Terms of Service

These terms govern the use of School Tech, the school management platform published by School Tech, and of the website it is served from. They are agreed between us and:

• Any school, college, or other institution that uses the platform, whether it pays for it, is trialling it or has been given access to it.
• Every person who uses it - a member of staff, a head teacher, a bursar, a parent or guardian, a learner, a visitor to the public pages.

By using the platform you accept these terms. If you are doing so for a school, you are confirming that you are authorised to bind it, and both sets of terms apply to you: the ones between us and the school, and the ones that apply to you personally as a user.

An order

The agreement, proposal, subscription, trial or installation record under which a school is given the platform. Where an order and these terms differ, the order prevails for that school. Where an order is silent, these terms fill the gap.

These terms

The rules below. They are the same for every school and every user, and they are published here so that a parent as well as a head teacher can read what the platform runs on.

The privacy policy

The document published beside these terms, which says what data the platform handles and what happens to it. It forms part of the arrangement and is not something that can be varied quietly - it follows the law, and the law is not ours to change.

A school sets its own rules for its own community - uniform, fees policy, discipline, how a parent is expected to behave towards staff. Those are the school's, and nothing here takes the place of them or lets a person ignore them.

The platform

The software, the screens, the reports, the portals and the website, together with the updates we make to them.

The service

The platform as we make it available to a school, including the hosting, support and maintenance that come with it.

A module

A part of the platform that can be switched on or off for a school - admissions, attendance, assessments and reports, fees, payroll, clinic and health, library, laboratory, transport, boarding, shop, security, audit, the public website.

Records

The information a school holds in the platform about learners, families, staff and its own operations.

Content

Anything put into the platform by a school or a user, including its documents, images and the text of a message.

Credentials

A username, email address or phone number together with a password, PIN or code that lets a person in.

Business day

A day other than a Saturday, a Sunday or a public holiday in Uganda.

What a school is given is the platform with the modules the order says are switched on. A school is not entitled to every part of the platform, and the parts that are on for one school may be off for another. We may add modules, change them and withdraw them, provided the platform keeps doing in substance what the order says it does.

These things are not part of the service unless the order says otherwise:

• Internet access, devices, power, airtime and data for the school or for a family.
• The school's own statutory returns, filings and records, although the platform may be the place they are prepared from.
• Printing, postage, courier or the physical delivery of a document.
• Legal, accounting, tax or audit advice. The platform produces records; it does not advise on them.
• Training beyond what the order provides, and the school's own induction of its staff.
• Any charge made by a third party whose service the platform uses - text message credit, a payment provider's fees, a mail relay - which the order will say how it is met.

The agreement is made when an order is accepted, or when the platform is first made available to a school, whichever comes first. It does not have to be signed on paper to take effect.

Under the Electronic Transactions Act, 2011 a record is not denied legal effect, validity or enforceability in Uganda because it was made or kept in electronic form. That runs both ways: the school's entries in the platform are its records, and the platform's own log of when an account was created, when a change was made, from what address and by whom, is the evidence of what happened.

Where a school needs a document to be signed, and the platform records that it was, that record is the school's evidence and ours. Where Ugandan law requires something to be done on paper or before a witness, this clause does not attempt to replace that requirement.

A school is the body that decides what is recorded about its learners, its families and its staff. Under the Data Protection and Privacy Act, 2019 that makes it a data collector, and the duties of a collector stay with it. A school using the platform agrees that it will:

1. Register with the Personal Data Protection Office as a data collector, controller or processor, as the Regulations require, and keep that entry current.
2. Obtain the consent the Act requires before collecting or processing personal data, and obtain the prior consent of a parent, guardian or other person with legal authority before touching a child's data, as section 6 requires.
3. Give families a privacy notice that says what it actually records, rather than what the platform happens to be capable of.
4. Keep its records accurate and up to date, and correct them when it is told they are wrong.
5. Give staff only the roles they need, and remove a role when a person moves on or leaves.
6. Keep its contact details - the head teacher, the bursar, the person who answers data questions, and the email addresses and phone numbers on accounts - current, because the platform reaches people through them.
7. Not record information in the platform that it has no right to hold, and not keep a record beyond the period its own schedule and the law allow.
8. Use the platform only for purposes that are lawful, and only in relation to schools and people it has the standing to administer.

A school is answerable for its own failures on that list, and it is the school that the Personal Data Protection Office will approach about the records a school holds. We are answerable for the platform and for what we do with data on a school's instructions. The privacy policy sets out how the two fit together.

• One account belongs to one person. A credential is not shared, not lent, not handed to a colleague to "just check one thing", and not left signed in on a shared device.
• A password must meet the policy the platform is configured with, and an account may be required to change its password on first use - which is how an invitation cannot leave a known password standing.
• A parent or guardian reaches the family door with a phone number. Keeping that number current is not a formality: it is what lets the right person in and keeps the wrong one out. A number cannot be swapped on a whim: the change is confirmed with a code and cannot be repeated on one account more often than every thirty days.
• A person is responsible for what is done under their credentials until they tell the school or us that they have been compromised. Telling promptly is the whole of the protection, and a delay is the part that causes damage.
• A school may reset, disable or remove an account of somebody in its community, and may do so without notice where it has a reason.
• We may require a change of credentials, or end a session, where we have reason to believe a credential has been exposed.
• An account that has not been used for a long period may be disabled by the school or by us. It is not deleted, and it can be restored.

A learner, a parent and a member of staff each see what their role and their school have been given permission to see, and nothing wider. A learner does not have access to another learner's record. A parent does not have access to a family they are not connected to. A teacher does not have access to payroll. A school that has enabled nothing sees nothing of it.

The public pages are open to anybody. The portal is not: it belongs to the schools that use it and to the people they have given accounts.

In particular, and without limiting anything else in these terms, a person must not:

• Reach, or try to reach, records, accounts or screens that are not theirs, or go beyond what their role allows - including by guessing or reusing another person's credential.
• Alter, delete, fabricate or arrange the alteration of a mark, an attendance record, a fee, a payment, a payroll entry or any other record outside what their role permits.
• Defeat a verification check - by presenting another person's photograph, an image of a screen, a synthetic or edited image, or by sending a phone to a place it is not.
• Turn off, tamper with, or attempt to avoid the audit trail, the rate limits, the lockouts or any other protection built into the platform.
• Upload anything that is not what it is said to be, anything designed to interfere with a system, or anything unlawful, offensive or irrelevant to the school's purposes.
• Harvest, collect, export or re-identify personal data beyond what the person is entitled to, including putting exported records back together with somebody else's.
• Use the platform to send unlawful material, to impersonate a school or a person, or to forge a document the platform produced.
• Interfere with the service, or with another person's use of it.
• Copy, adapt, translate, reverse engineer or build a competing product from the platform, except so far as Ugandan law does not permit such a restriction.

Some of what is on that list is a criminal offence in Uganda. The Computer Misuse Act, Cap. 96, as amended, makes unlawful access to computer data, unlawful disclosure of personal data and unlawful interference with data or a computer system offences, and the Regulation of Interception of Communications Act, Cap. 101 protects communications from interception. A school should understand that a serious incident may have to be reported to the Uganda Police Force, to the Personal Data Protection Office, or to both.

Where we become aware of unacceptable use we may warn, restrict, suspend or end the accounts and access concerned, tell the school, preserve the evidence and, where conduct appears to be criminal, report it. We will not suspend a whole school for the conduct of one person unless there is no other way to stop the harm.

A school keeps ownership of its own records and of the material it supplies - its crest, its report card template, its lists. What a school gives us is a licence to host, copy, transmit, display and otherwise process that material for the purpose of providing the platform, and for nothing else. The licence ends when the material is deleted or destroyed, save to the extent that it survives in a backup that has not yet been pruned.

A school warrants that it is entitled to supply the material, that its staff have the right to enter it, and that it has the consents the Act requires behind it.

We do not read a school's records as a matter of routine. We may access them where it is necessary to provide or restore the service, to respond to a support request, to comply with a legal requirement, or to investigate a suspected breach of these terms; and where we can tell the school that we have had to, we do.

Charges, the currency they are expressed in, and the billing cycle are those in the order. No fee, rate or increase is invented in this document.

• An invoice is payable by the due date stated on it, unless it is disputed in writing before that date. A dispute about part of an invoice does not hold up the part that is not disputed.
• Each party bears its own taxes. Where Ugandan law requires a tax to be charged on a supply - including such value added tax as applies to it - the amount is added to the invoice and is for the school's account, and where the law requires the school to withhold anything from a payment the school accounts for it and gives us the evidence of having done so.
• An amount unpaid after its due date and after the matter is no longer in dispute may be met by charging interest on it at the rate the order allows, and by the costs of recovery the law permits.
• A fee increase takes effect only where it has been notified in writing before the start of the period it applies to.

Persistent non-payment may lead to suspension and then to the end of the arrangement, after written notice and a reasonable chance to put it right. It never leads to our withholding records where doing so would put a learner at risk, obstruct a statutory duty or leave a family unable to establish where their child is.

Some capabilities of the platform depend on somebody else: an email relay, a text messaging gateway, a mobile money provider, a hosting provider, an external password breach check. The privacy policy names each one, says what it receives and says when it is switched on.

Where a third party requires a school to accept its own terms or to pay its own charges, the order says whose arrangement that is. We are responsible for choosing a service provider sensibly, for telling a school when a provider changes in a way that matters to the school's data, and for doing what we can when a provider fails. We are not responsible for the acts or omissions of a third party that neither we nor the school could have controlled - and where a third party's failure means a school cannot be paid or a message cannot be sent, the remedy is that we find another way, not that we pay for a loss we did not cause.

The platform is built to be there through a school day. No figure for uptime is promised here beyond any figure the order promises; the order is where a commitment of that kind belongs, because it is where the price for it belongs too.

• Planned work is scheduled outside peak school hours wherever that is practical, and a school is given notice of it where the work can be foreseen.
• Work that cannot wait - to close a security hole, or to restore service after a failure - is done without waiting for a window.
• Support is reached through the channel stated in the school's order. Response and resolution times are the ones that order sets; where it sets none, support is provided within a reasonable period and a school is told what is happening.
• A school is expected to try the obvious before escalating: that the account has the role it needs, that the term and class are the current ones, that the person is signed in to the school they meant. A school may be asked to have done that before a fault is treated as one.
• A fault that means a learner cannot be accounted for at a gate, at a bus or in a clinic is treated as urgent whatever the queue says, because that is what it is.

Neither party is in breach of these terms, and neither is liable to the other, for a failure or a delay caused by an event that was beyond its reasonable control and that it could not reasonably have foreseen or avoided. That includes:

• fire, flood, storm, earthquake, epidemic or other natural event
• a failure of an electricity supply, of an internet backbone, or of a national communications operator
• industrial action affecting either party or a provider, other than action by the affected party's own staff
• war, civil disturbance, terrorism, or a lawful direction of a Ugandan authority
• the failure of a third-party service that neither party controls

The party affected tells the other, works to limit the effect, and keeps going with whatever it can still do. If the event continues for thirty days or more without a realistic prospect of the service resuming, either party may end the part of the arrangement it affects, without penalty and without prejudice to amounts already due.

We may suspend access to an account, a module or a school's whole installation where it is necessary to:

• comply with the law, or with a direction of the Personal Data Protection Office or another authority
• stop or contain a compromise of the platform or of a school's records
• respond to unacceptable use, or to a credible threat of it
• allow a school to carry out an investigation or a change it has asked for
• meet an obligation we owe another school sharing the installation
• give a school the chance to pay an undisputed amount that has fallen due

A suspension is limited to what the reason requires and lasts no longer than it must. A school is told, unless telling it would defeat the purpose. A suspension is never used in a way that leaves a learner unaccounted for.

As between the parties, a school is the data collector for its own records and we are the person processing them on the school's documented instructions. The privacy policy explains that relationship to the people whose data it concerns; this clause explains it to each other.

• We process a school's records only to provide the platform and only on the school's instructions. We do not sell them, and we do not use them for a purpose the school has not instructed or agreed.
• Where we must process beyond an instruction - to keep the service secure, or because the law requires it - we tell the school, unless we are not permitted to.
• A school instructs us by using the platform as it is configured, and by asking us for something specific. An instruction that would put either of us in breach of the Act will be raised with the school before it is carried out.
• Each party assists the other to answer a data subject's request. Where a request reaches us about a school's records we send it to the school and help it respond, and the thirty-day period in the Regulations runs for the school, not for us.
• We keep the third parties we use under the same duties of confidentiality and security, and we tell a school about a new one where it changes the school's position.
• A school is responsible for the consent, the notice and the registration the Act requires of a collector. We are responsible for registering and for the duties the Act places on a processor, and for our own entry in the Register.

Section 23 of the Act requires immediate notification to the Personal Data Protection Office where there is reasonable belief that personal data may have been accessed or used without authority, and the Regulations set out how that is done.

1. The party that becomes aware tells the other without delay, with what it knows.
2. Whichever of us holds the duty under the Act - collector or processor - notifies the Office immediately, and the other assists with the information the Office asks for.
3. The school informs the affected families where it is the collector, and we inform the school where the incident is in our own infrastructure.
4. Both keep a written record of the incident, the assessment and the remedy: an annual summary of incidents is filed with the Office, and it is drawn from those records.
5. Neither blames the other by public statement before the facts are established.

Each party answers for its own failure to comply with the Act. Nothing in these terms makes one party answerable for the other's contravention, and nothing in them limits what a data subject may do, or what the Office may require.

Each party treats the other's confidential information as its own - a school's records and figures, our pricing, terms, security arrangements and unpublished plans. Information is protected for as long as it stays confidential, and may be used only for the purpose it was given for.

That duty does not apply to information that was already known, that has become public without a breach, that was obtained independently, or that the law or a regulator or a court requires to be disclosed - in which case only the part that must be disclosed goes, and the other party is told first where it is lawful to tell it.

A school may tell its community that it uses the platform and may show a learner's own record to that learner's family: neither is a breach of this clause.

The platform, its code, its design and our name and marks belong to us or to those who have licensed them to us. A school is given the right to use them for the term of the order and for the purposes of running its school; nothing else passes.

The school's records, documents and material remain the school's, as set out above.

Without our written consent a school must not sub-license, rent, resell, host for a third party, or remove or alter a proprietary notice. Identifying itself as a school that uses the platform, and describing what it does with it, is not restricted by this clause.

The platform includes third-party and open source components distributed under their own licences. Those licences prevail for those components, and some of them grant rights that cannot be taken away by these terms - for example to use, copy and modify software that is supplied to you under such a licence.

If a school suggests an improvement, we may use it or not, without obligation and without payment.

The arrangement runs from the date the order takes effect until it ends. It may end:

• by notice on the terms set out in the order, including at the end of a subscription period,
• by either party, where the other is in material breach and has not put it right within thirty days of a written notice saying what the breach is,
• by either party, where an event outside control prevents the service for thirty days or more,
• by a school at any time, by telling us in writing,
• by us, for unacceptable use or non-payment, in accordance with the clauses above.

Before or after the end, a school may take its records out of the platform in the forms the platform offers for export, and we will assist with anything the platform cannot produce on its own. Where the order fixes a period after the end during which records remain available, that period applies. Where it fixes none, records remain available for thirty days after the end date, and are then destroyed.

We do not use a school's records as leverage. Where the law requires a record to be kept, where a school asks for it to be kept, where an investigation or a statutory duty requires it, or where destroying it would leave a child unaccounted for, it stays - whatever the state of the commercial dispute, and whoever is owed what.

On the end we withdraw accounts and access, and a school's own copies of anything already exported are then entirely the school's responsibility. Amounts that have fallen due stay payable, and the clauses on data protection, confidentiality, intellectual property, liability, indemnities, governing law and disputes continue to apply after the end.

We warrant that we will provide the service with reasonable skill and care, that we have the right to supply it, that it will conform in material respects with the description in the order, and that we will not knowingly introduce code intended to damage or disable it.

Beyond that, and to the fullest extent the law allows, no warranty or representation is given. In particular, the platform:

• is not warranted to be uninterrupted or free of error, and is not a substitute for a school's own oversight,
• reports what has been entered into it: it does not warrant that a school's records are accurate,
• is not tailored to any school's particular process unless the order says it has been,
• does not give legal, accounting, tax, medical or safeguarding advice, and does not replace the judgement of a head teacher, a bursar, a clinician or a parent,
• is not an emergency service. A school must keep another way of reaching a family in an emergency, and must not rely on a message in the platform having been seen.

A school warrants that it is who it says it is, that the person accepting these terms can bind it, that it has the lawful standing to administer the schools whose records it puts in, and that its records and its instructions comply with the law of Uganda.

Neither party is liable to the other for loss of profit, revenue, goodwill, anticipated savings, business opportunity or reputation, or for indirect or consequential loss, in each case so far as the law allows.

Subject to that and to the paragraph below, each party's total liability to the other arising out of or in connection with these terms is limited to the fees paid or payable by the school for the platform in the twelve months before the event that gave rise to the claim.

No term of these conditions limits or excludes liability where Ugandan law will not allow it to. That includes, in particular:

• death or personal injury caused by negligence,
• fraud and wilful misconduct,
• breach of the duties of confidence owed to a data subject, and liability under the Data Protection and Privacy Act, 2019 and the Regulations made under it, so far as that liability cannot lawfully be limited or excluded,
• anything else that cannot be limited or excluded under the law of Uganda.

The exclusions and the cap do not protect a party from its own failure to comply with the Act as against a data subject or the Personal Data Protection Office, and they do not apply to an indemnity given below.

Nothing here extends or shortens any period within which a claim may be brought under the law of Uganda.

• A school indemnifies us, our staff and our providers against a claim, a regulatory action, a fine, a loss or a cost - including reasonable legal costs - arising from its records or its content, from its breach of the undertakings in the clause headed what a school undertakes to do, from the acts of its own staff or users, from a consent that should have been obtained and was not, or from an instruction of the school that was not lawful.
• We indemnify the school against a claim that the platform, in the form supplied to the school and used as it was meant to be used, infringes the intellectual property of a third party in Uganda, and against a loss arising from our own breach of these terms. Where such a claim is made we may procure the right for the school to keep using it, modify it, or replace it, and where none of those is commercially reasonable we may end the arrangement and refund the fees for the period remaining.

The party giving the indemnity is entitled to be told promptly, to be kept informed, and to conduct the defence or settlement of the claim, with the other party's consent to any settlement that admits fault or binds it. This clause does not oblige a party to indemnify the other for the other's own failure.

A notice under these terms is in writing. An ordinary notice may be sent to the email address recorded on the account or in the order, and is treated as received on the next business day after it is sent, provided it is not returned. A notice that ends the arrangement, changes it, or asserts a breach is also sent to the postal address recorded for the recipient.

Our own postal address and our data protection contact are printed at the head of this page where they have been published. A school may reach us through the contact page on this website at any time.

A school must tell us promptly if the person who deals with data protection for it, or the address for service, changes. A notice that could not be delivered because a school let its details go stale is a school's problem, not a notice that was never given.

The version and the date at the head of this page identify the terms in force. We may change them: to follow the law, to describe what the platform now does, to reflect a change to a third-party service, or to improve the fairness or clarity of the document.

A change that a school could reasonably object to is notified to that school before it takes effect, and a school that does not accept it may end the arrangement in accordance with the clause above rather than be bound by it.

The privacy policy is not varied by us at will. It describes what the platform actually does; where the law changes, or where the platform changes, it changes with them.

• A school may not transfer the benefit of these terms without our consent, except to a body that takes over the whole or a substantial part of its undertaking, and we may do so to a successor operator on notice to the school.
• Nothing here makes either party the other's partner or agent, or creates a joint venture.
• These terms, the order and the privacy policy are the whole of the agreement between the parties about the platform, and replace anything said or written before them. A statement that is not in one of those three documents is not relied on.
• Nobody outside the parties may enforce these terms. This includes a learner, a parent and a member of staff, whose protection comes from the Data Protection and Privacy Act, 2019 and from the school's own duties, not from this contract.
• If a clause is held to be unenforceable, the rest continue, and the clause is read as narrowly as is necessary to make it enforceable.
• A delay or an indulgence by one party is not a waiver of anything, and only a signed written waiver works.
• References to time are to time in Uganda.
• Headings are for reading out and do not affect the meaning of a clause.

These terms, and any question arising out of them or in connection with the platform, are governed by the laws of the Republic of Uganda, and the courts of Uganda have jurisdiction over them.

Before either party starts proceedings, other than proceedings that cannot wait, the parties will try to settle a dispute in this order:

1. The complaining party sets out the dispute in writing to the other, with the facts and what it wants.
2. A person of each side with the authority to settle meets, or speaks, within fourteen days of that notice.
3. If it is not settled within thirty days of the notice, the parties will attempt mediation in Kampala before a mediator agreed between them, including the mediation offered by the courts of Uganda where a claim has already been begun.
4. If mediation is not attempted, or does not settle the dispute, the dispute goes to arbitration in Kampala before a single arbitrator agreed between the parties or, failing agreement, appointed on the application of either party by a court of competent jurisdiction in Uganda. The Arbitration and Conciliation Act governs the arbitration, the language is English, the award is final and binding and costs follow it.

Either party may apply to a court in Uganda at any time for interim or injunctive relief - to stop a breach of confidence, to preserve records, or to prevent a school's learners being harmed - without going through that process first.

Nothing in this clause prevents a data subject from complaining to the Personal Data Protection Office, or a school or us from doing what the Data Protection and Privacy Act, 2019 requires, or affects anything the Office may decide or the Act allow.

Nothing in these terms is intended to exclude or restrict anything that cannot be excluded or restricted by law in Uganda, and so far as any clause would do so it does not take effect. That applies most importantly to the rights of a data subject under the Data Protection and Privacy Act, 2019, to the duties a school owes the learners in its care, and to the powers of the Personal Data Protection Office.