Privacy Policy

1. Who is responsible for your data

Ghana’s Data Protection Act, 2012 (Act 843) distinguishes between a data controller (who decides why and how personal data is processed) and a data processor (who processes it on the controller’s behalf). Two different arrangements apply to Sukuufie:

Pupil, guardian and staff records: the school is the controller

When a school uses Sukuufie to keep its register, mark attendance, record assessments, raise fee invoices, or message parents, the school is the data controller. The school decides which pupils, guardians and staff are added, what is recorded about them, who at the school may see it, and which messages are sent. Handitech is the school’s data processor: we store and process that data only on the school’s instructions, as set out in our Terms of Service, and we do not use it for our own purposes.

If you are a parent, guardian, pupil or member of staff and you have a question about your own record, the school holds the answer and should be your first point of contact. We will help the school respond, and we will pass on any request that reaches us directly.

The school’s account and billing: Handitech is the controller

For the information we need to run the service itself — the school’s account, the people who administer it, its subscription and invoices, support conversations, and enquiries made through our website — Handitech is the data controller.

2. The data we handle

As the school’s processor (the school controls this data)

• Pupil records: name, date of birth, gender, class and level, admission and enrolment history, status (active, graduated, archived), and an optional profile photo the school chooses to upload.
• Guardian records: name, relationship to the pupil, mobile number, and whether the guardian has signed in to the parent portal.
• Attendance: daily marks (present, late, absent, exited), corrections, and the alerts sent about them.
• Academic records: assessment scores, grades, teacher and head-teacher remarks, promotion decisions, and generated report cards.
• Fees: fee structures, invoices, discounts and scholarships, payments recorded by the school, online payment references and receipts, and arrears.
• Staff records: name, email, mobile number, role and permissions, class and subject assignments, an optional profile photo, and — where the school turns on staff clock-in — clock-in times, the location reported by the staff member’s device, and the evidence photo taken at clock-in. Sukuufie does not perform facial recognition.
• Messages: the content, recipient and delivery status of SMS and WhatsApp messages the school sends through Sukuufie.
• School settings: academic years and terms, timetable, grading scheme, report-card branding and signatures.

As the controller

• Account data: school name, school code, region and district, the administrator’s name, email and mobile number, sign-in credentials (passwords are stored only as one-way hashes), and one-time codes sent by SMS.
• Subscription and billing data: plan, billing cycle, subscription invoices, SMS bundle purchases, payment references, and — where the school takes online fee payments — the settlement bank or mobile-money account details the school gives us to set up its Paystack sub-account.
• Enquiries and support: the name, school and mobile number given when you request a call back or start a trial, and the content of support conversations by phone, WhatsApp or email.
• Technical data: IP address, browser and device type, sign-in times, and an audit log of significant actions (for example who changed a grade or reversed a payment). This log exists to protect the school’s records and is visible to the school’s administrators.

3. Why we use it

On behalf of the school, we process pupil, guardian and staff data solely to provide the features the school has chosen to use: keeping the register, recording attendance and results, producing report cards and timetables, raising and reconciling fee invoices, and sending messages to guardians. We do not sell this data, use it to build profiles, or use it for advertising.

As the controller, we use account, billing, enquiry and technical data to:

• set up and administer the school’s account and the people who use it;
• bill the school for its subscription and SMS bundles, and collect payment;
• respond to enquiries, onboard new schools, and provide support;
• keep the service secure, detect abuse, and investigate problems;
• send service messages about the school’s account, such as trial reminders, invoices, planned maintenance and changes to these terms;
• understand how the service is used in aggregate so we can improve it; and
• comply with law and enforce our terms.

4. Lawful basis

We process personal data only where the Data Protection Act, 2012 (Act 843) permits it. In practice:

• Performance of a contract — providing the service to the school under our terms, billing for it, and supporting it.
• The school’s instructions — for pupil, guardian and staff data, we act on the school’s documented instructions as its processor. The school is responsible for having a lawful basis for the records it keeps and the messages it sends, which will usually be its legitimate function as an educational institution, its contract with the family, or the consent of the parent or guardian.
• Consent — where we ask for it, for example when a guardian chooses to receive receipts by SMS or a school opts in to optional features. Consent can be withdrawn at any time.
• Legal obligation — keeping financial records, and responding to lawful requests from authorities.
• Legitimate interests — keeping the service secure and reliable, preventing fraud and abuse, and improving it, where those interests are not overridden by the rights of the people concerned.

Handitech is registered, or in the process of registering, with the Data Protection Commission of Ghana as required by Act 843. [Registration details to be confirmed.]

5. SMS and WhatsApp messages

Schools use Sukuufie to send messages to guardians and staff — attendance alerts, fee invoices and reminders, payment receipts, announcements, sign-in codes and the parent-portal link. Each message is sent because the school chose to send it, or configured Sukuufie to send it automatically. The school decides what is sent and to whom.

• Messages are delivered through licensed Ghanaian SMS gateways and, for WhatsApp, through Meta’s WhatsApp Business platform. Those providers receive the recipient’s number and the message text in order to deliver it, and return a delivery status.
• Sign-in codes for the parent portal and password resets are sent by SMS to the number the school holds for you. If you do not recognise a message from a school, contact that school.
• To stop receiving messages from a school, ask the school to update your contact preferences or remove your number. We can help the school do this.
• We meter how many messages each school sends so we can bill for SMS bundles. We do not read messages for any other purpose.

6. Online fee payments

When a guardian pays school fees online through the parent portal, the payment is processed by Paystack, a licensed payment service provider, using mobile money or a bank card. Card numbers, PINs and mobile-money wallet credentials are entered on Paystack’s secure pages and never reach Sukuufie. We receive only what we need to reconcile the payment: a transaction reference, the amount, the payment channel, the payer’s phone number or masked card details as Paystack reports them, and whether the payment succeeded.

Fees paid online are settled directly to the school’s own bank or mobile-money account through a Paystack sub-account that the school sets up with us; Handitech does not hold guardians’ money on the school’s behalf. A small platform fee and Paystack’s own transaction fee are deducted as described in our Terms of Service. Paystack’s handling of payment data is governed by Paystack’s privacy policy.

Schools pay their Sukuufie subscription the same way, through Paystack; the same principles apply.

7. Children’s data

Most pupils whose records are kept in Sukuufie are children. Their data is entered, managed and accessed by the school as data controller, and by parents and guardians through the parent portal. Sukuufie does not collect information directly from children, does not offer pupils their own logins, and does not market to children. Schools are responsible for telling parents and guardians how pupils’ data is used and for obtaining any consent the law requires, and we provide the tools (this policy, the parent portal and data-export features) to help them do so.

Pupil profile photos are optional and are uploaded only if the school chooses to. They are used on the pupil’s record and report card and are not shared with anyone outside the school.

8. Who we share data with

We share personal data only with providers we need in order to run the service (our sub-processors), with the school’s own authorised users, and where the law requires. We never sell it.

Some providers may store data outside Ghana. Where they do, we rely on their contractual commitments to protect it to a standard consistent with Act 843. We will keep the school informed of the current list of sub-processors and give reasonable notice before adding one that will handle pupil data.

We may also disclose data where required by Ghanaian law, a court order, or a lawful request from a public authority, and to professional advisers under a duty of confidence. If Handitech is ever reorganised or sold, the school’s data would transfer with the service under the same commitments, and the school would be told in advance.

9. How long we keep data

• Pupil, guardian and staff records are kept for as long as the school’s account is active. The school controls them throughout and can archive or delete individual records at any time.
• When a school leaves, it can export its data as a set of CSV files before it goes. After the account is closed we keep the school’s data for a limited wind-down period [to be confirmed, e.g. 90 days] so it can be restored if the school comes back or completes its export, and then delete it from live systems. Backups roll off on their own schedule after that.
• Billing records (subscription invoices and payment references) are kept for the period required by Ghanaian tax and company law.
• Audit logs and technical logs are kept for a limited period for security and dispute resolution and then deleted.
• Enquiries that do not become an account are deleted within a reasonable time after we last hear from you.

10. How we protect data

We take the security of school records seriously. Measures in place include:

• encryption of all traffic between your browser or phone and Sukuufie (HTTPS), and encryption of stored data and backups;
• strict separation of each school’s data in the database, enforced at the database layer so one school’s users can never read another school’s records;
• role-based access within a school — teachers see only their assigned classes, bursars only the finance they need — controlled by the school’s administrators;
• passwords stored as salted one-way hashes; SMS one-time codes for password resets and parent sign-in; two-factor authentication for Handitech’s own platform staff;
• an audit trail of sensitive actions, visible to the school;
• rate-limiting and abuse protection on sign-in and public forms;
• daily backups; and
• access to production systems limited to named Handitech staff who need it, under confidentiality obligations.

No system is perfectly secure. If we become aware of a breach affecting a school’s data, we will tell the school without undue delay so it can meet its own obligations, and we will notify the Data Protection Commission where the law requires.

The offline attendance feature stores the day’s register on the teacher’s device until it can sync. Schools should ensure staff protect their devices with a screen lock.

11. Your rights

Under Act 843, you have the right to be told what personal data is held about you, to access it, to have inaccurate data corrected, to object to processing in some circumstances, and to have data deleted where there is no longer a good reason to keep it. You may also complain to the Data Protection Commission of Ghana.

We may need to verify your identity before acting on a request.

12. Cookies and device storage

Sukuufie uses only the cookies and browser storage it needs to work: a sign-in token so you stay signed in, your remembered school code, your interface preferences, and — for the attendance app — a local copy of the day’s register so it works without a connection. We do not use advertising or third-party tracking cookies on the product or on this website.

Our website pages (including this policy) and the Sukuufie app load their typefaces from Google Fonts. To serve them, your browser sends your IP address to Google; we do not receive it, and Google’s own privacy policy governs that request.

13. Changes to this policy

We may update this policy as the service or the law changes. Material changes will be announced to school administrators inside Sukuufie or by email at least 14 days before they take effect, and the effective date at the top of this page will change. Continued use of the service after that date means the updated policy applies.

14. Contact

Questions about this policy, or about how Handitech handles data, can be sent to:

You can also contact the Data Protection Commission of Ghana at dataprotection.org.gh.