Data Processing Agreement

1. Roles

Your school is the Controller of the student, guardian and finance data it enters. SchoolPurse is the Processor, acting only on your documented instructions (which include using the product's features). Where anything conflicts with the Privacy Policy on the subject of processing school data, this Agreement governs.

2. Scope of processing

• Purpose: to provide school fee-management (invoicing, payments, receipts, arrears, expenses, reports) and any features you enable.
• Duration: for as long as your account is active, plus the retention period in the Privacy Policy.
• Data subjects: your students, their guardians, and your staff.
• Data types: names, dates of birth, gender, class, contact details, addresses, optional photographs, and financial records (invoices, payments, receipts, arrears, expenses).

3. Our obligations as Processor

• Process personal data only on your instructions and to provide the service.
• Keep personal data confidential and limit access to those who need it.
• Apply appropriate security measures (section 6).
• Assist you, so far as reasonable, with data-subject requests (section 7).
• Notify you of personal-data breaches without undue delay (section 8).
• Return or delete personal data when the account ends (section 9).
• Not sell personal data or use it for our own advertising.

4. Sub-processors

You authorise SchoolPurse to use the sub-processors below to provide the service. Each is bound to protect personal data and may use it only to provide their service to us. We will give reasonable notice before adding or replacing a sub-processor, so you can object.

5. International transfers

Personal data is stored in London, United Kingdom (Supabase, eu-west-2), and some sub-processors operate in the United States or the EU. Data may therefore be transferred outside Zimbabwe. We rely on contractual safeguards with these providers to maintain a comparable level of protection, consistent with the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe.

6. Security measures

• Encryption of data in transit (HTTPS).
• Per-school isolation via database row-level security — one school cannot access another's data.
• Role-based access control (head/admin, bursar, teacher) enforced on both the interface and the database.
• Short-lived signed URLs for private files such as student photos.
• Audit trail on financial records; voided receipts are retained, not deleted.

7. Data-subject requests

If a student, guardian or staff member exercises a right (access, correction, deletion, objection), and it concerns data we process for you, we will assist you in responding within a reasonable time. Requests should normally be directed to the school as Controller.

8. Breach notification

On becoming aware of a personal-data breach affecting your data, we will notify you without undue delay with the information reasonably available, so you can meet your own obligations to POTRAZ — the Postal and Telecommunications Regulatory Authority of Zimbabwe (Zimbabwe's Data Protection Authority) and affected individuals.

9. Return & deletion

When your account ends, we will, on request, return your data (e.g. via CSV export) and delete it from active systems, then from backups within our normal backup cycle, subject to any legal retention requirement.

10. Audit & information

On reasonable written request, we will provide information necessary to demonstrate our compliance with this Agreement.

11. Governing law

This Agreement is governed by the laws of Zimbabwe and the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe. To request a countersigned copy for your records, contact support@schoolpurse.app.