Privacy Notice

1. Who we are

Skolpass (skolpass.com) is an application-transmission and tracking service for Senior One admissions to private secondary schools in Uganda. For the purposes of the Data Protection and Privacy Act, 2019 (the "Act"), Skolpass is the data controller for your account, payment and tracking data, and a data processor acting on the instructions of each school you apply to for the application content you send them. The registered operator name, address and registration number appear in the footer and in our Terms.

2. Whose data we collect

• Parents / legal guardians — name, phone number(s), email (optional), language preference, payment references.
• Children (candidates) — first and last name, PLE index number, PLE aggregate (when released), primary school and district, and any documents you choose to upload (for example a result slip or a recommendation letter).
• School staff and field agents — name, work email/phone, role, and an audit trail of actions taken on the platform.

A child's data is entered only by their parent or legal guardian (or by a verified Skolpass agent on the guardian's explicit instruction). We do not collect data directly from children and we do not create accounts for children.

3. Why we use it (lawful basis)

• To deliver the service you asked for — transmitting your application to the schools you selected and relaying their decisions (contract).
• With your consent — processing a child's personal data for school applications. You give this consent on the application form and can withdraw it (see section 8).
• Optional marketing — reminders and news by SMS, WhatsApp or email only if you tick the optional box; you can switch it off any time in My Applications. Application status messages are not marketing and are always sent.
• Legal obligations and safety — keeping payment records, preventing fraud and impersonation, and responding to lawful requests.

4. Who sees what

• The schools you apply to see your child's application and documents. Each school decides independently and is responsible for verifying credentials. Schools do not see which other schools you applied to, or your ranking.
• Skolpass support can see a parent's application list only for 30 minutes after the parent generates and shares a support code, and never the uploaded documents. Every such access is logged.
• Field agents never see your data after helping you submit; they cannot log in as you.
• Service providers (sub-processors) that host or deliver our service: Supabase (database and authentication, hosted in the EU), Vercel (web hosting), Resend (email), PesaPal (payments — we never see your card or mobile-money PIN), and our SMS gateway. Each is bound by contract to protect your data.

We do not sell personal data. We do not share it with advertisers.

5. Where it is stored

Our database and file storage are hosted in the European Union (Frankfurt). Transfers outside Uganda are made under contractual safeguards in line with the Act and its Regulations. We will update this notice if hosting moves.

6. How long we keep it

• Applications, decisions and documents: until the end of the admissions cycle plus 12 months, then deleted or anonymised, unless you ask us to delete earlier or a school's legal duty requires a copy.
• Payment records: 7 years (accounting law).
• Audit logs (who viewed what): 24 months.
• Accounts with no applications: deleted after 24 months of inactivity.

7. How we protect it

Encryption in transit (HTTPS) and at rest; role-based access with row-level security; two-factor authentication for school approvers and for Skolpass administrators; two-signature school decisions; logged document views; rate-limited public endpoints; automated daily backups. No system is perfectly secure — if we ever suffer a breach affecting your data we will notify you and the Personal Data Protection Office without undue delay, as the Act requires.

8. Your rights

Under the Act you may ask us to: access the data we hold about you or your child; correct it; delete it (subject to the retention periods above); withdraw consent (this withdraws pending applications — schools that have already received an application keep their copy under their own policy); and object to marketing. You can do most of this yourself in My Applications. For anything else, contact us using the details in the footer; we respond within 30 days. You may also complain to the Personal Data Protection Office (PDPO) at NITA-Uganda.

9. Children

Because our users' data concerns children aged around 12–14, we apply extra care: minimum data, no profiling, no advertising, no public display of any child's name or results, and access restricted to the guardian and the chosen schools only.

10. Cookies and devices

We use only strictly necessary cookies and local storage (to keep you signed in and to save an unfinished application on your phone). No advertising or cross-site tracking cookies.

11. Changes

We will post any changes here with a new version number and date, and notify account holders of material changes by SMS or email.