Privacy policy

This policy explains how Kilasi ("we", "us") collects, uses and protects personal data when schools use the Kilasi school management system, the Kilasi app and school websites, and when you visit kilasi.com. We follow the Data Protection and Privacy Act, 2019 of Uganda and its regulations.

1. Who is responsible for the data

School data. Each school decides what information about its learners, parents and staff it keeps in Kilasi and why. For that data the school is the data controller and Kilasi processes it on the school's behalf and only on its instructions. Questions about a learner's or parent's record should first go to the school.

Our own data. For people who contact us, book a demo or sign up a school, Kilasi is the data controller.

2. What we collect

• Learners: name, sex, date of birth, photo, class, LIN, house and residence, marks, report cards, attendance, fees invoices and payments, as entered by the school.
• Parents and guardians: name, relationship, phone number, email and, if they use the portal or app, their sign-in details.
• Staff: name, contact details, role, the classes and subjects they teach and their sign-in details.
• Demo requests and messages: the name, phone, email, school and message you send us.
• Technical data: IP address, browser or app version, the phones signed in to an account and records of important actions (the audit trail), kept for security.

3. How we use it

• To provide Kilasi to schools: records, marks, report cards, fees, attendance, messages, the parent portal and the app.
• To send the SMS, WhatsApp, email and app notifications that a school chooses to send.
• To keep accounts secure, prevent misuse and investigate problems.
• To answer demo requests and support questions, and to bill schools for the service.

We do not sell personal data, and we do not use learners' data for advertising.

4. Who we share it with

Only with service providers we need to run Kilasi, and only as much as they need: our hosting provider, our SMS provider (Africa's Talking) to deliver text messages, Google Firebase to deliver app notifications, and our email provider. WhatsApp messages are opened on the sender's own phone. We may also disclose data where the law requires it.

Some providers may store data outside Uganda. Where they do, we use providers that protect data to a standard at least as strong as Ugandan law requires.

5. How long we keep it

School data is kept while the school uses Kilasi. When a school leaves, it can export its lists, and we delete or anonymise its data within a reasonable period unless the law requires us to keep it longer. Demo requests are kept for as long as needed to follow up, and no longer than two years.

6. How we protect it

Each school's data is kept separate; access depends on each user's role; connections are encrypted; passwords are hashed; and important changes are recorded. See our security page.

7. Children

Learners' data is entered and managed by their school. Learners do not sign in to Kilasi themselves; parents and guardians see their own children's information.

8. Your rights

You may ask to see the personal data held about you, to correct it, or to object to or limit how it is used, as the Data Protection and Privacy Act allows. For school records, contact the school first; we will help the school respond. For anything else, contact us.

9. Cookies

We use cookies that are needed to keep you signed in and to protect forms. We do not use advertising cookies.

10. Changes and contact

We may update this policy and will change the date above when we do. Questions or requests: contact us or email [email protected].