Privacy Policy

This Privacy Policy explains how Tvantra (“Tvantra”, “we”, “us”) collects, uses, discloses and protects personal data in connection with the MySchoolPortal software platform (the “Platform”).

It applies to personal data processed through the Platform. It does not apply to the independent data-handling practices of any school, or of any third party whose services a school chooses to use.

Under the Data Protection Act, 2012 (Act 843) of Ghana, a subscribing school (the “School”) is the data controller for the records it keeps in the Platform. The School determines what personal data is entered, for what purpose, and for how long it is retained.

Tvantra acts as a data processor, processing that data on the School’s documented instructions and for no independent purpose of our own. Where we determine the means of processing (for example in relation to account security, billing and service administration), we act as a controller in respect of that limited processing.

If you are a parent, guardian, pupil or member of staff, your first point of contact in relation to your personal data is the School, not Tvantra. Section 9 explains how we support such requests.

The Platform processes the following categories of personal data:

• Pupil data: name, class, date of birth, admission details, photograph where uploaded by the School, and guardian contact details.
• Financial data: fees charged, payments received, outstanding balances, credit balances, and receipts issued.
• Attendance and academic data: daily registers, assessment scores, grades and report cards.
• Staff account data: name, role, contact details, authentication credentials and assigned permissions.
• Communications data: recipient numbers and message content for SMS sent by the School, together with delivery status.
• Audit data: a log attributing each material change to the account that made it, together with a timestamp.

Some of this constitutes personal data relating to children. It is processed solely to deliver the Platform to the School, and is never used for marketing or profiling.

We process personal data for the following purposes:

• Provision of the Platform: maintaining records, generating statements, invoices and report cards, and transmitting SMS at the School’s direction. Lawful basis: performance of our contract with the School.
• Security and audit: authenticating users, enforcing permissions, and maintaining audit logs. Lawful basis: legitimate interests in securing the Platform, and the School’s legal obligation to maintain accurate records.
• Support and fault diagnosis: investigating issues reported by the School. Lawful basis: performance of our contract with the School.
• Billing and administration: invoicing subscription and SMS charges. Lawful basis: performance of our contract, and compliance with legal obligations.

We do not sell personal data, licence it to third parties, or use it for advertising or automated decision-making that produces legal effects.

We engage the following sub-processors, each bound by contract to appropriate confidentiality and security obligations, and each receiving only the data necessary for its function:

• mNotify and Hubtel (SMS delivery): recipient telephone number and message content.
• Paystack (payment processing): transaction data where a School collects fees online. Cardholder data is processed by Paystack under its own PCI-DSS obligations and is not stored by Tvantra.
• Amazon Web Services (infrastructure): hosting of the application, database and uploaded files.

We may also disclose personal data where required by law, court order or a lawful request from a competent authority, or where necessary to establish, exercise or defend legal claims. We will notify the School of any such disclosure unless legally prohibited from doing so.

Each School’s data is logically separated from that of every other School. Within a School, access is governed by role-based permissions assigned by that School’s administrators; a class teacher’s access is narrower than an administrator’s.

Tvantra personnel access School data only where necessary to provide support, investigate a fault, or comply with a legal obligation. Such access is limited to authorised personnel and is recorded.

We retain personal data for as long as the School maintains an active subscription, as the records constitute the School’s operational and financial history.

Certain financial records are retained notwithstanding a deletion request. A cancelled or voided payment is marked as void and preserved, together with the reason and the account that voided it, so that the financial audit trail remains complete. This is a deliberate control and may also be required for the School’s own statutory record-keeping.

On termination, we will agree a data export and deletion schedule with the School. Following that schedule, data is deleted from active systems, with residual copies in routine backups expiring in the ordinary course.

We maintain technical and organisational measures appropriate to the risk, including individual authentication credentials, role-based access control, encryption of data in transit, and audit logging that attributes changes to the acting account.

No system can be guaranteed secure. Where a personal data breach occurs that is likely to affect a School’s data, we will notify the affected School without undue delay and provide the information reasonably required for it to meet its own obligations under Act 843.

Subject to Act 843, data subjects have the right to request access to their personal data, to request correction of inaccurate data, to object to processing in defined circumstances, and to request erasure where no lawful ground for continued retention applies.

Because the School is the controller, such requests should be addressed to the School in the first instance. Where a School requires our assistance to respond, we will provide it within the timeframes required by law. Where we receive a request directly, we will refer it to the relevant School and inform the requester that we have done so.

We may amend this Policy from time to time. Where an amendment materially affects the rights of data subjects or the obligations of Schools, we will notify Schools directly rather than relying on publication alone.

Enquiries and requests relating to this Policy may be directed to:

Tvantra: operator of MySchoolPortal
Email: info@myschoolportal.xyz
Telephone: +233 59 653 9060
Or via the contact page.

Data subjects in Ghana additionally have the right to lodge a complaint with the Data Protection Commission.