Privacy Policy

This Privacy Policy applies to information relating to schools using SEAC; school administrators; staff members; teachers; students; parents and guardians; accountants and finance users; operational staff; prospective customers; website visitors; demo users; support contacts; and other persons whose information is processed through SEAC.

SEAC provides software and hosted technology services to schools.

In many situations, the school decides what personal information should be collected, why that information is needed, who should have access to it, how long the school needs to keep it, and how it should be used for school operations.

In those situations, the school generally acts as the organisation responsible for deciding how the information is processed, while SEAC processes the information in order to provide the service.

SEAC may also process certain information for its own legitimate operational purposes, including account administration, billing, service security, fraud prevention, technical support, system monitoring, legal compliance and service improvement.

Where appropriate, SEAC and a school may enter into a separate Data Processing Agreement.

SEAC may process information such as school name, address, contact details, email address, telephone numbers, school logo, institutional settings, academic-year information, class structures, student population, subscription information, and account and onboarding information.

Schools may use SEAC to process student information such as full name, student identification number, admission information, date of birth, gender, class, photograph, contact information, address, guardian information, academic history, attendance, assessment results, report cards, class history, clubs and leadership records, finance records, canteen records, bookshop activity, status history, archived or alumni records, and other school-related information entered by authorised users.

SEAC does not require schools to collect information merely because a field exists within the platform. Schools are responsible for deciding what information is appropriate and lawful for them to collect.

SEAC may process parent or guardian information such as full name, telephone number, email address, residential or contact address, relationship to the student, linked student records, guardian account information, communication history, and other information entered by the school.

SEAC may link one guardian record to more than one student where those students belong to the same family.

Schools may use SEAC to process information relating to teachers and other staff members, including name, staff identification number, photograph, telephone number, email address, job title, role, department, employment status, salary information, payroll information, attendance-related information, system permissions, account information, and other employment or administrative records entered by the school.

SEAC may process academic information including subjects, class assignments, assessment scores, examination results, SBA or continuous-assessment records, mock examination results, grades, positions or rankings where enabled, teacher remarks, conduct information, promotion information, report cards, and historical academic records.

SEAC may process attendance-related information including student attendance, class attendance, dates of attendance, presence or absence, teacher attendance actions, attendance completion status, and related management reports.

Schools may use SEAC to process financial and operational information including student bills, fee schedules, payment records, receipts, arrears, credits, payment history, canteen collections, bookshop transactions, payroll records, expenses, billing status, and other school financial records.

SEAC may also process payment information relating to a school's own subscription to SEAC.

Payments for SEAC subscriptions may be processed through third-party payment providers.

SEAC may receive information such as payer name, school name, transaction reference, payment status, amount paid, currency, payment date, and provider-generated transaction information.

SEAC does not necessarily receive or store full payment-card details where those details are handled directly by the payment provider. Payment providers may process information under their own privacy policies and terms.

SEAC may process information contained in or relating to school announcements, guardian communications, support messages, service notifications, email communications, billing notices, system alerts, and other messages sent through or in connection with SEAC.

SEAC may process information used to create, secure and manage accounts, including usernames, account identifiers, password hashes, roles, permissions, login status, session information, account status, temporary-password status, and security-related information.

Passwords should be stored and handled in a protected form rather than as readable plain-text passwords.

When someone accesses SEAC, SEAC may automatically process limited technical information such as IP address, browser type, device information, operating system, date and time of access, requested pages, session information, system events, error information, security events, and server logs.

This information may be used for security, troubleshooting, performance monitoring, abuse prevention, service reliability and technical support.

SEAC may use cookies or similar browser technologies where necessary to keep users signed in, maintain secure sessions, remember limited preferences, protect accounts, and support normal website or application functionality.

SEAC does not need to use advertising cookies in order to operate its core school-management services.

If additional analytics or optional tracking technologies are introduced later, this Privacy Policy should be updated accordingly.

SEAC provides a live demonstration environment containing synthetic or fictional information.

The public demo is intended only for evaluation and demonstration. Users should not enter real personal, confidential, sensitive or school-production information into the public demo.

Information entered into the demo may be visible to other demo users, changed, overwritten, reset or deleted. The public demo should not be treated as permanent or confidential storage.

SEAC may process personal information to provide the SEAC platform; create and manage school environments; create and manage user accounts; authenticate users; operate school-management features; process school records; provide support; process SEAC subscription payments; issue billing records and receipts; maintain security; prevent fraud, abuse and unauthorised access; troubleshoot errors; maintain backups; monitor service performance; communicate important service information; comply with legal requirements; enforce applicable agreements; and improve the reliability and functionality of SEAC.

SEAC seeks to process personal information only where there is an appropriate lawful basis or other lawful authority for doing so.

Depending on the circumstances, processing may be necessary to perform a contract, provide requested services, comply with a legal obligation, support legitimate operational or security interests, act with the consent of the relevant person where consent is appropriate, or rely on another lawful basis available under applicable law.

Schools remain responsible for identifying and maintaining an appropriate lawful basis for personal information they collect and enter into SEAC.

Because SEAC is designed for schools, the platform may contain information relating to children.

SEAC recognises that children's information requires particular care. Schools are responsible for ensuring that children's information is collected lawfully, used only for legitimate school purposes, accessed only by authorised persons, kept accurate where reasonably possible, and protected appropriately.

A school should not use SEAC to collect unnecessary information about a child.

SEAC does not sell School Data to advertisers.

SEAC may share or make information available only where reasonably necessary, including with authorised users of the relevant school, infrastructure and hosting providers, payment processors, email-delivery providers, approved communications providers, technical service providers, professional advisers where necessary, legal or regulatory authorities where required by law, and other parties authorised by the relevant school or user.

Any service provider handling personal information on SEAC's behalf should only receive the information reasonably necessary for its role.

Schools control many aspects of user access within their own SEAC environments.

Different users may receive different permissions depending on their role. A teacher, administrator, accountant, storekeeper, canteen manager, guardian, or other authorised user may have access to different parts of the system.

Schools are responsible for assigning permissions appropriately and reviewing access when a user's responsibilities change.

Hosted SEAC school environments are intended to keep each school's operational records separated from those of other schools.

SEAC uses technical and access controls designed to prevent one school from accessing another school's information without authorisation.

No system can guarantee absolute security, but SEAC will take reasonable steps to maintain appropriate separation and access controls.

SEAC takes reasonable technical and organisational measures to protect information against unauthorised access, unlawful disclosure, accidental loss, alteration, misuse, destruction and other security risks.

Measures may include user authentication, role-based permissions, protected sessions, access controls, security headers, rate limiting, infrastructure protections, database controls, backups, monitoring, audit records and security updates.

Schools should also protect administrator credentials, assign appropriate permissions, disable accounts that are no longer required, avoid sharing passwords, use trusted devices where possible, and notify SEAC of suspected unauthorised access.

If SEAC becomes aware of a security incident affecting personal information, SEAC may investigate the incident, take steps to contain it, protect affected systems, restore service, preserve relevant records, and notify affected schools, users or authorities where required by applicable law.

Schools and authorised users are responsible for keeping information entered into SEAC reasonably accurate and up to date.

Where a user identifies incorrect information, the school should use the available administrative tools or contact the appropriate school administrator to correct it.

SEAC may assist with technical correction where necessary but does not independently determine the accuracy of school records.

SEAC may retain School Data while the relevant school has an active SEAC account or subscription and while the information is reasonably necessary to provide the service.

Specific school records may also be retained in accordance with the school's own policies, applicable legal requirements, academic or financial record-keeping obligations, and legitimate operational needs.

When a school's SEAC licence expires or the school terminates its use of SEAC, SEAC will not ordinarily delete the school's operational data immediately.

Unless otherwise agreed in writing, SEAC will retain the school's data for 90 days after the effective date of expiry or termination.

During this period, the school may request reasonable access to retrieve or export its data.

After the 90-day period, SEAC may delete, anonymise or otherwise remove the school's data, subject to legal requirements, regulatory obligations, security needs, fraud-prevention needs, dispute-resolution needs, billing or audit requirements, and normal backup-retention cycles.

Information remaining temporarily in backups may be removed through SEAC's normal backup lifecycle.

A school may request deletion of its data following termination, subject to verification of the requester's authority, applicable legal obligations, legitimate security needs, financial or audit obligations, and any other lawful reason requiring limited retention.

SEAC may require confirmation from an authorised school administrator before carrying out a deletion request.

Schools may retain historical student records, including alumni or graduated-student records, where those records remain part of the school's legitimate academic or administrative history.

The school determines whether and for how long such records should remain active within its SEAC environment, subject to applicable law.

SEAC may maintain backups for continuity, recovery and security purposes.

Deletion from the active system may not always result in immediate removal from every backup copy. Backup copies will normally be removed through SEAC's ordinary backup-retention cycle and should not ordinarily be restored for normal customer use after deletion.

Some technology providers used by SEAC may operate infrastructure or systems outside Ghana.

Where personal information is processed outside Ghana, SEAC will seek to use appropriate providers and safeguards consistent with applicable data-protection requirements.

Schools should be informed through applicable agreements where international processing is material to the service.

SEAC may rely on third-party providers for services such as cloud hosting, domain services, payment processing, email delivery, SMS delivery, monitoring, infrastructure, and other technical functions.

These providers may process limited information needed to perform their services. SEAC does not control the independent privacy practices of third parties acting outside SEAC's instructions.

SEAC may send information about service updates, product improvements, offers, promotions and related SEAC services.

Where required, users may be given a way to opt out of marketing communications.

Service-related communications necessary to operate an account, subscription or security process may still be sent even where marketing messages are declined.

Subject to applicable law, individuals may have rights relating to their personal information, which may include rights to obtain information about processing, request access, request correction, object to certain processing, request deletion in appropriate circumstances, request restriction of certain processing, and make a complaint to an appropriate authority.

Because much of the information in SEAC is controlled by schools, a student, guardian or staff member should ordinarily contact the relevant school first regarding information held in that school's SEAC environment.

SEAC may assist the school in responding where technically necessary.

If you are a student, guardian, staff member or other person seeking access to or correction of information maintained by a school, you should first contact that school's administration.

SEAC should not normally change a school's official records directly without appropriate school authorisation.

Where a request concerns information controlled directly by SEAC, you may contact SEAC using the details at the end of this Privacy Policy.

If you have concerns about how SEAC handles personal information, you may contact SEAC first so that the issue can be investigated.

Nothing in this Privacy Policy prevents a person from exercising any right to complain to an appropriate data-protection or regulatory authority under applicable law.

If SEAC is reorganised, acquired, merged or transferred to another lawful business entity in the future, information associated with the service may be transferred as part of that transaction where permitted by law.

Any successor operating SEAC would remain subject to applicable data-protection obligations.

SEAC does not sell student, guardian, staff or school operational data to advertisers.

SEAC does not intend to operate the SIS by monetising school records through advertising profiles.

If SEAC's business model materially changes in a way that affects personal-data use, this Privacy Policy should be updated before such processing begins where required.

SEAC may generate calculations, summaries, reports or system outputs based on information entered by authorised users. These may include academic results, fee balances, arrears, attendance summaries, payroll calculations, reports and management indicators.

These outputs are intended to assist school administration. Schools remain responsible for reviewing significant decisions rather than treating every automated calculation as an independent final decision about a person.

SEAC may update this Privacy Policy as the service, law or data-processing practices change.

The current version will be published with an updated Last updated date.

Where a material change significantly affects how existing users' personal information is handled, SEAC will take reasonable steps to provide notice where appropriate.

This Privacy Policy should be read together with the SEAC Terms & Conditions.

If a school has a separate Data Processing Agreement, Subscription Agreement or other written agreement with SEAC, those documents may contain additional privacy and data-protection obligations.