Privacy policy

1. Operator and company details

The E-School Management System (“E-School”, the “Service”) and this marketing website are operated by:

• 360 Software House Spółka z ograniczoną odpowiedzialnością (“we”, “us”, “Operator”)
• Registered office: ul. Piotrkowska 262/264/204, 90-361 Łódź, Poland, European Union
• KRS: 0001054652
• NIP: 7252334520
• REGON: 526060182
• Share capital: PLN 5,000.00
• Representation: Each member of the Management Board is authorised to represent the company individually
• Contact / privacy: contact@eschoolmanagementsystem.com

Company particulars are published for identification under Polish company law. Registry extracts may be verified via official KRS sources (reference listing: krs-pobierz.pl company card ).

2. Scope of this notice

This privacy notice explains how we process personal data when you use E-School (SaaS) and this marketing site. It is written primarily for schools and staff in Uganda, with hosting and operator establishment in the European Union. It is not a substitute for a signed data-processing agreement (DPA) between the Operator and a school customer.

3. Roles: controller and processor

Marketing website and Operator account/billing data. For this website, trial/signup metadata, SaaS subscription/billing records we create as supplier, and security logs of the platform, the controller is 360 Software House.

School education records. When a school customer enters pupil, parent, guardian, or staff records in their tenant, that school organisation typically acts as controller of those records. 360 Software House processes that content as a processor / service provider to host and operate E-School under the school’s instructions and contract (including a DPA where required).

End users (teachers, students, parents) should contact their school administrator first for access or correction of education records held in the school’s tenant.

4. Where we store and transfer data

Application and tenant data for E-School are hosted on infrastructure operated by 360 Software House in Poland, European Union. Use of the Service from Uganda involves a transfer of personal data to the EU for the purpose of providing the hosted platform.

Processing by us as an EU-established operator is framed by the EU General Data Protection Regulation (GDPR) where it applies. School customers remain responsible for compliance under Uganda’s Data Protection and Privacy Act (DPPA) and guidance from the Personal Data Protection Office (PDPO).

5. Categories of personal data

• Account and authentication — name, email, role, password hashes, MFA status/secrets, session and security logs.
• Organisation / school configuration — school identity, branding assets, settings, memberships, and operational configuration.
• Education and operations content (customer data) — records the school chooses to store (e.g. students, attendance, grades, fees, library, clinic, stores/budget, messages, uploaded files).
• Support and billing metadata — trial/signup details, invoices, payment status, correspondence needed to run the Service.
• Marketing-site analytics (optional) — with consent, Microsoft Clarity session recordings and heatmaps. See our cookie policy.

6. Purposes and legal bases

We process data to:

• provide, secure, and support the Service (contract / legitimate interests; processor instructions for customer data);
• onboard schools, run trials, and communicate about the Service;
• bill and collect subscription fees where applicable;
• monitor reliability, prevent abuse, and enforce fair use and security;
• comply with legal obligations applicable to the Operator;
• improve this marketing site when analytics cookies are accepted (consent).

7. Retention

We keep account and operational data for as long as the school subscription or trial requires, then delete or anonymise according to retention practices, customer requests, and legal holds where applicable. After contract end, customer tenant data may be retained for a limited wind-down period (as described in product docs / contract) before deletion, unless law requires longer retention.

Clarity recordings on the marketing site follow Microsoft’s product defaults (typically about 30 days).

8. Subprocessors and recipients

Hosting, email delivery, object storage, and observability tools act as subprocessors under our instructions and are located in the EU or engaged under safeguards appropriate for EU processing. Clarity (Microsoft) on this marketing site runs only after analytics consent.

We do not sell personal data. We may disclose data if required by competent authorities or to protect rights, safety, or the integrity of the Service.

9. Security

We apply technical and organisational measures appropriate to the risk (access control, encryption in transit where configured, role-based permissions, logging, and operational controls). No method of transmission or storage is perfectly secure; schools must protect credentials and follow least-privilege access for their staff.

10. Your rights

Depending on your role and applicable law (Uganda DPPA / PDPO and, where applicable, GDPR), you may request access, rectification, erasure, restriction, portability, or objection to certain processing. School users should usually contact their school administrator first for education records. You may also lodge a complaint with PDPO in Uganda and/or, where GDPR applies, the relevant EU supervisory authority (in Poland, typically the President of the Personal Data Protection Office — UODO).

Privacy requests to the Operator: contact@eschoolmanagementsystem.com.

11. Children

E-School is a B2B school platform. Pupil data is entered under the school’s responsibility as controller. The marketing site is not directed at children.

12. Changes to this privacy policy

We may update this privacy policy from time to time (for example when features, subprocessors, or law change). The “Last updated” date below will change. For material changes we will provide notice by one or more of: posting on this website, in-product notice, or email to the school administrator contact on file. Where required, material changes become effective after at least 14 days from notice, unless earlier effect is needed for security, legal compliance, or to prevent abuse. Continued use of the Service after the effective date constitutes acceptance of the updated policy, except where mandatory law requires a different mechanism.