The policy applied to client schools and their users: students, parents and staff.
Each client school is the data controller in the legal sense for the data of its students, their parents and its staff. SkoolMob acts as processor: the data is processed solely on the school's behalf, under the contract between them. Processing is carried out in accordance with the Cameroonian regulations on personal data protection and, for hosting in the European Union, with the GDPR.
Student identity and contact details (name, matricule, photo, date of birth); parent contacts (phone, email); teaching and administrative staff information; grades, averages, remarks, report cards; history of school-issued communications; technical logs required for security (IP address, connection timestamps).
School management as mandated by the school: grade entry, MINESEC-compliant report card generation, communication with parents. No data is used for advertising purposes, nor sold to commercial third parties.
Processing is based on the performance of the contract between the school and SkoolMob, and on the school's legitimate interest in running the academic and administrative management of its students. Commercial information sent by SkoolMob is based on consent and has its own dedicated checkbox in the contact form.
Data is hosted in a Tier III certified data centre located in the European Union. The name of the host is provided in writing to client schools on request. Any transfer outside the European Union is governed by standard contractual clauses compliant with the applicable regulations.
Encrypted communications in transit (TLS 1.2+), passwords hashed with Argon2id, authentication tokens encrypted at rest (AES-256-GCM via Android Keystore on mobile). Role- and permission-based access control; timestamped audit logs.
Active data is kept for the whole duration of the contract between the school and SkoolMob. On termination, a full export is provided to the school within 15 working days, then the data is kept for a 90-day grace period, so the school can query the export or request another copy. After that period it is deleted from our active systems. Technical backups are overwritten within a further 30-day cycle. Published report cards with evidential value may be kept longer if the school requests it in writing, as part of its school archiving obligations; responsibility for long-term archiving then rests with the school.
Any data subject has a right of access, rectification, restriction and, within legal limits, erasure of their data. These requests are made to the client school, the data controller. SkoolMob supports the school in handling these requests.
Data on minor students is collected within the school context, under the joint responsibility of the school and the legal guardians. No student data is published on public channels by SkoolMob.
Any question about this policy may be sent to legal@skoolmob.com. Requests from students, parents or staff should first be addressed to their school, which is the data controller.