Privacy Policy

1. Who Controls This Data

Each School is the data controller for the student, guardian and staff records it enters into Nexschools. Nexschools acts as a data processor, storing and processing that data on the School's behalf and under its instructions. If you are a parent, student or staff member with questions about your own data, please contact your School directly — they control what is entered into the system.

2. Information We Collect

• Student records — name, date of birth, admission number, class, guardian relationships, academic marks, attendance and disciplinary records.
• Guardian/parent records — name, phone number, email, and relationship to student, used for communication and the parent portal.
• Staff records — name, role, contact details, and payroll information entered by the School.
• Financial records — fee balances, payments, and payment claims submitted through the platform.
• Account & usage data — login activity, IP address, and actions taken within the system, used for security and audit purposes.

3. How Information Is Used

Information is used solely to operate the Nexschools platform for the School: displaying records to authorised staff and parents, sending SMS/email/in-app notifications the School has configured, generating report cards and financial statements, and maintaining an audit trail. We do not sell personal data, and we do not use School data to advertise to third parties.

4. AI Features (Prima)

Where a School enables Prima, our AI assistant, relevant record data (for example, a student's marks when drafting a report comment) may be sent to the AI provider configured for that School in order to generate a response. Schools control whether Prima is enabled and can provide it with instructions. We do not use School data to train AI models.

5. Sharing With Third Parties

We share information only with service providers necessary to operate the platform — for example, SMS gateways for sending text notifications, and AI providers for Prima features — and only to the extent needed to provide those features. We do not sell or rent personal information to anyone.

6. Data Security

We take the security of School data seriously. Access to records is restricted by role and permission within each School, passwords are stored using industry-standard hashing, sensitive credentials (such as API keys) are encrypted at rest, and every School's data is isolated from every other School's data. No system is completely immune to risk, and we continually work to identify and close security gaps.

7. Children's Data

Nexschools is used by schools to manage records belonging to minors. This data is entered and controlled by the School, not collected directly from children by us. Schools are responsible for ensuring they have appropriate authority under applicable law (including parental consent where required) to enter student data into the system.

8. Data Retention

School data is retained for as long as the School's account is active, and for a reasonable period afterward to allow for export or reactivation, unless the School requests earlier deletion or applicable law requires a different retention period.

9. Your Rights

Depending on your role and applicable law (including Uganda's Data Protection and Privacy Act, 2019), you may have the right to access, correct, or request deletion of personal data held about you. Requests should be directed to your School, who can action them directly or ask us to assist.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above.

11. Contact Us

Questions about this policy can be sent to bakewise.inc@gmail.com.