Privacy Policy

Each school that uses Mwanexa is the data controller for the learner, parent and staff records it enters. It decides what to collect and who on its team may see it.

Mwanexa Technologies Ltd (“Mwanexa”, “we”) is the data processor. We provide and secure the platform and process data only on the school’s instructions and as described here. For our own account holders, billing records and website visitors, we act as controller.

Contact: privacy@mwanexa.com · Mwanexa Technologies Ltd, Kampala, Uganda.

We process personal data in accordance with the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection and Privacy Regulations, 2021, the Electronic Transactions Act, 2011, and the Computer Misuse Act. Where a school or parent is located outside Uganda, we apply equivalent standards.

Mwanexa exists to serve pre-primary and primary schools, so most learners are children. Under section 8 of the Data Protection and Privacy Act, 2019, a child’s personal data may only be processed with the consent of a parent or guardian, or where processing is necessary to comply with the law or to protect the child.

We therefore require an explicit, recorded parental or guardian consent on every admission application, and schools must have a lawful basis (enrolment contract, legal duty of care, or safeguarding) for any further processing. Consent can be withdrawn by contacting the school; withdrawal does not affect records the school must keep by law.

We do not use children’s data for advertising, profiling, automated decision-making, or to train third-party artificial intelligence models. We never sell personal data.

• Learner records: name, date of birth, sex, class and stream, enrolment history, photograph where the school uploads one, and a unique learner reference.
• Parent and guardian records: name, relationship to the learner, email, phone number, and authorised-pickup details.
• Staff records: name, work email, role, department, employment and leave records for schools using the HR module.
• Attendance and gate activity: arrival and departure times, pickup codes and who collected a learner.
• Academic records: subjects, assessments, marks and report cards.
• Health and safeguarding records: sick-bay visits, treatment notes, incidents and safeguarding reports. These are special categories of data and are locked to named roles only.
• Financial records: fee structures, invoices, receipts and payment references. Card and mobile-money details are entered on Pesapal’s own secure pages and are never seen or stored by Mwanexa.
• Account and technical data: email address, password (stored only as a salted hash), sign-in timestamps, IP address, device and browser information, and audit log entries recording who viewed or changed a sensitive record.

• Performance of a contract — to deliver the platform to the school and the parent portal to families.
• Consent — for processing children’s data, for optional communication channels such as SMS or WhatsApp, and for any non-essential use.
• Legal obligation — education, tax, accounting and child-protection duties.
• Vital interests — medical emergencies and safeguarding concerns affecting a child’s safety.
• Legitimate interests — securing the platform, preventing fraud and keeping audit trails.

We share personal data only where necessary, and never for marketing:

• Within the school — staff see only what their role allows. Each school is technically isolated from every other school on the platform.
• Pesapal — payment processing. Pesapal receives the payer’s name, email, phone and the amount due, and handles the payment instrument itself.
• Cloud hosting and email delivery providers — to run the service and send account, receipt and notification emails from our own domain.
• Authorities — where required by law, court order, or to protect a child.

All of our providers are bound by contract to process data only on our instructions and to keep it secure.

Mwanexa runs on managed cloud infrastructure which may store and process data on servers outside Uganda. Where data leaves Uganda, we rely on contractual safeguards and encryption in transit and at rest so that protection remains at least equivalent to Ugandan law, as required by the Data Protection and Privacy Act, 2019.

Schools set retention for their own records. As a default we keep learner academic and enrolment records for the period a school is required to retain them by education law, financial records for at least seven years for tax and audit purposes, safeguarding records for as long as the school’s child-protection policy requires, and technical logs for up to twelve months. When a school leaves Mwanexa we return or delete its data on request, subject to legal retention duties.

Every record is protected by database-level row security tied to the specific school, so one school’s staff can never read another school’s records. Sensitive modules (safeguarding, health, finance, HR) require specific roles. Passwords are hashed, traffic is encrypted, privileged actions are recorded in an append-only audit log, and leaked-password checks and multi-factor authentication are available for privileged accounts.

If a breach occurs that is likely to cause harm, we will notify the affected school without undue delay so it can inform affected individuals and the Personal Data Protection Office (PDPO), Uganda.

You have the right to be informed, to access your data, to have inaccurate data corrected, to request erasure, to object to or restrict processing, to withdraw consent, and to receive a copy of your data in a usable format.

If a school holds the record, contact the school first — it is the controller. You can also write to us at privacy@mwanexa.com and we will help. We respond within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Office (PDPO), Uganda.

We use only strictly necessary cookies and browser storage. See our Cookie Policy.

We will post any change on this page and update the date above. Material changes affecting schools will also be notified by email.