PRIVACY POLICY FOR BRAINSTAKE:

1. Who We Are

We are Brainstake Solutions (Private) Limited, the company behind the eSchools platform. Our platform helps schools across Zimbabwe and Southern Africa manage their data securely and efficiently. We are a registered Data Controller with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

If you use our platform, this policy applies to you whether you're a:

• School administrator or staff member
• Teacher
• Parent or legal guardian of a student

Please note:

We do not collect personal data directly from students. All student data is provided by registered schools.

2. Scope of This Policy

This Privacy Policy applies to all users of the eSchools platform:

• Students
• Parents/Guardians
• Teachers and staff
• School administrators
• Any other users who interact with our platform

It explains how we collect, use, store, share, and secure your personal data.

3. What Information We Collect

Depending on how you interact with our platform, we may collect the following types of information:

1. Basic Details

   Names, dates of birth, student ID numbers, or national ID numbers.

2. Contact Information

   Phone numbers, email addresses, and postal addresses.

3. Academic Records

   Grades, attendance, schedules, and any disciplinary history.

4. Financial Information

   Payment methods, billing records, and fee statements.

5. Biometric Data (only when used by schools)

   Fingerprint scans or facial recognition data (with parent/guardian consent).

6. Technical Data

   Your IP address, browser type, device information, and usage logs.

7. Communication Data

   Messages sent through our system (email, SMS, or chat).

8. Location Data

   See Section 3A below

3A. Location Data

Our app may collect approximate or precise location data from teachers’ mobile devices under the following conditions:

• To enable automatic teacher attendance check-ins when a teacher is physically within the school’s geofenced area.
• The "Mark Attendance" button becomes active only when the teacher is on school premises.
• We do not track teachers continuously or outside of school boundaries.

This data is:

• Not used to track you continuously
• Not shared with any advertisers
• Not sold or rented
• Only accessed with your device permission
• Handled in compliance with privacy regulations
• You can manage or revoke location permissions at any time from your device settings

Legal Compliance:

We process location data in accordance with:

• Zimbabwe’s Data Protection Act [Chapter 11:22] and SI 155 of 2024
• South Africa’s POPIA
• The African Union’s Malabo Convention on Cyber Security and Personal Data Protection
• Any applicable local regulations governing school and education data protection

4. How We Collect Your Information

• From Schools: Schools enter student data (including personal, academic, and financial details) into the system on behalf of parents and students.
• From Parents or Guardians: When you register or update your contact information.
• Automatically: When you use the platform, we collect technical and usage data using cookies and system logs.
• From Trusted Third Parties: For example, payment processors or messaging service providers.

5. Why We Collect Your Data

• To manage academic and administrative tasks, like attendance, grades, and schedules.
• To allow communication between schools and parents.
• To process payments and send fee notifications.
• To improve the functionality and performance of our platform.
• To comply with laws and regulations.
• To protect the platform from misuse or security threats.

We only collect data that is necessary for these purposes.

6. Legal Grounds for Using Your Data

We will only use your data when we are allowed to by law. The legal grounds we rely on include:

• Consent: We ask for your clear permission before collecting biometric data or processing children’s personal data.
• Contractual Necessity: To provide the services you expect from our platform.
• Legal Obligation: To meet requirements under Zimbabwean and South African laws.
• Legitimate Interest: To run, maintain, and improve our platform without overriding your rights.

7. Children’s Data and Parental Consent

If the user is a student under the age of 18, we will only collect and use their data if we have verified consent from a parent or guardian. In cases where schools use biometric systems (e.g., fingerprint for attendance), we:

• Always get written consent from the parent or guardian first
• Keep biometric data securely encrypted
• Limit access to only authorized school staff or administrators

Parents may revoke their consent at any time by contacting us or their child’s school.

8. Who We Share Your Information With

We only share your information with trusted parties that help us run the platform. These include:

• Payment Providers – to handle secure transactions
• Communication Services – to send emails, SMS, or alerts
• IT and Analytics Services – to maintain and improve our platform
• Regulatory Authorities – like POTRAZ, if required by law

All our partners follow strict confidentiality and data protection agreements. We do not sell or rent your personal data to anyone.

9. International Transfers

Sometimes your data may be stored or processed outside Zimbabwe (e.g., on cloud servers or by international service providers). If this happens, we ensure:

• Your data is protected to the same high standards.
• The receiving country has privacy safeguards in place.
• We follow Zimbabwean and South African data transfer regulations.

10. Your Privacy Rights

You have the right to

• Access your personal data.
• Correct any mistakes or incomplete information.
• Delete your data, where allowed by law.
• Limit or object to how we process your data.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, please contact us at info@brainstake.tech.

11. How We Protect Your Data

We take your data security seriously. Some of the steps we take include:

• Encryption: to protect sensitive information in storage and during transfer.
• Access Control: only authorized personnel can view personal data.
• Regular Security Audits: to detect and fix any vulnerabilities.
• Training: our staff are trained in data privacy and security best practices.

12. How Long We Keep Your Data

We only keep your data for as long as it is needed for the purpose it was collected. This may include:

• Keeping academic records for regulatory or school reporting.
• Retaining financial data for tax or audit purposes.
• Holding on to contact details to notify you about school-related matters.

When we no longer need the data, we delete or anonymize it securely.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make any major changes, we’ll let you know through:

• Email notifications
• Messages on our platform
• The updated “Last Updated” date at the top of this document

We encourage you to review the policy periodically.

14. Contact Us

If you have any questions or concerns, you can contact us:

Brainstake Solutions (Private) Limited

Email: info@brainstake.tech

Phone: +263711951133

Address: 2761 Sable Way, BluffHill, Harare

15. School and Organizational Data

We also protect non-personal data belonging to schools, such as class schedules, teacher records, and internal reports. This data is:

• Encrypted and stored securely.
• Only accessible to verified users.
• Handled in compliance with Zimbabwean and South African regulations.

We are committed to creating a safe and transparent platform for education. Thank you for trusting eSchools by Brainstake.