This notice explains how personal data is handled in ZamSkools, the school management platform operated by Ontech Solutions Limited for schools in Zambia. It is written to meet the Data Protection Act No. 3 of 2021 of the Republic of Zambia and is administered under the oversight of the Office of the Data Protection Commissioner.
Responsibility depends on whose data it is and who decides what happens to it:
This notice covers the ZamSkools web application at
school.ontech.co.zm, the ZamSkools Android application
(package zm.co.ontech.zamskools, distributed on Google Play), and the ZamSkools
USSD service on *388*11#. It does not cover the Ontech Solutions corporate
website at ontech.co.zm, which publishes its own privacy policy at
https://ontech.co.zm/privacy, nor any other
Ontech product. Where this notice is silent, the Ontech Solutions company policy applies.
The mobile app is a second way to reach the same ZamSkools platform. Everything in this notice about what data is held, why, and with whom it is shared applies equally whether you use the app or the website — both are clients of the same server and the same records. The following is specific to the app and is drawn from what the app's code actually does:
The following is drawn from the system's actual data model, not from a template.
| Category | Fields |
|---|---|
| Identity | First, middle and last name; date of birth; gender; admission number; pupil identifier; photograph |
| Contact | Address; phone; email (where a pupil has one) |
| Emergency | Emergency contact name, phone and relationship |
| Health — sensitive | Blood group; medical conditions; allergies |
| Academic | Class and grade level; marks and grades; class position/rank; attendance; previous school; transfer certificate number |
| Financial | Fee assessments, payments and balances |
| Name; phone number; email address; relationship to the pupil; the pupil(s) linked to you; fee payment records; the results messages sent to you |
| Name; email; username; phone numbers; role and permissions; employment and payroll records where the school uses those modules. Passwords are stored only as a one-way hash and are never recoverable, by us or by anyone. |
Pupil records are processed so a school can run: register pupils, record marks and attendance, assess fees, produce reports, and tell guardians how their child is doing. The lawful bases are the school's contract with the guardian and the school's own legal obligations as an educational institution — not consent collected in the app. Account and billing data is processed to provide and charge for the service.
ZamSkools holds a limited amount of health data about pupils — blood group, medical conditions and allergies. This is sensitive personal data under section 14 of the Act, and it is held for one reason: so that a school can respond appropriately in a medical emergency and otherwise safeguard the pupil's health while in its care. These fields are optional, are visible only to the school's authorised staff under the same role-based access that governs every pupil record, and are never used for any purpose beyond the pupil's care and safety. They are not shared for advertising, profiling or any commercial purpose.
ZamSkools is a tool for schools to manage their pupils, most of whom are children. Pupil data is entered and controlled by the school, which acts under its own legal and contractual responsibilities towards the children in its care — not on the basis of consent collected through the app. The app is operated by adults: administrators, teachers and guardians. Children do not create accounts and are not the users of the app. A pupil's parent or guardian, or the school, may ask at any time for the pupil's data to be corrected or removed (see section 12). We do not knowingly use children's data for any purpose other than the school's operation of its own school.
We do not sell personal data. It is disclosed only as follows:
| Recipient | What | Why |
|---|---|---|
| Your school | All of that school's records | The school is the controller |
| Cloud Service Zambia | Guardian phone number and message text | To deliver results and notices by SMS (shortcode 388, sender ID SchoolSMS). Delivered in Zambia. |
| Titan (email) | Name and email address | To send password resets and welcome mail. See section 8. |
| Authorities | As lawfully required | Where compelled by Zambian law or a court |
Data is isolated per school. A user of one school cannot read another school's records; this is enforced centrally in the API on every school-scoped request.
ZamSkools sends password-reset and welcome email through Titan, an email provider located outside Zambia, so a recipient's name and email address are processed outside the country for the purpose of delivering that mail. This transfer is limited to what is needed to send those messages and is governed by Part IX of the Act. SMS does not leave Zambia (it is delivered by a Zambian shortcode provider), and pupil records are not otherwise transferred out of the country. The only other cross-border processing is the optional approximate-location lookup described in section 16.3, which is disabled by default.
Because your school is the controller of pupil records, the school decides how long each record is needed to run the school and to meet its own legal obligations, and records are kept while the school is an active customer. Records are not deleted automatically while a school is active; instead a school, or a data subject through the school, may remove data that is no longer needed at any time (see section 12). Account, billing and audit records are kept while the account is active and for as long afterwards as the law requires. Two specific items have their own, shorter, automatic limits: uploaded results awaiting sending expire after 24 hours (section 10), and site-analytics records are deleted after 400 days (section 16.4).
Where a breach occurs, section 49(1) of the Act requires the Data Protection Commissioner to be notified within twenty-four (24) hours. Where a breach affects a school's pupils or guardians, we will notify the school without undue delay so that it can discharge its own obligations as controller.
Sections 58 to 65 of the Act give you the right to be informed, to access your data, to have it corrected, to have it erased, to object to or restrict processing, to data portability, to withdraw consent where consent is the basis, and to lodge a complaint with the Data Protection Commissioner and to appeal.
Because your school is the controller of pupil records, exercise these rights with your school first. Where we hold data as controller — account, billing, support — contact our DPO directly. You may complain to the Office of the Data Protection Commissioner at any time; you do not have to come to us first.
Deleting your account. You can delete your ZamSkools account and its associated personal data at any time. In the app, open the account menu (top‑left) and tap Delete account; you will be asked to confirm with your password. If you can no longer sign in, use the public request page at school.ontech.co.zm/data-deletion, which works without the app. Deleting your account erases the personal data tied to your login — your name, email, phone number, password and profile photo — and disables the login. Records that belong to the school (for example academic results, attendance and fee records) are retained under the school's ownership and legal obligations, with your identity anonymised, as described in section 9 and the narrow audit exception in section 14.
ZamSkools sends guardians SMS about their child's results and school notices, using the
number the school holds. USSD on *388*11# processes the number you dial from
and what you enter during the session.
If you do not wish to receive these messages, tell your school — the school controls who is messaged and can stop sending to your number — or contact our Data Protection Officer (section 18), who will arrange it. School notices about your own child (results, attendance, fees) are part of the service the school provides, not marketing, and we do not send you advertising by SMS.
The system keeps an audit log of significant actions — who did what, to which record, and what the previous values were. This exists to protect pupils and schools by making changes to records traceable.
You should know that the audit log deliberately retains the email address of the user who performed an action even after that user's account is deleted, so that the record of who changed what remains meaningful. This is a security and accountability record kept in the legitimate interests of protecting pupils and schools; it is not used for any other purpose. If you exercise your right to erasure (section 12), other personal data is removed, but this narrow audit entry is retained as part of that security record.
ZamSkools calculates grades from marks and computes class position automatically according to the grading scale the school selects. These are arithmetic outcomes of marks entered by teachers, not profiling, and no decision about a pupil is taken by the system without a person. ZamSkools does not carry out automated decision-making with legal or similarly significant effects.
ZamSkools uses a session cookie to keep you signed in. It is strictly necessary for the service to function and carries no advertising or cross-site tracking.
ZamSkools carries no advertising trackers of any kind, and shares no data with advertising networks, data brokers or social platforms. It does operate its own first-party site analytics, described in full below.
| Cookie | Lifetime | Purpose |
|---|---|---|
zs_wa_vid |
2 years | A random value that lets us count returning browsers separately from new ones. It is not linked to your account, your name or your email. |
zs_wa_sid |
30 minutes from your last request | A random value that groups one visit together, so a visit can be measured rather than counted as many unrelated page loads. |
Both are first-party and HttpOnly. Neither is readable by any other website,
and neither is used for advertising or shared with anyone.
For each page view we record the page address, the time, which portal it belonged to, the HTTP status, and the browser, operating system and device category taken from your User-Agent. Where the page runs our tracker script we also record how long the page was open, so that time-on-page and bounce rate can be calculated. Page addresses are normalised before they are stored: identifiers, record numbers and tokens in the address are replaced with a placeholder, and query strings are discarded entirely, so the analytics records do not identify which pupil, invoice or exam a page concerned.
No pupil name, staff name, account, email address, phone number, school identifier or raw IP address is stored in the analytics records. Your IP address is converted to a salted, one-way cryptographic hash on arrival and the address itself is discarded; the hash exists only to group requests from one network and cannot be reversed to recover the address.
Where enabled, ZamSkools resolves an approximate location (country, region and city) for each distinct network so that traffic can be reported by region. This is done by sending the IP address to ip-api.com, a geolocation service operated outside Zambia and hosted in the United States. On the service tier used, that request travels over unencrypted HTTP. The lookup is performed at most once per distinct network and the result is cached; the IP address is not retained by ZamSkools afterwards.
This is a transfer of personal data outside the Republic of Zambia within the meaning of Part IX of the Data Protection Act. For that reason it is disabled by default and is switched on only where a school and our Data Protection Officer have agreed it, with appropriate safeguards for the transfer. Where it is off — as it is by default — no IP address or location data leaves Zambia through this feature.
Site analytics are used solely to operate and improve the service — to see which features are used, to find pages that fail, and to size capacity. They are not used to make any decision about any individual, and are never used to monitor a pupil, a parent or a member of staff. The lawful basis is legitimate interest in the secure and effective operation of the platform.
Analytics records are retained for 400 days and then deleted automatically. Nothing in the analytics tables is retained indefinitely.
Because this processing is not strictly necessary for the service to function, it can be switched off entirely for a school on request to the Data Protection Officer, whose details are in section 18.
Material changes will be notified to schools before they take effect. The version and date at the top of this page always reflect the current text.
Data Protection Officer — Ebwalya, Ontech Solutions Limited ·
ebwalya@ontech.co.zm
Data Controller registration — DP000394, Office of the Data
Protection Commissioner, Republic of Zambia
You have the right to lodge a complaint directly with the Office of the Data Protection Commissioner, whether or not you raise it with us first.
This notice is governed by the laws of the Republic of Zambia, and the Zambian courts have jurisdiction.