Privacy Policy

1 Who We Are

Westrand Private School operates this mobile application ("the App") to provide school management services to students, parents, teachers, and administrators enrolled with the school.

For the purposes of data protection law, Westrand Private School is the data controller responsible for your personal information.

2 Information We Collect

We collect only the information necessary to operate the school management platform:

Account & Profile Data

• Full name, role (student / parent / teacher / admin)
• Email address and phone number
• Profile photo (optional, if uploaded)
• Encrypted password

Academic Data

• Class enrolment, grades, exam results, and attendance records
• Assignment submissions and teacher feedback

Communication Data

• In-app messages between authorised users
• Push-notification tokens (to deliver notifications to your device)

Device & Usage Data

• Device model, operating system version, and app version
• IP address and approximate location (country/city) for security logging
• Crash reports and performance metrics

Files & Media

• Documents, images, or PDFs you upload (e.g., assignments, profile photos)

3 How We Use Your Information

We use the data we collect to:

• Create and manage your account and provide access to school features
• Record and display academic results, attendance, and timetables
• Send push notifications about results, events, and school notices
• Enable communication between teachers, students, and parents
• Generate attendance and academic reports for authorised staff
• Keep the platform secure and monitor for fraudulent activity
• Comply with legal obligations

4 Data Sharing & Disclosure

We do not sell or rent your personal information. We may share it in these limited circumstances:

Within the School — Teachers can see the class lists and results of their enrolled students. Admins can see all school records for management purposes. Parents can see only their own child's data.

Service Providers — We use trusted third-party providers to host our servers and send push notifications. These processors handle data strictly on our behalf and under written data-processing agreements.

Legal Requirements — We may disclose data if required by law, court order, or to protect the safety of individuals.

Business Transfer — In the event of a merger or acquisition, your data may be transferred, subject to the same privacy protections.

5 Data Retention

We retain personal data for as long as your account is active and for a period afterward to comply with legal, accounting, or reporting requirements. Typical retention periods are:

• Active accounts: Data is kept for the duration of enrolment plus 3 years
• Academic records: Up to 7 years after leaving the school (legal requirement)
• Push-notification tokens: Deleted when you uninstall the app or revoke permission
• Log/security data: 90 days

You may request early deletion — see Your Rights or visit our Data Deletion page.

6 Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request that we delete your account and associated data
• Objection — Object to processing based on legitimate interests
• Portability — Receive your data in a machine-readable format
• Withdraw Consent — Withdraw consent where processing is consent-based

We will respond to verified requests within 30 days. Some data may be retained where we have a lawful obligation to do so.

7 Data Security

We implement the following measures to protect your data:

• All data transmitted between the app and our servers is encrypted using HTTPS/TLS
• Passwords are stored using strong one-way hashing algorithms (never in plain text)
• Authentication tokens (JWT) are short-lived and scoped by role
• Database access is restricted to authorised backend services only
• Regular backups are performed and stored securely

No system is 100% secure. If you suspect your account has been compromised, please contact us immediately.

8 Children's Privacy

The App is used by students of all ages, including children under 13. We collect student data only with the school acting as the authorised institution in loco parentis and, where required, with parental consent obtained through the school enrolment process.

Parents or guardians may contact us at any time to review, correct, or request deletion of their child's data.

We do not permit under-18 users to make public posts or share personal contact information within the App.

9 Third-Party Services

The App may use the following third-party services, each with their own privacy policies:

• Expo / React Native — Mobile app framework (Expo Inc.)
• Firebase Cloud Messaging (FCM) — Push notifications (Google LLC)
• Device media libraries — For saving reports / files to your device

We are not responsible for the privacy practices of these external services.

10 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will:

• Update the "Last updated" date at the top of this page
• Send an in-app notification for material changes

Continued use of the App after changes are made constitutes acceptance of the revised policy.