Privacy Policy
The short version:
- Schools use ShuleTop to keep records about their learners, parents and guardians, and staff. The school decides what is recorded and who can see it. We look after the records for the school.
- We use the information only to run ShuleTop for the school. We do not sell it, and we do not use it for advertising.
- We share it only with the companies that host ShuleTop and deliver its SMS, and with authorities when the law requires it.
- If you are a parent, learner or staff member and want to see, correct or delete your information, start with your school. We will help the school do it.
1. Who we are
1.1ShuleTop is a school management system owned and run by Flovo Digital Solutions, a business registered in Kenya (Business Registration No. BN-P7SAQZLP), Ground Floor, Room 2, Dere Building, Katoloni Road, Machakos, P.O. Box 375-90100, Machakos, Kenya. "ShuleTop", "we", "us" and "our" in this policy mean Flovo Digital Solutions.
1.2This policy explains what personal information ShuleTop holds, why, who can see it, how long we keep it, and the rights you have under Kenya’s Data Protection Act, 2019. It applies to the ShuleTop web app at shuletop.com, the ShuleTop Android app, and our public website pages.
2. Schools are in charge of their records
2.1Most of the information in ShuleTop is put there by a school: its learners, their parents and guardians, its staff, marks, attendance, fees and messages. For that information the school is the data controller. It decides what to record, why, and who in the school can see it. ShuleTop is the data processor: we store and process the information on the school’s behalf and on its instructions, under the data processing terms in our Terms of Service.
2.2We are the data controller for a smaller set of information: the details of the people who sign a school up and pay for ShuleTop, our billing records, the messages we send to schools ourselves, technical information we need to keep ShuleTop secure, and information about visitors to our public website.
2.3If you are a parent, guardian, learner or member of staff, your school is usually the right first contact for questions about your information. You can also contact us, and we will pass your request to your school and help it respond.
3. Information we hold
What is held about you depends on your school and on how you use ShuleTop. A school may not use every field listed here.
| About | Information | Where it comes from |
|---|---|---|
| Learners | Name, admission number, gender, date of birth, class and stream, admission date, UPI (NEMIS) number, assessment number, previous school, boarding or day status, medical notes, parent or guardian details, attendance, marks, grades, report forms and remarks, transcripts and leaving certificates, fee invoices, payments and balances, transport route, and the date and reason a learner left the school. | The school |
| Parents and guardians | Name, phone number, relationship to the learner, national ID number (if the school records it), which learners they are linked to, and their sign-in activity if they use a parent login. | The school, and the parent when activating a login |
| Staff and teachers | Name, phone number, email address, role, gender, date of birth, national ID number, TSC number, qualifications, date employment started, next of kin name and contact, subjects and classes taught, timetable, attendance with sign-in and sign-out times, and payroll details (salary, allowances, deductions and payslips). | The school, and the staff member when activating a login |
| Sign-in details | Phone number or username, role, school, password (stored only in scrambled, hashed form that cannot be read back), and one-time codes sent by SMS to confirm a phone number or reset a password. | You and your school |
| Messages | The text of SMS sent through ShuleTop, the phone numbers they were sent to, who sent them, when, and whether each was sent or failed. | The school |
| School and billing | School name, code, category, logo and contact details; the name and phone number of the person who signed the school up; invoices and payments to ShuleTop; and requests for SMS credits, including the payment confirmation message the school pastes in. | The school |
| Technical | IP address, browser and device type, sign-in times, pages and features used, and error reports, recorded by our hosting providers and by ShuleTop to keep the service working and secure. | Your device |
| Website visitors | Standard request logs (IP address, browser, page and time) kept by our website host. Our public pages do not use advertising or tracking cookies. | Your device |
4. Sensitive information and children
4.1Some information in ShuleTop is sensitive under the Data Protection Act, such as learners’ medical notes, and some needs extra care, such as national ID numbers, UPI numbers and payroll details. Schools should record such information only where it is needed, for example a medical note that teachers on duty must know about. Access to records in ShuleTop is limited by role.
4.2Most learners in ShuleTop are under 18. Their information is recorded by their school as part of running the school. Under the Data Protection Act, the school is responsible for having a lawful basis for this and, where the law requires it, the consent of a parent or guardian.
4.3A school may give learners their own login so they can see their published results. Learners use ShuleTop as part of school life and under their school’s supervision. We do not market anything to learners, and we do not use learners’ information to build profiles for advertising or any purpose other than providing ShuleTop to their school.
5. How we use information
We use personal information to:
- provide ShuleTop’s features to the school: records, exams and report forms, attendance, timetables, fees and finance, and parent and teacher logins;
- deliver the SMS the school chooses to send, such as results, fee reminders and announcements, and send automatic SMS that are part of the service, such as one-time codes and notices to teachers when their published timetable changes;
- confirm identities when people sign up, activate a login or reset a password;
- provide support, fix problems and answer questions;
- keep ShuleTop secure, detect misuse, and keep each school’s information separate from every other school’s;
- bill schools, process SMS credit purchases and keep our own accounts;
- understand how ShuleTop is used, using combined and anonymised statistics, so we can improve it; and
- meet our legal obligations and protect our legal rights.
5.1We do not sell personal information, rent it out, or use it for advertising.
6. Our legal grounds
6.1Where we process information for a school, we do so on the school’s instructions and under our contract with it. The school relies on its own lawful grounds, such as running the school, its legal duties, its legitimate interests and, where needed, consent.
6.2Where we are the controller, we rely on: our contract with the school (to provide and bill for ShuleTop); our legitimate interests in keeping ShuleTop secure, supporting schools and improving the service, which we balance against your rights; our legal obligations, for example for tax records; and your consent where the law requires it, for example for optional product news (see section 13).
7. Automatic calculations
7.1ShuleTop calculates grades, points, averages, positions and deviations from the marks a school enters and the grading scale it chooses. It writes class teacher and principal remarks on report forms from each learner’s performance, and builds timetables from the rules a school enters. These are tools for the school. The school checks and publishes results, and it makes any decision about a learner. ShuleTop does not on its own make decisions that have legal or similarly significant effects on anyone.
8. Who can see information
8.1Within the school. Each person sees what their role allows. For example, a teacher sees their classes and subjects; finance records are limited to the staff the administrator allows; a parent sees only their own children’s information and results the school has published; and a learner sees only their own published results.
8.2Our service providers. We use a small number of trusted technology companies to run ShuleTop. They act on our instructions, under contracts that require them to protect the information:
- Cloud database provider: database, sign-in and secure storage. This is where ShuleTop’s records are kept.
- Website hosting provider: hosts the ShuleTop website and app and runs some of its server functions.
- SMS delivery provider: delivers SMS to phone numbers. It receives the phone number and the text of each message.
8.3ShuleTop staff. Only authorised staff can access school records, and only when needed to support a school, investigate a problem or keep ShuleTop secure. When our support staff sign in to a school’s account to help it, the access is recorded in an audit log. Our staff must keep the information confidential.
8.4Authorities. We disclose information to the police, courts, regulators or other authorities only when the law requires it or a valid legal order compels it. Unless the law forbids it, we tell the school first.
8.5If ShuleTop changes hands. If our business is transferred to another owner, school records would move with it under the same protections, and we would tell schools in advance.
9. How we keep information safe
- Each school’s records are separated at the database level, so one school’s login can never read another school’s records.
- Access by role limits what each person can see and change inside a school.
- Passwords are never stored in readable form, and new accounts and password resets are confirmed with a one-time SMS code sent to the account’s phone number.
- All traffic is encrypted (HTTPS), and stored data is encrypted by our database provider.
- Support access is logged, and our own administrative actions are recorded in an audit log.
- Deleted exams can be restored for 30 days, which protects schools from accidental deletion.
9.1No system is completely secure. If a breach affects personal information, we will tell the affected schools without delay, help them respond, and notify the authorities where the law requires.
10. How long we keep information
10.1We keep a school’s records for as long as its account is active, so the school can keep using its history: past results, report forms, fee statements and attendance.
10.2Within an active account, the school decides what to keep. For example, it can archive learners who have left, or ask us to delete particular records.
10.3If a school asks us to close its account, we delete the account and its records within 30 days of confirming the request. If an account is restricted for unpaid fees, we keep its records for 90 days and then delete them after a final notice.
10.4Copies in our providers’ routine backups are overwritten in the normal course of their backup cycles. We keep billing records for as long as tax law requires. Anonymised statistics, which identify no one, may be kept longer.
11. Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your information is used (this policy does that);
- see the information held about you;
- have it corrected if it is wrong or misleading;
- have it deleted where it is no longer needed or is held unlawfully;
- object to some uses of it, or ask for its use to be restricted; and
- receive a copy in a common format, or have it sent to another service, where this applies.
11.1Because your school controls its records, please make your request to your school first. A school administrator can correct most records directly and can export many of them. You can also write to us at privacy@shuletop.com. We will check your identity, work with your school, and respond within the time the law allows.
11.2Parents and guardians can make these requests on behalf of their children.
11.3If you are unhappy with how your information has been handled, please tell us so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
12. Cookies and storage on your device
12.1When you sign in, ShuleTop stores a sign-in token in your browser so that you stay signed in. It also saves copies of the app’s screens on your device so that ShuleTop loads faster and pages you have opened can still be viewed without a connection. Signing out removes your sign-in token. These are needed for ShuleTop to work, and we do not use them to track you.
12.2ShuleTop and our public pages do not use advertising cookies or third-party tracking.
12.3On a shared computer, always sign out when you finish.
13. Messages from us
13.1We send school administrators messages about their account, such as security notices, one-time codes, billing reminders and important changes to ShuleTop. These are part of the service.
13.2We may also send school administrators occasional news about ShuleTop features and offers. You can stop these at any time by replying STOP or by emailing support@shuletop.com. We never send marketing to parents, guardians or learners.
14. Changes to this policy
14.1We update this policy when ShuleTop or the law changes. The date at the top shows the latest version. If a change significantly affects how we use personal information, we will tell school administrators before it takes effect.
15. Contact us
Flovo Digital Solutions (trading as ShuleTop)
Business Registration No. BN-P7SAQZLP
Ground Floor, Room 2, Dere Building, Katoloni Road, Machakos
P.O. Box 375-90100, Machakos, Kenya
Support: support@shuletop.com · Privacy and data requests: privacy@shuletop.com
To ask for a school’s account and data to be deleted, see Account & Data Deletion.