Privacy Policy

1. Our Privacy Commitment

Africa School Management System (“ASMS”) is a school management platform designed to help educational institutions manage their academic, administrative, financial, communication, operational, and related activities.

Schools entrust ASMS with information that may include student records, parent and guardian information, employee records, academic results, attendance, financial information, payroll information, communications, and other sensitive institutional information.

We recognise that this trust carries a significant responsibility.

Our core privacy commitment is simple:

ASMS does not use a school’s data as our own data.

We do not sell School Data, rent it, use it for advertising profiles, commercially exploit it, or access it merely because it is stored on our platform.

We process School Data only as necessary to provide, secure, maintain, support, and improve the services the school has chosen to use, as authorised by the school, or where required by applicable law.

Privacy and confidentiality are fundamental principles of the ASMS platform.

2. Who We Are

ASMS is a Software-as-a-Service platform operated by RSEB TECH and developed for educational institutions.

Website: https://asms.africa

Privacy and support enquiries: support@asms.africa

For purposes of this Policy, “ASMS”, “we”, “us”, and “our” refer to the operator of the ASMS platform.

3. Our Role and the School's Role

The role ASMS plays depends on the information being processed.

3.1 School Data

For personal information that a school, its administrators, teachers, employees, parents, students, or authorised representatives place within ASMS for school operations, the school generally determines:

• what information is collected;

• why it is collected;

• who may access it;

• how it is used within the school;

• which ASMS features are enabled;

• how long school records should be maintained, subject to applicable laws; and

• when information should be corrected, exported, archived, or deleted.

For this information, the school normally acts as the Data Controller, and ASMS acts as a Data Processor or service provider acting on the school's instructions.

ASMS will not independently change the purpose for which School Data was provided.

3.2 Information ASMS Controls Directly

ASMS may act as a Data Controller for information required to operate our own business and service, including:

• school subscription and registration information;

• account information for school owners and platform administrators;

• ASMS billing records;

• enquiries and support requests;

• website interactions;

• security, authentication, audit, and operational logs;

• communications between ASMS and subscribing organisations; and

• information necessary to meet legal, regulatory, fraud-prevention, or security obligations.

4. School Data Remains Under School Control

ASMS does not claim ownership of School Data uploaded, created, or maintained by a subscribing school.

As between ASMS and the subscribing institution, the school retains its rights and control over its institutional data, subject to the rights of individual data subjects and applicable law.

A school's use of ASMS does not grant ASMS the right to:

• sell School Data;

• rent School Data;

• disclose School Data to advertisers;

• build advertising profiles from School Data;

• market third-party products to students using School Data;

• independently contact students or parents for unrelated commercial purposes;

• combine one school's identifiable data with another school's data for commercial exploitation; or

• use School Data for purposes unrelated to providing or protecting the ASMS service unless separately authorised or legally required.

The fact that ASMS hosts or processes information does not make that information available for unrestricted ASMS use.

5. Isolation Between Schools

ASMS is a multi-school platform.

Information belonging to one school is intended to remain logically separated from information belonging to other schools.

Users are granted access according to their school, branch, role, relationship, and authorised permissions.

A school does not receive access to another school's private records merely because both schools use ASMS.

ASMS maintains technical and organisational safeguards intended to prevent unauthorised cross-school access.

Where a school operates multiple branches, access between branches is controlled according to the school's authorised roles, permissions, and platform configuration.

6. Categories of Information Processed

Depending on the features a school chooses to use, ASMS may process the following information.

Student Information

This may include:

• student names and identification information;

• dates of birth and other profile information;

• photographs;

• admission and enrolment information;

• class and programme information;

• attendance;

• assessment and examination results;

• academic reports;

• behaviour or disciplinary information;

• awards and achievements;

• extracurricular activities;

• transportation information;

• authorised pickup information;

• emergency information;

• relevant health or medical information entered by the school;

• financial obligations and payment history; and

• historical school records.

Parent and Guardian Information

This may include:

• name;

• telephone number;

• email address;

• address;

• relationship to a student;

• linked children or wards;

• emergency contact details;

• communication history; and

• information required to provide parent or guardian access to authorised records.

Employee Information

Depending on modules enabled by the school, this may include:

• identification and contact information;

• employment records;

• qualifications;

• role and department information;

• attendance;

• leave information;

• payroll information;

• salary assignments;

• statutory payroll information;

• performance-related information; and

• other employment records maintained by the school.

Academic and Operational Information

This may include:

• curriculum information;

• assessments;

• examinations;

• timetables;

• teaching activities;

• attendance;

• school events;

• announcements;

• polls;

• inventory;

• purchases;

• transportation;

• hostel information; and

• other information generated through enabled school-management modules.

Financial Information

This may include:

• fee bills;

• invoices;

• receipts;

• payment references;

• scholarships and discounts;

• additional charges;

• transaction histories;

• payroll records; and

• subscription information.

ASMS does not intentionally store complete debit or credit card credentials when transactions are processed by external payment providers.

Technical and Security Information

We may process:

• IP addresses;

• device and browser information;

• login activity;

• session information;

• authentication information;

• security events;

• application logs;

• error information; and

• activity necessary to investigate fraud, abuse, security incidents, or service problems.

Passwords are not intended to be stored in readable form. Authentication credentials are protected using appropriate password-hashing mechanisms.

7. Why We Process School Data

We process School Data only for legitimate platform and school-service purposes, including to:

• provide ASMS functionality requested by the school;

• authenticate and authorise users;

• manage admissions and student records;

• provide academic and examination functions;

• calculate or display attendance;

• provide parent and student portals;

• process fees and school financial records;

• provide payroll and employee-management functionality;

• provide communications and notifications;

• provide reporting and exports;

• operate enabled transportation, inventory, curriculum, event, and other modules;

• maintain historical records where appropriate;

• provide customer support;

• troubleshoot technical problems;

• prevent fraud and abuse;

• maintain backups and disaster-recovery capabilities;

• secure the platform;

• comply with applicable law; and

• maintain the reliability and integrity of the service.

We do not treat access to School Data as permission to use that information for unrelated purposes.

8. ASMS Personnel Access to School Data

ASMS employees, contractors, administrators, or authorised technical personnel do not receive unrestricted permission to browse School Data.

Access to identifiable School Data by ASMS personnel should occur only where reasonably necessary for purposes such as:

• responding to an authorised support request;

• diagnosing a technical failure;

• investigating a security incident;

• restoring or protecting platform availability;

• performing authorised maintenance;

• investigating suspected misuse or fraud; or

• complying with a valid legal obligation.

Administrative access is restricted to authorised personnel based on operational need.

Personnel who are authorised to access such information are expected to maintain its confidentiality.

ASMS will not permit employees or contractors to access school records for personal curiosity, unrelated commercial purposes, or other unauthorised reasons.

9. Artificial Intelligence and Automated Features

ASMS may provide optional or automated features that use artificial intelligence where AI provides a genuine benefit to the school.

School Data will not be used by ASMS to train a general-purpose artificial intelligence model for unrelated purposes.

Where an ASMS feature uses an external AI service:

• data should be sent only when reasonably necessary for the enabled feature;

• ASMS will seek to minimise the information transmitted;

• an entire school database will not intentionally be provided where limited relevant context is sufficient;

• AI processing will be connected to an ASMS feature or purpose rather than unrelated model development;

• access remains subject to applicable security and confidentiality controls; and

• material third-party AI service providers may be identified through ASMS's subprocessor information.

ASMS will not introduce an AI feature that materially changes how sensitive personal information is processed without considering the privacy and data-protection implications of that change.

Where appropriate, schools may be provided with configuration or activation controls for AI-assisted functionality.

AI-generated information should not automatically replace the judgement of authorised school personnel in decisions having significant academic, disciplinary, financial, employment, or welfare consequences.

10. We Do Not Sell or Advertise Using School Data

ASMS does not sell personal information contained in School Data.

ASMS does not provide student profiles, parent information, employee information, academic records, attendance information, financial information, or other private school records to advertising companies for behavioural advertising.

If ASMS provides advertising, promotion, partnership, school-reward, or marketplace functionality, participation in such functionality does not authorise advertisers or other schools to obtain private School Data unless the relevant school has expressly authorised the disclosure and the disclosure is lawful.

11. Service Providers and Subprocessors

ASMS relies on selected third-party providers to operate parts of the service.

These may include providers of:

• cloud infrastructure and hosting;

• data storage and backup;

• email delivery;

• SMS or communication delivery;

• payment processing;

• security and monitoring;

• customer support infrastructure; and

• artificial intelligence services where an AI-enabled feature is used.

A service provider does not receive the right to use School Data simply because it provides infrastructure to ASMS.

ASMS seeks to provide third parties only with information reasonably necessary to perform the relevant service and expects providers handling personal information on our behalf to apply appropriate privacy, confidentiality, and security protections.

ASMS may maintain a separate Subprocessor List identifying material service providers, their purpose, and relevant processing locations.

12. International Processing and Data Transfers

Some infrastructure or service providers used by ASMS may operate outside Ghana.

As a result, certain information may be stored in or processed from another country.

Where personal information is transferred internationally, ASMS will take reasonable steps to ensure that such processing is subject to appropriate contractual, organisational, or technical safeguards and is carried out consistently with applicable data-protection requirements.

Schools may contact ASMS for additional information regarding material hosting locations or subprocessors relevant to their service.

13. Information Security

ASMS uses technical and organisational measures designed to protect information against:

• unauthorised access;

• accidental loss;

• unlawful disclosure;

• inappropriate modification;

• destruction;

• cross-school access;

• credential abuse; and

• other reasonably foreseeable security risks.

Depending on the system or information involved, safeguards may include:

• encrypted network connections;

• password hashing;

• role-based access controls;

• school and branch access boundaries;

• authentication controls;

• security and activity logging;

• infrastructure access restrictions;

• backups;

• operational monitoring;

• application-level authorisation controls;

• server and network safeguards; and

• ongoing testing and remediation of identified security weaknesses.

No internet-connected system can guarantee absolute security. ASMS therefore treats security as an ongoing process rather than a one-time feature.

14. Backups

ASMS maintains backups and recovery mechanisms for service continuity and protection against accidental data loss.

Backup copies are used for legitimate continuity, recovery, security, and disaster-recovery purposes.

Backup information is not intended to become a separate source for unrelated processing.

Because backups operate on recovery cycles, information deleted from the active platform may remain within protected backup copies for a limited period until those copies expire or are overwritten according to the applicable backup-retention process.

15. Payments

Payments may be processed through authorised third-party payment providers.

ASMS may receive and retain information necessary to reconcile a payment, such as:

• transaction references;

• payment status;

• amount;

• payer-related information;

• provider response information; and

• settlement or reconciliation records.

ASMS does not require possession of complete card credentials where those credentials can be handled directly by the authorised payment provider.

Payment providers process information according to their own legal and regulatory obligations and privacy terms.

16. Children's and Student Information

ASMS is designed for use by educational institutions and therefore processes information relating to children and students as part of providing school services.

ASMS does not independently solicit children's personal information for advertising or unrelated commercial profiling.

The subscribing school is responsible for ensuring that its collection and use of student information through ASMS has an appropriate legal basis and that any notices, permissions, consents, parental authorisations, or institutional approvals required by applicable law are obtained.

ASMS processes this information on behalf of the school and according to the authorised functions of the platform.

We recognise that student information deserves a particularly high level of confidentiality and care.

17. Student Transfers and Historical Records

Where ASMS supports transfers between schools, the platform may preserve appropriate historical records so that previous academic, financial, or institutional history remains attributable to the school at which it was originally created.

A student's transfer does not automatically give a new school unrestricted access to confidential information belonging to a previous institution.

Historical access is subject to authorised relationships, legitimate educational or record-keeping purposes, platform controls, and applicable law.

18. Data Accuracy and Correction

Schools and authorised users are responsible for maintaining the accuracy of information entered into ASMS.

Where supported by a user's permissions, records may be corrected or updated through the platform.

Individuals seeking correction of School Data should normally contact the school responsible for that information.

ASMS will reasonably assist a subscribing school where technical assistance is required to respond to a valid data-protection request.

19. Data Retention

ASMS does not intend to retain identifiable personal information indefinitely without a legitimate reason.

School Data is generally retained while necessary to provide the service, maintain authorised historical school records, meet the school's configured or instructed retention requirements, comply with applicable law, resolve disputes, maintain financial or audit records, or protect legitimate security interests.

Different categories of information may require different retention periods.

Where information no longer needs to remain identifiable, ASMS may delete it or, where appropriate, anonymise it so that it can no longer reasonably identify an individual.

ASMS may publish or provide additional retention information for particular services or categories of records.

20. When a School Leaves ASMS

Ending a subscription does not transfer ownership or unrestricted control of the school's information to ASMS.

Subject to contractual, technical, legal, security, and financial-record requirements, ASMS will provide a reasonable mechanism or process for an authorised school to obtain appropriate exports of its School Data.

Following termination and any applicable transition or retention period, School Data that ASMS is no longer required or authorised to retain will be scheduled for deletion or anonymisation.

Certain limited information may need to be retained where required for:

• financial and accounting obligations;

• fraud prevention;

• legal claims;

• audit requirements;

• security records; or

• other obligations imposed by law.

Residual copies may temporarily remain in protected backups until the applicable backup-retention cycle expires.

Termination of service is not permission for ASMS to repurpose a former school's database.

21. Disclosure of Information

ASMS may disclose personal information only in limited circumstances, including:

• where instructed or authorised by the responsible school;

• where necessary to provide an ASMS service through an authorised service provider;

• where the individual has lawfully authorised the disclosure;

• where necessary to investigate fraud or protect platform security;

• where necessary to protect legal rights or safety; or

• where required by applicable law or a valid legal process.

ASMS will not voluntarily disclose an entire school's database merely because a third party requests it.

Where legally permitted and reasonably practicable, requests concerning School Data should be directed to or communicated to the responsible school.

ASMS will assess legal demands for information and will seek to limit disclosures to information that is legally required.

22. Data Subject Rights

Subject to applicable law, individuals may have rights concerning their personal information, including rights to:

• be informed about processing;

• request access to personal information;

• request correction of inaccurate information;

• object to certain processing;

• request restriction or cessation of certain processing; and

• seek other remedies provided by applicable data-protection law.

Where a school is the Data Controller, requests relating to School Data should generally be submitted to that school.

ASMS will reasonably assist schools in responding to legitimate requests where our assistance is required because the information is processed through ASMS.

Requests relating to information controlled directly by ASMS may be submitted to support@asms.africa.

We may request reasonable verification before providing information or taking action in order to prevent unauthorised access.

23. Security Incidents and Personal Data Breaches

ASMS maintains processes for identifying, investigating, containing, and responding to security incidents.

If ASMS becomes aware of a personal-data breach involving School Data, we will investigate the incident and take reasonable measures to contain and remediate it.

Where notification to a subscribing school, regulator, affected individual, or other party is required by applicable law or contractual obligations, ASMS will provide the required notification without unreasonable delay and provide information reasonably available to us concerning the nature and impact of the incident.

ASMS may also provide affected schools with reasonable assistance necessary to fulfil their own legal obligations arising from the incident.

24. Analytics and Platform Improvement

ASMS may analyse technical and operational information necessary to understand platform performance, reliability, adoption, security, and service quality.

Where possible and appropriate, information used for broader platform analysis should be aggregated or de-identified.

ASMS will not treat “improving the platform” as unrestricted permission to inspect identifiable student, parent, employee, academic, payroll, or financial records.

Identifiable School Data will not be commercially profiled for purposes unrelated to providing the ASMS service.

25. Cookies and Website Technologies

The ASMS public website and platform may use cookies, sessions, and similar technologies necessary for:

• authentication;

• security;

• remembering user preferences;

• maintaining sessions;

• preventing abuse; and

• understanding technical website performance.

Where non-essential tracking technologies are introduced, ASMS will provide appropriate notice or controls where required by applicable law.

26. Changes to This Privacy Policy

ASMS may update this Privacy Policy as the platform, applicable law, or our processing activities change.

We will update the version number and effective or last-updated date when material changes are made.

Where a change materially expands the purposes for which School Data is processed, ASMS will not rely solely on a silent privacy-policy update where additional notification, agreement, or authorisation is reasonably required.

27. Data Processing Agreements

Schools requiring additional contractual privacy assurances may request a Data Processing Agreement (DPA) governing ASMS's processing of School Data.

A DPA may address matters including:

• the controller and processor relationship;

• confidentiality;

• processing instructions;

• security obligations;

• subprocessors;

• international processing;

• data-subject requests;

• incident notification;

• data return and deletion;

• audits and compliance information; and

• termination of processing.

Where there is a conflict between this general Privacy Policy and a separately executed Data Processing Agreement applicable to a subscribing school, the applicable contractual terms will govern to the extent stated in that agreement.

28. Ghana Data Protection

ASMS is committed to processing personal information consistently with the Data Protection Act, 2012 (Act 843) of Ghana and applicable requirements of the Data Protection Commission.

Our privacy programme is guided by principles including:

• accountability;

• lawfulness of processing;

• specification of purpose;

• compatibility with the purpose of collection;

• data quality;

• openness;

• security safeguards; and

• participation and rights of data subjects.

Where ASMS operates in additional jurisdictions, other applicable privacy and data-protection requirements may also apply.

29. Contact Us

Questions, concerns, complaints, or requests regarding privacy or the handling of personal information may be submitted to:

Africa School Management System (ASMS)
Operated by RSEB TECH

Email: support@asms.africa
Website: https://asms.africa

For School Data, individuals are encouraged to contact the educational institution responsible for their records first, since that institution normally determines how the information is used.

ASMS will cooperate with subscribing schools in addressing legitimate privacy and data-protection concerns.

Our Promise to Schools

A school should not have to surrender control of its institutional information simply because it chooses cloud software.

ASMS is built on the principle that technology should help schools manage their information — not exploit it.

We will continue developing ASMS around privacy, security, institutional control, transparency, and responsible use of educational data.