Privacy Policy
This policy explains how Malticard Uganda Limited handles personal data in Skooltym Access and on this website, in line with Uganda’s Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.
1Who is responsible for your data
For student, parent and staff data inside Skooltym Access, the school is the data controller. The school decides which children are enrolled, what contact numbers are held, and how long records are kept. Malticard is the data processor: we hold and process that data only on the school’s documented instructions.
If you are a parent or a student and you want data corrected or deleted, contact your school first. We will help the school act on your request, but we cannot act on it independently.
Malticard is the data controller for its own business data — enquiries submitted on this website, correspondence with school staff, invoices and payment records.
2What we process
| Whose data | What | Why |
|---|---|---|
| Students | Name, Student Number, class, stream, sex, date of birth (where the school provides it), enrolment photograph, biometric template (face and/or fingerprint), RFID card number, clock-in and clock-out events with timestamps and terminal identifiers | To record attendance and generate the notifications and reports the school has subscribed to |
| Parents and guardians | Name, relationship to the student, phone number, email address where provided, notification and portal activity | To send attendance notifications and, where enabled, to provide the parent portal |
| School staff | Name, role, email address, phone number, login credentials, audit records of actions taken in the system | To provide access control, accountability and support |
| Website visitors | Details submitted in the demo request form; basic technical logs such as IP address, browser type and pages viewed | To respond to enquiries and keep the site secure |
Biometric data and children’s data are treated as special personal data and are subject to the additional protections set out in the Biometric & Children’s Data Notice.
3Lawful basis
- Consent — for the enrolment and processing of a child’s biometric data, given by the parent or guardian and recorded by the school. Consent may be withdrawn at any time.
- Performance of a contract — to deliver the service the school has subscribed to, and to answer an enquiry you send us.
- Legal obligation — where we must retain records for tax, accounting or regulatory purposes.
- Legitimate interest — to keep the platform secure, prevent abuse, and maintain audit logs, balanced against the rights of the individuals concerned.
4Who we share data with
We share personal data only where it is necessary to run the service:
- Mobile network operators and SMS aggregators — the recipient’s phone number and message text, to deliver notifications.
- Cloud hosting and infrastructure providers — to store and serve the platform.
- Payment providers — for school subscription payments; card and mobile-money details are handled by the provider, not by us.
- Professional advisers and auditors — under confidentiality obligations.
- A competent authority — only where we are required to disclose by law, and only to the extent required. Where we are lawfully permitted to do so, we will notify the school first.
We do not sell personal data. We do not share it with advertisers or data brokers. We do not use student biometric data, attendance records or parent contact details to train machine-learning models. We do not operate a watchlist or provide facial recognition services to third parties.
5Where data is held
Data is hosted at [hosting location]. Where any processing takes place outside Uganda, we do so only in a country with comparable protection or under contractual safeguards that meet the requirements of section 19 of the Data Protection and Privacy Act, 2019. On-premises deployments keep data on the school’s own infrastructure; the school is then responsible for its physical and network security.
6How long we keep it
| Data | Retention |
|---|---|
| Biometric templates | Deleted within [30] days of the student leaving the school, consent being withdrawn, or the subscription ending — whichever is first |
| Attendance records | For as long as the school instructs, and by default [7] years, so that historic attendance can be evidenced |
| Parent contact details | Until the student leaves the school, plus [12] months |
| Website enquiries | [24] months from last contact |
| Invoices and accounting records | As required by Ugandan tax law |
7Security
We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, encryption at rest for biometric templates, role-based access control, audit logging of administrative actions, tenant isolation between schools, least-privilege access for our staff, and background-checked personnel bound by confidentiality. No system is perfectly secure; we do not represent that ours is.
8Your rights
Under the Data Protection and Privacy Act, 2019 you have the right to be informed about the collection of your data; to access it; to have inaccurate data corrected; to have data erased where there is no lawful basis to keep it; to object to processing; and to withdraw consent where consent is the basis of processing. A parent or guardian exercises these rights on behalf of a child.
Because the school is the controller, please send requests to the school in the first instance. If you cannot reach the school, or you are unhappy with its response, write to us at [dpo@malticard.com] and we will route the request. You may also complain to the Personal Data Protection Office of Uganda.
9Data breaches
If a breach affecting personal data occurs, we will notify the affected school without undue delay and in any event within [72] hours of becoming aware of it, with the information the school needs to meet its own notification duties to the Personal Data Protection Office and to affected individuals.
10Changes
We will post any change to this policy here and update the version date. Where a change materially affects how personal data is handled, we will notify subscribing schools directly.
[dpo@malticard.com] · +256 785 880259 · PDPO registration no. [—]