Privacy Policy

Last updated: [DATE]

This policy explains how EduBulk SMS Services, operated by [Eduscape Systems — legal name and address] ("EduBulk", "we"), handles personal data under Uganda's Data Protection and Privacy Act, 2019.

1. Two kinds of people, two roles

• Our customers (the schools, clinics, shops and other organisations that open accounts). For their account details we are the data controller.
• People who receive messages (for example parents, patients, members). The organisation that texts you decides why and to whom messages are sent and is the data controller for your contact details; EduBulk acts as its processor and handles your data only to deliver messages on its instructions. If you have a question about why you were texted, contact that organisation.

2. What we collect

• Customer accounts: name, email, organisation name, Sender ID, password (stored only as a one-way hash), sign-in attempts and IP address, payment records (amount, status, reference; not card or mobile money PINs), and the date you accepted our terms.
• Contacts uploaded by customers: names, phone numbers and group labels.
• Messages: message text, recipient number, send time, delivery status and any error returned by the network.

3. How we use it

To provide the service (sending and scheduling messages, showing reports, managing credits and payments), to keep accounts secure, to prevent abuse, to communicate with customers about their account, and to meet legal obligations. We do not sell personal data or use recipients' details for our own marketing.

4. Who we share it with

• SMS gateway and mobile networks (currently [EgoSMS / Africa's Talking — confirm]), which must receive the recipient number and message text to deliver it.
• Payment providers (currently [Flutterwave]) for processing credit purchases.
• Hosting and email providers that run our servers and send system emails.
• Authorities, where the law requires it.

Some of these providers may process data outside Uganda. We use providers that maintain appropriate safeguards.

5. Opting out

If you receive messages sent through EduBulk and do not want them, go to edubulksms.eduscapesystems.com/o and enter your phone number, or reply STOP where a reply option is offered, or tell the sending organisation. We then stop messages from organisations that have texted that number. We keep the number on a suppression list so it is not messaged again, even if the organisation re-uploads it.

6. How long we keep data

Account data is kept while the account is active and for a reasonable period afterwards for legal and accounting purposes. Message logs are kept [e.g. 12 months] to provide reports and resolve disputes. Opt-out records are kept so that suppression continues to work. Customers can ask us to delete contacts and messages when they close an account.

7. Security

We use encrypted connections (HTTPS), hashed passwords, access controls between customer accounts and limited staff access. No system is perfectly secure; if a breach affecting your data occurs we will notify affected customers and the regulator as the law requires.

8. Your rights

You may ask to access, correct or delete your personal data, object to its processing, or complain to the Personal Data Protection Office of Uganda. For data held on behalf of an organisation, we will pass your request to that organisation or help it respond.

9. Cookies

We use only a strictly necessary session cookie to keep you signed in and protect forms. We do not use advertising cookies. Pages load fonts from Google Fonts, which may receive your IP address.

10. Children

The service is for organisations, not children. Schools that upload parents' or pupils' details are responsible for having the right to do so.

11. Changes and contact

We will post changes here. Questions or requests: [privacy@eduscapesystems.com — physical address]