Privacy Policy

Eduroot Technologies Ltd ("Eduroot", "we", "us", or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, and protect information when you use our website, mobile applications, APIs, and education management platform (collectively, the "Services").

We operate across multiple African jurisdictions and adhere to applicable data protection laws, including the Data Protection Act of Zambia, the Kenya Data Protection Act, the Nigeria Data Protection Act, and the principles of the African Union Convention on Cyber Security and Personal Data Protection.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

We collect information necessary to provide our education management Services. This includes: (a) Institutional Information — school name, registration details, accreditation status, and administrator contact details; (b) Student Information — names, dates of birth, enrollment dates, academic records, attendance data, grades, and demographic information as provided by the institution; (c) User Account Information — names, email addresses, phone numbers, job titles, and login credentials for teachers, administrators, and staff; (d) Financial Information — fee records, payment histories, and transaction details when processed through our platform; (e) Usage Data — IP addresses, device information, browser types, access times, and pages viewed; and (f) Communications — messages sent through our platform, support inquiries, and feedback submissions.

We do not collect sensitive personal data such as biometric data, health records, or religious affiliation unless explicitly required by an institution's curriculum or regulatory reporting, and only with appropriate safeguards.

We use the information we collect to: provide, maintain, and improve our Services; process transactions and send related information including confirmations and receipts; facilitate communication between schools, teachers, parents, and students; generate reports, analytics, and insights for institutional decision-making; detect, prevent, and address technical issues, fraud, and security incidents; comply with legal obligations and enforce our Terms of Service; and communicate with you about products, services, offers, and events (with your consent where required).

For institutions using our AI features, we may process academic data to generate lesson plans, grade assessments, and provide early warning insights. This processing is performed under strict data minimization principles, and institutions retain control over whether AI features are enabled.

We process personal data based on one or more of the following legal grounds: (a) Contractual Necessity — processing is necessary to perform our contract with the institution and provide the Services; (b) Legitimate Interests — processing is necessary for our legitimate business interests, such as improving our Services and ensuring security, provided these interests are not overridden by your rights; (c) Legal Obligation — processing is necessary to comply with applicable laws, regulations, or court orders; (d) Consent — where we rely on your consent, you have the right to withdraw it at any time; and (e) Vital Interests — in rare cases, processing may be necessary to protect someone's life or safety.

For student data, we rely on the institution's authority and consent as the data controller to process data on their behalf as a data processor.

We do not sell personal information. We may share information in the following circumstances: (a) With the Institution — student data is shared with authorized users within the institution that uploaded it; (b) Service Providers — with trusted third-party vendors who perform services on our behalf, such as cloud hosting, payment processing, and analytics, under strict confidentiality agreements; (c) Legal Requirements — when required by law, regulation, legal process, or governmental request; (d) Business Transfers — in connection with a merger, acquisition, or sale of assets, with notice to affected users; and (e) With Consent — when you have given us explicit permission to share information.

All third-party service providers are vetted for compliance with African data protection standards and are contractually bound to use personal data only for specified purposes.

We implement comprehensive technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include: AES-256 encryption for data at rest and TLS 1.3 for data in transit; role-based access controls with multi-factor authentication; regular security audits and penetration testing; automated threat detection and anomaly monitoring; secure data centers with ISO 27001 certified providers; and staff training on data protection and privacy best practices.

While we take all reasonable precautions, no internet transmission is completely secure. We encourage users to protect their account credentials and report any suspected security incidents to security@eduroot.africa immediately.

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, accounting, and reporting requirements. Typically: (a) Active Accounts — data is retained while the institution maintains an active subscription; (b) Inactive Accounts — data is retained for 12 months after account termination to allow for reactivation; (c) Financial Records — transaction data is retained for 7 years in accordance with tax and accounting regulations; and (d) Anonymized Data — aggregated, non-identifiable data may be retained indefinitely for analytics and product improvement.

Upon termination of services and expiry of the retention period, personal data is securely deleted or anonymized in accordance with our data destruction protocols.

Depending on your jurisdiction, you may have the following rights regarding your personal data: (a) Access — request a copy of the personal data we hold about you; (b) Correction — request that we correct inaccurate or incomplete data; (c) Deletion — request deletion of your personal data, subject to legal retention requirements; (d) Restriction — request limitation on how we process your data; (e) Portability — request transfer of your data to another service provider; (f) Objection — object to processing based on legitimate interests or direct marketing; and (g) Withdraw Consent — withdraw previously given consent at any time.

To exercise these rights, please contact us at privacy@eduroot.africa. We will respond within 30 days of receiving a verified request. Institutions should direct student data requests through their designated data protection officer.

Eduroot provides Services to educational institutions and does not knowingly collect personal data directly from children under the age of 13 (or the applicable age of digital consent in your jurisdiction) without institutional authorization.

Student data is collected and managed by the educational institution, which acts as the data controller. We process such data only as a data processor under the institution's instructions. Parents and guardians with concerns about their child's data should contact the relevant educational institution directly.

If you believe we have inadvertently collected personal data from a child without proper authorization, please contact us immediately at privacy@eduroot.africa, and we will take steps to delete such information.

Eduroot is headquartered in Zambia and operates infrastructure across Africa. Your data is primarily stored in regional data centers located in Zambia, Kenya, and Nigeria to ensure low latency and compliance with local data residency requirements.

In limited circumstances, we may transfer personal data to service providers located outside of Africa. When we do so, we ensure appropriate safeguards are in place, including: adequacy decisions by relevant authorities; standard contractual clauses approved by data protection regulators; and encryption and access controls during transit and storage.

We are committed to keeping African student data within the African continent wherever possible and will notify institutions of any proposed changes to data storage locations.

We use cookies and similar technologies to operate and improve our Services. For detailed information about the types of cookies we use, their purposes, and how you can manage your preferences, please see our Cookie Policy.

By using our Services, you consent to our use of cookies as described in the Cookie Policy, unless you have adjusted your browser settings to refuse cookies. Essential cookies cannot be disabled as they are necessary for the functioning of the Services.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance. When we make material changes, we will: update the "Last Updated" date at the top of this page; notify active users via email or in-app notification; and, where required by law, seek renewed consent for changed processing activities.

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after any changes indicates your acceptance of the updated policy.

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact our Data Protection Officer:

Email: privacy@eduroot.africa

Address: Plot 123, Great East Road, Lusaka, Zambia

Phone: +260 211 123 456

We aim to respond to all privacy inquiries within 48 hours. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.