Biometric & Children’s Data Notice

Skooltym Access recognises children. That deserves a document of its own. This notice explains exactly what is created when a student is enrolled, what it can and cannot be used for, and how a parent stops it.

1What is actually stored

Where a school also uses a student photograph for identification on a profile page or a printed card, that photograph is stored separately, is used only for that purpose, and is covered by the same consent and deletion rules.

2What it may be used for

A biometric template may be used for one purpose only: to establish that a particular enrolled student has presented themselves at a school gate terminal, so that an attendance event can be recorded and a notification sent.

3What it will never be used for

• Surveillance of a student anywhere other than at a gate terminal.
• Emotion recognition, behaviour scoring, attention monitoring or profiling of any kind.
• Inference of ethnicity, health, religion or any other characteristic.
• Matching against a watchlist, or identification of any person who is not an enrolled student of that school.
• Training, tuning or evaluating machine-learning models, whether ours or a third party’s.
• Sale, rent, licensing, marketing or transfer to any third party.
• Sharing between schools. Each school’s templates are isolated from every other school’s.
• Disclosure to law enforcement or any authority except under a valid court order or an express legal obligation — and, where we are lawfully able, only after notifying the school.

4Consent

A child’s biometric data may not be enrolled without the informed, freely given, specific and recorded consent of that child’s parent or legal guardian. The school is responsible for obtaining and holding that consent, and must be able to produce it. Consent must state what is collected, why, how long it is kept, and how to withdraw it. Where a student is old enough to understand, the school should also explain the system to the student.

5The right to refuse — and the alternative

6Withdrawing consent

A parent or guardian may withdraw consent at any time by writing to the school. On withdrawal, the school instructs deletion in the platform and the student’s biometric template is permanently deleted within [7] days, and the student is moved to the non-biometric method. Attendance events already recorded remain in the school’s register, because they are a record of a fact the school is entitled to keep — but they are no longer linked to any biometric data.

7Deletion

Biometric templates are deleted:

• within [7] days of consent being withdrawn;
• within [30] days of the student leaving, graduating from, or being withdrawn from the school;
• within [30] days of the school’s subscription ending, from both the hosted platform and every gate terminal;
• immediately on a lawful erasure request the school accepts.

Deletion covers the hosted platform, all gate terminals at the school, and backups within the following backup cycle of [35] days.

8Security of biometric data

Templates are encrypted at rest, isolated per school, and accessible only to the school’s authorised administrators and to the minimum number of Malticard engineers required for support — whose access is logged. Templates are never included in exports, reports, CSV downloads or support tickets.

9Accuracy and its consequences

Face recognition is not infallible. It can fail to recognise a student it should recognise, and — rarely — confuse two students, most often siblings. A school must have a procedure for a student who is not recognised, must review flagged mismatches, and must never treat a missing clock-in as proof of absence without checking. See section 3 of the Terms of Service.

10Rights and complaints

Parents and guardians have the rights set out in the Privacy Policy, exercised through the school. Complaints may also be made to Uganda’s Personal Data Protection Office.