Eduketiq Privacy Policy
We are fundamentally committed to protecting the privacy, sovereignty, and security of the personal data entrusted to us by our partner educational institutions.
1. Introduction and Scope
The Eduketiq Platform ("Eduketiq", "we", "us", or "our") operates as a specialized educational management and financial infrastructure platform. We are committed to protecting the privacy and security of the personal data entrusted to us.
This Privacy Protocol explains how we collect, use, process, and protect personal data in strict compliance with the Zimbabwe Data Protection Act [Chapter 11:22] (DPA) and aligned global privacy standards.
Understanding Our Legal Role
Under the DPA, the legal responsibility for data processing is divided as follows:
-
Data Controller: The educational institution (the "School") that subscribes to Eduketiq is the Data Controller. The School legally determines the purpose and means of processing the personal data of its students, parents, and staff.
-
Data Processor: Eduketiq acts exclusively as a Data Processor. We only process personal data on behalf of, and strictly under the documented instructions of, the School via our Master Services Agreement and Data Processing Agreement (DPA).
Note: If you are a parent, guardian, or student, your primary legal relationship is with the School. Requests regarding your data rights must be directed to the School's administration.
2. Information We Process
To provide the Eduketiq services, we process information across isolated, tenant-specific environments. We explicitly do not cross-reference, pool, or aggregate personal data between independent schools.
A. Information Provided by the School
- Student Data (Minors): Full names, auto-generated admission numbers, class designations, and enrollment history.
- Parent/Guardian Data: Full names, physical addresses, email addresses, mobile numbers, and relational links to specific enrolled students.
- Financial Data: Fee structures, multi-currency invoices generated in supported ledgers (USD and ZiG), payment receipts, unallocated credit balances, and historical financial ledgers.
- Staff Data: Names, email addresses, and assigned system access roles including Administrator or Master Admin.
B. Information Collected Automatically
- System Telemetry & Audit Logs: IP addresses, browser types, device identifiers, login timestamps, and immutable audit trails of administrative actions, including invoice generation, receipt creation, and profile modifications.
3. Special Notice Regarding Minors
Eduketiq processes the personal data of children strictly for educational administration and financial billing purposes as instructed by the School. We do not independently collect data directly from children. It remains the strict legal obligation of the School, acting as the Data Controller, to obtain explicit, verifiable consent from parents or legal guardians prior to enrolling a minor into the Eduketiq system, as mandated by the Zimbabwe Data Protection Act.
4. How We Use the Information
We process personal data solely to operate, maintain, and secure the Eduketiq platform. Authorized uses include:
- Educational Administration: Facilitating student rosters, managing academic year rollovers, and processing class promotions or alumni transitions.
- Financial Processing: Generating invoices, recording receipts, managing advance credits via automated ledger logic, and rendering official PDF financial statements.
- Communication: Transmitting school announcements, broadcast messages, and automated fee reminders to parents via secure portal notifications or email.
- Security & Diagnostics: Monitoring infrastructure health, authenticating authorized users, preventing unauthorized access, and maintaining audit logs of financial transactions.
6. Data Security and Infrastructure
We implement enterprise-grade Technical and Organizational Measures (TOMs) to protect personal data against unauthorized access, alteration, or destruction:
Architectural Isolation
Eduketiq utilizes a strict multi-tenant architecture. Each School's database is logically segregated.
Encryption
Data in transit is encrypted using modern TLS protocols. Passwords and credentials are cryptographically hashed.
Access Controls
Tenant environments feature strict Role-Based Access Control (RBAC) to ensure operational authorization.
Incident Mitigation
We maintain a Global Maintenance Protocol to instantly sever external access during threat investigations.
7. Retention & Deletion
Eduketiq retains data solely for the duration of the School's active subscription, or as legally mandated. Financial ledgers are retained permanently within the system audit trail to comply with ZIMRA tax regulations. Upon termination of a subscription, the Data Controller's environment is safely archived and scheduled for secure erasure.
8. Data Subject Rights
Under the Zimbabwe Data Protection Act, individuals possess specific rights regarding their personal data, including the right to access, rectify, or erase their information.
How to Exercise Your Rights
Because Eduketiq is the Data Processor, all data subject requests must be directed to your School's administration. We provide the necessary tools for the School to fulfill these requests directly. If we receive a direct privacy request from a parent or student, we will forward it to the respective School within 72 hours.
9. Contact Information
For inquiries regarding this Privacy Policy or our architectural data protection practices, please contact our administrative team.
Eduketiq Data Protection
Harare, Zimbabwe