Privacy Policy

1. Who we are

This Privacy Policy explains how Grace Project International School ("we", "us", "the school") collects, uses, and protects personal data through the GPIS attendance and secure pickup platform, in line with Uganda's Data Protection and Privacy Act, 2019 ("the Act").

For any question about this policy or your data, contact us at technology@gpisu.com.

2. What data we collect

• Staff and school administrators: name, email, phone number, role, and campus/school assignment.
• Guardians / parents: name, contact details, and relationship to the student(s) they are linked to.
• Students: name, date of birth, student number, class and campus, and pickup/attendance records. Student data is provided and managed by the school and by the student's guardian(s), consistent with the Act's provisions on processing children's data.

3. Why we process this data

We process personal data to run the school's attendance and secure pickup system: verifying who is authorized to collect a student, recording attendance, managing staff and guardian accounts, and communicating with guardians and staff about their children or duties. Processing is based on the school's legitimate interest in student safety, performance of our services to the school, and guardian consent where applicable.

4. Who we share it with

Data is only visible to staff and guardians with a legitimate need — scoped to their own school, campus, or linked students. We do not sell personal data, and we do not share it with third parties except where required to operate the platform (e.g. our hosting provider) or where required by law.

5. How long we keep it

We retain personal data for as long as it is needed for the purposes above, or as required by law — for example, attendance and safeguarding records may need to be retained for a minimum period even after a deletion request, to meet the school's legal obligations.

6. Security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including access controls scoped by role and encrypted connections.

7. Your rights

Under the Act, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data, subject to our legal retention obligations (see Section 5);
• Object to or restrict certain processing;
• Lodge a complaint with Uganda's National Personal Data Protection Office (NPDPO) if you believe your rights have been violated.

To exercise your right to erasure, use our Data Deletion Request page. For any other request, contact technology@gpisu.com. We aim to respond within 30 days.

8. Children's data

Where the platform processes a student's personal data, this is done with the involvement and consent of the student's parent or guardian, who can exercise the rights in Section 7 on the student's behalf.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.