This policy explains how R & T SOLUTIONS collects, uses, stores and protects personal data through the SMIS Portal at https://smis-portal.com/. We process personal data in line with the Data Protection and Privacy Act, 2019 of Uganda. Because the Service handles information about students, many of whom are children, we take particular care with it.
1. Our role
For student, parent and staff records that an Institution places in the Service, the Institution is the data controller and we act as its data processor, handling data only on the Institution's instructions. For account administration, billing, website analytics and support, we act as controller. Parents, guardians and students should direct questions about school records to their school first.
2. Information we collect
- Account data: name, email, phone number, role, username and encrypted password.
- Student data (entered by Institutions): names, dates of birth, admission numbers, class, attendance, grades and reports, health or special-needs notes where the school records them, guardian contact details, and fee and payment records.
- Staff data: contact details, role, timetable and assignment information.
- Payment data: transaction references and status. Card and mobile-money details are handled by our payment provider (Pesapal) and are not stored by us.
- Technical data: IP address, device and browser type, pages visited, login times and error logs.
- Communications: messages you send to us for support.
3. How we use information
- To provide, operate and maintain the Service and its features;
- to authenticate Users and protect against fraud and abuse;
- to process payments and send invoices and receipts;
- to send service notices, such as security alerts, updates and school notifications, and to respond to support requests;
- to improve performance and fix defects; and
- to comply with legal obligations.
4. Legal basis
We process data to perform our contract with the Institution, to meet legal obligations, for our legitimate interests in securing and improving the Service, and, where required, with consent (for example, from a parent or guardian for a child's data). Consent can be withdrawn at any time through the Institution or by contacting us.
5. Sharing
We share personal data only with:
- the Institution that holds the record, and Users it authorises;
- service providers that help us run the Service (hosting, email/SMS delivery, payments, backups), under confidentiality and data-protection obligations;
- authorities, where required by law or to protect rights, safety and security; and
- a successor organisation in a merger or sale, with notice to account holders.
6. International transfers
Our providers may process data in countries other than where you live. Where this happens we take steps to ensure appropriate safeguards are in place, as required by applicable data-protection law.
7. Retention
We keep Customer Data while the Institution's account is active. After termination we keep it for up to 30 days to allow export, then delete or anonymise it, except where the law requires longer retention. Backups are overwritten on a regular cycle. Billing records are kept for the period required by tax and accounting law.
8. Security
We use measures such as encrypted connections (HTTPS), hashed passwords, role-based access control, access logging and regular backups. No system is completely secure; Users must also protect their credentials. If a breach affecting personal data occurs, we will notify affected Institutions and, where required, regulators without undue delay.
9. Your rights
Subject to applicable law, you may ask to access, correct, delete or restrict the use of your personal data, to object to certain processing, and to receive a copy of data you provided. Because most data belongs to the Institution, we may refer your request to the school. Contact us at info@smis-portal.com. You may also complain to the Personal Data Protection Office in Uganda, or to the data-protection authority in your own country.
10. Children
The Service is not directed at children acting independently. Student accounts and records are created and managed by Institutions, which are responsible for obtaining parental or guardian consent where required. If you believe a child's data was submitted without authority, contact us and we will act on it promptly.
11. Cookies
We use essential cookies to keep you signed in and secure the Service, and may use limited analytics cookies to understand usage. You can control cookies through your browser, though disabling essential cookies may stop the Service working.
12. Links to other sites
The Service may link to external sites we do not control. We are not responsible for their privacy practices.
13. Changes
We may revise this policy. The latest version will always be on this page with its date, and we will notify account holders of material changes.
14. Contact
Privacy enquiries: info@smis-portal.com
R & T SOLUTIONS, Buzzi, Entebbe Road, Uganda, East Africa