Privacy notice

Who is responsible

SP Portal keeps school records, marks, comments, reports and announcements for your school. The school decides what is recorded and who at the school may see it; it is responsible for your data. Panashe and Shuvai run the portal for the school and handle the data only to provide it.

The school and the portal aim to follow Zimbabwe's Cyber and Data Protection Act. The lawyer's review will confirm how it applies.

What we store

Only what the school needs to run reports and keep families informed.

• Learners: name, learner number, date of birth, sex, class, subjects, marks, teachers' comments, reports and their PDFs, and, if the learner has a login, their account and when they last signed in.
• Parents and guardians: name, phone number, email address, how they are related to each child, their account, which announcements they have read, and the report share links they make and when those are opened.
• Staff: name, email address, phone number, roles, the classes and subjects they teach, and a record of the marks, comments and reports they change. School admins and heads also have an authenticator app linked to their account and recovery codes, which are stored only in a scrambled (hashed) form.
• Everyone: passwords and PINs are held by the sign-in service in hashed form and nobody at the school can read them. To stop password guessing we keep each sign-in try with a hash of the email address or network address, never the address itself.

Where it is stored

The database, files and sign in run on Supabase, in eu-west-2. The website is served by Vercel. If something breaks, an error report goes to Sentry, with names, marks, codes and links removed before it is sent.

These services may be outside Zimbabwe. They store the data for the portal and do not use it for anything else.

Who can see what

• A learner sees their own published reports and the announcements meant for them.
• A parent sees the published reports of the children linked to them, and the announcements meant for them.
• A teacher sees and enters marks and comments for the classes and subjects they teach. A class teacher also sees their class's results.
• A head of department sees the class subjects they look after. The school admin and the head see everything at their school.
• Nobody at another school can see anything about your school.
• Anyone a parent sends a share link to can open that one report until the link expires. Anyone holding a printed report can check its reference with the QR code, which shows the learner's name, school, term and whether the report is still valid.
• The people who run the portal see school settings and usage numbers. They can reach the stored data only to fix problems, restore backups or answer the school's requests.

How long we keep it

Reports, marks and comments are kept for as long as the school keeps the learner's record, because they are the school's official record. When a learner leaves, their record is marked as left, not deleted.

Spreadsheets uploaded to import learners or marks are deleted after 30 days; what they added stays in the records. Sign-in tries are deleted after 30 days. Backups are kept for a limited time and then replaced.

Your rights and data requests

You can ask to see the data held about you or your child, ask for a mistake to be corrected, or ask questions about how it is used. A parent claiming a code accepts this notice, and we record which version and when.

Contact: Your school's office. Choose your school above to see the name and email address it has given for data protection questions.