EDULIFE OS PRIVACY NOTICE
Version 0.1-UAT
UAT STATUS
This version is published only for controlled EduLife OS user-acceptance testing. It is not intended to govern Production use. The final Production Privacy Notice will be issued after the operator's exact registered particulars, Data Protection Commission status and required compliance review are complete.
1. WHO THIS NOTICE COVERS
This Privacy Notice explains how personal data is handled when people use EduLife OS, including school staff, governance officers, learners, parents or guardians, administrators, support contacts and other authorised users. EduLife OS is operated by Hehxagon Technologies, a private company limited by shares incorporated in Ghana. For this UAT version, the exact registered company name, company registration number and registered office remain subject to verification before Production publication.
2. OUR DATA-PROTECTION ROLE
The legal role depends on the processing context. An education institution or public authority may determine why and how learner, staff, attendance, assessment, appraisal, safeguarding or similar institutional records are used, while Hehxagon Technologies processes those records to provide EduLife OS under the institution's authority and instructions. Hehxagon Technologies may separately determine purposes for account administration, authentication, platform security, service communications, legal acceptance evidence, fraud prevention, billing, support, product operations and compliance. This Notice does not alter responsibilities imposed by applicable law or a specific institutional data-processing agreement.
3. DATA WE MAY PROCESS
Depending on enabled features and the user's role, EduLife OS may process: - identity and account data, such as name, username, email, phone number, account identifiers and authentication/security records; - authority and organisational data, such as school membership, role, tenant, circuit, district, governance assignment, class, subject and responsibility; - learner and guardian data, such as learner identity, class, guardian contact details and authorised relationships; - education and administration records, such as attendance, assessments, results, lesson-note workflow, interventions, reports and school records; - staff and governance records, such as attendance, appraisal, supervisory review, decisions, official notices and workflow history; - health, safeguarding or other sensitive information only where an authorised feature and lawful institutional process require it; - communications data, including service notices, onboarding messages, Essential Alerts choices and delivery evidence; - security and technical data, such as device/browser information, session information, timestamps, IP-related security information where collected, audit logs, error logs and abuse-prevention signals; - support, institutional, billing and transaction information needed to administer the service.
4. SOURCES OF DATA
Data may come from the individual, an authorised institution, a parent or guardian, authorised staff or governance officers, connected service providers, or from records generated when EduLife OS is used. Users and institutions must only provide personal data they are authorised to provide.
5. WHY WE PROCESS DATA
We process personal data as necessary and lawful to: - create and secure accounts and verify authority; - provide school administration, teaching, attendance, assessment, appraisal, reporting, governance and communication features; - maintain tenant, role and jurisdiction boundaries; - deliver support, onboarding, security and transactional communications; - operate optional services such as Essential Alerts after separate activation; - prevent fraud, abuse, unauthorised access and record manipulation; - maintain audit trails, legal acceptance evidence and institutional accountability; - comply with lawful instructions, legal obligations and valid requests; - administer institutional plans, billing and service operations; - maintain, troubleshoot and improve reliability, accessibility and capacity; - create responsible aggregated or de-identified analytics where individuals are not reasonably intended to be identifiable.
6. LAWFUL AUTHORITY
Processing must have a lawful basis under applicable Ghanaian law, including the Data Protection Act, 2012 (Act 843), where applicable. Depending on the context, processing may be based on lawful institutional or public authority, performance of an authorised service relationship, statutory duties, valid consent where consent is required, protection of security and legal rights, or another basis permitted by law. Consent is not treated as the basis where the processing is actually required by another lawful authority, and withdrawal of an optional consent does not automatically invalidate processing required for a different lawful purpose.
7. CHILDREN AND LEARNERS
EduLife OS is designed for education environments and may process children's data under the authority of schools, education authorities and authorised parents or guardians. We expect institutions to collect and use learner data only where lawful, necessary and proportionate. We do not sell children's personal data or use learner records to create advertising profiles. Direct marketing to children is not an intended EduLife OS purpose.
8. SENSITIVE AND SPECIAL PERSONAL DATA
Some features may involve health, safeguarding, disability or other information requiring heightened care. Such data should be collected only where the institution has lawful authority and a genuine operational need. Access should be limited to authorised persons, and additional safeguards, retention rules or impact assessments may apply.
9. ACCOUNT SECURITY, TENANT ISOLATION AND AUDIT
EduLife OS uses access controls, authenticated identities, role and scope checks, tenant boundaries, audit records and other technical and organisational measures designed to protect data. Security and audit information may be retained to investigate incidents, enforce authority, prove legal acceptance, detect abuse and preserve record integrity. No security measure can eliminate every risk.
10. WHO MAY RECEIVE DATA
Personal data may be disclosed only as reasonably necessary to: - the institution or authority responsible for the relevant records; - authorised users acting within their verified scope; - hosting, infrastructure, email, SMS, payment, security, support and other service providers that help operate EduLife OS; - professional advisers, auditors, insurers or prospective transaction advisers under appropriate duties; - regulators, courts, law-enforcement or other authorities where disclosure is lawfully required; - a successor or affiliated entity in a lawful corporate reorganisation, acquisition or transfer, subject to applicable safeguards. We do not sell personal data.
11. SERVICE PROVIDERS AND SUBPROCESSORS
Where third parties process personal data for EduLife OS, we aim to use providers appropriate to the service and to impose relevant confidentiality, security and data-protection obligations through contracts or other lawful arrangements. Providers receive only the access reasonably required for their function.
12. INTERNATIONAL PROCESSING AND CLOUD SERVICES
EduLife OS may use cloud, telecommunications or support infrastructure located outside Ghana. Where personal data is transferred or made accessible internationally, we will seek to use lawful contractual, technical and organisational safeguards appropriate to the transfer and to inform or contract with the responsible institution as required.
13. RETENTION
We retain personal data only for as long as reasonably necessary for the purpose for which it is processed, valid institutional instructions, safeguarding or education requirements, security and audit integrity, dispute handling, financial and legal obligations, and protected backup cycles. Retention periods can differ by record type and institution. When data is no longer required, it should be deleted, anonymised or otherwise handled in accordance with applicable law and valid retention obligations. Immutable legal-acceptance and audit evidence may be retained where necessary to establish rights, authority or compliance.
14. DATA QUALITY
Institutions and users should keep submitted information accurate and up to date. EduLife OS provides correction workflows where appropriate, but some historical audit records must remain preserved so that later changes do not rewrite the past.
15. ESSENTIAL ALERTS
Essential Alerts are separate from general account creation and from acceptance of the Terms of Service. Staff activation requires a separate choice recorded by the Essential Alerts system. Activation is free to the individual staff member. The service is intended for essential work-related notices, not advertising. Declining Essential Alerts does not by itself prevent creation of an otherwise valid EduLife OS account. Where the service permits withdrawal, a user may later withdraw without converting that choice into a marketing preference.
16. EMAIL, SMS AND SERVICE COMMUNICATIONS
We may use email, SMS or in-app notices for security, onboarding, legal, transactional and institutional service communications. Delivery providers may process the minimum contact and message information necessary to deliver those communications. Service communications are not treated as permission for unrelated direct marketing.
17. DIRECT MARKETING
EduLife OS does not treat account creation, acceptance of legal terms, institutional authority or Essential Alerts activation as consent to unrelated direct marketing. Where direct marketing is ever introduced and consent is legally required, it must use a separate lawful choice and provide a way to stop future marketing.
18. COOKIES, SESSIONS AND DEVICE STORAGE
EduLife OS may use cookies or similar browser storage that are necessary for authentication, security, preferences and reliable operation. If non-essential analytics, advertising or similar technologies requiring an additional choice are introduced, they will be handled separately as required by applicable law.
19. AI AND AUTOMATED DECISIONS
AI or automated features may assist with summaries, recommendations, anomaly detection or workflow support. They should not be treated as infallible. Where a decision significantly affects an individual, appropriate human review and the protections required by applicable law should be preserved. Users may contact us or the responsible institution regarding a decision they believe was based improperly on automated processing.
20. DATA-SUBJECT RIGHTS
Subject to applicable law and the role of the responsible controller, individuals may have rights to be informed about processing; request access to personal data; object to or seek prevention of certain processing; request correction of inaccurate data; give or withdraw consent where processing depends on consent; object to direct marketing; seek protection regarding certain solely automated significant decisions; complain about unlawful processing; and seek other remedies available under law. Some rights are subject to lawful exemptions, institutional record duties and the rights of other persons.
21. HOW TO EXERCISE RIGHTS
For EduLife OS privacy enquiries, contact [email protected]. Corporate service enquiries may also be sent to [email protected]. Where an institution is the responsible controller for a school or employment record, we may direct the request to that institution or assist it in responding. We may need to verify identity and authority before releasing, correcting or deleting protected data.
22. COMPLAINTS
Individuals may first raise a privacy concern with EduLife OS or the responsible institution. They may also have the right to complain to Ghana's Data Protection Commission about processing they believe is unlawful or improper. Nothing in this Notice removes a statutory complaint or compensation right.
23. DATA BREACHES AND INCIDENTS
We maintain processes intended to identify, investigate and respond to security incidents. Where a personal-data breach triggers notification or cooperation duties under applicable law or an institutional agreement, we will take the required steps and work with the responsible institution and authorities as appropriate.
24. CHANGES TO THIS NOTICE
A published Privacy Notice version is not rewritten after publication. We may issue a new version prospectively when processing practices, laws, services or organisational details materially change. Where a material change requires a new acknowledgement or consent, EduLife OS will seek it separately.
25. CONTACT
EduLife OS privacy and support: [email protected] Hehxagon Technologies corporate service: [email protected] Current operating location: Suhum, Eastern Region, Ghana. The exact registered office, company registration number and Data Protection Commission particulars will be inserted in the Production notice after verification.