Session Tracking

The System uses only server-side PHP session cookies (PHPSESSID) necessary for authenticated user sessions. These cookies:

• Are first-party and contain only a session identifier — no personal data
• Are valid only for the duration of the browser session or 15-minute inactivity timeout
• Are deleted automatically upon logout
• Are regenerated on each login to prevent session fixation attacks

The System does not currently use third-party analytics cookies, advertising cookies, or persistent tracking cookies. Certain UI preferences (e.g., dark mode) may be stored in browser local storage — this data remains on your device and is not transmitted to our servers.

10. Children's Data Protection

10.1 Data Minimisation

We collect only the personal data strictly necessary to manage a student's academic record. We do not collect medical history, disciplinary records beyond System scope, or social media information.

10.2 Parental and Guardian Rights

For students under 18, a parent or legal guardian may exercise all data subject rights on behalf of the student. Written requests with proof of guardianship are required.

10.3 Access Restrictions

Student records are accessible only to authorised school staff. No student data is publicly accessible through the System.

10.4 Photographs

Student photographs are stored securely and accessible only within the System by authorised users. They are not published publicly or shared externally.

10.5 No Direct Online Collection from Children

The System does not provide a student-facing login portal. All student data is entered exclusively by authorised administrative staff or teachers.

11. Third-Party Services

11.1 Web Hosting

[Hosting Provider] provides the server infrastructure. The hosting provider acts as a Data Processor and processes data only on our documented instructions, under a data processing agreement.

11.2 Front-End Libraries / CDNs

The System may load UI libraries from CDNs (e.g., Bootstrap, FontAwesome). These services may log your IP address in connection with file requests. No personal data from within the System is transmitted to these CDNs.

11.3 No Analytics or Advertising Platforms

As of the effective date, the System does not integrate with third-party analytics platforms, social media platforms, or advertising networks.

12. Data Breach Response Procedures

12.1 Detection and Containment

Upon discovery of a suspected breach, our technical team will immediately investigate, contain the breach, and preserve evidence.

12.2 Notification to Affected Individuals

If the breach poses a high risk to individuals' rights, we will notify affected persons within 72 hours of becoming aware, via available communication channels. Notification will include the nature of the breach, categories of data affected, likely consequences, and steps taken.

12.3 Regulatory Reporting

Qualifying breaches will be reported to the Personal Data Protection Office (PDPO) at NITA-U within the timeframe prescribed by the DPPA 2019.

12.4 Post-Breach Review

Following any breach, we will conduct a root-cause review and implement corrective measures to prevent recurrence.

13. Maintenance Mode and System Downtime

The System includes a maintenance mode feature that may be activated during updates or technical work. During maintenance, access is temporarily restricted and no new personal data is processed. Existing data remains securely stored. Users attempting access during maintenance are redirected to a maintenance notification page.

14. International Data Transfers

The System is designed to operate within Uganda. If the hosting provider's infrastructure involves data storage in another country, we will ensure such transfers comply with the DPPA 2019 and are subject to appropriate safeguards, such as Standard Contractual Clauses.

15. Updates to This Privacy Policy

When material changes are made, we will update the Effective Date and Version at the top, make the updated policy accessible through the Admin and Teacher Dashboards, and notify users where required. Continued use of the System after an update constitutes acceptance of the revised policy.

16. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Republic of Uganda, including the Uganda Data Protection and Privacy Act, 2019. Any disputes shall be subject to the jurisdiction of the courts of the Republic of Uganda.

17. Contact Information

For questions, concerns, or data subject requests, contact our Data Protection Administrator:

School	ST. GONZAGA SECONDARY SCHOOL
System	School Management System (SMS)
Contact Person	School Data Protection Administrator
Email	stgonzassk@gmail.com
Address	P.O Box 1809, Jinja-Kagoma
Phone	+256782741977
System URL	[System URL]

You may also escalate unresolved complaints to:

• National Information Technology Authority – Uganda (NITA-U) — Personal Data Protection Office (PDPO)
• Palm Courts, Plot 7A, Rotary Avenue, Lugogo, Kampala, Uganda
• www.nita.go.ug

---

This Privacy Policy is effective as of 26 March 2026 and supersedes all previous versions.
© 2026 ST. GONZAGA SECONDARY SCHOOL. All rights reserved.