Effective Date: 1st April, 2026 · Last updated: 2nd September, 2026
School Connect ("we", "our", "us") is committed to protecting the privacy and security of its users. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform.
This is the most important thing on the page, because it decides who you should actually talk to.
On this website
School Connect is the controller. If you fill in the demo form or read a blog post, we decide what happens to that data and you can come straight to us.
Inside the application
Your school is the controller and School Connect is a processor. The school decides what is recorded about its pupils and staff; we hold and move that data on their instructions and for no purpose of our own. If you are a parent, a teacher or a student, the fastest route for any request below is your school office — they can act immediately, whereas we have to refer your request back to them anyway.
Contact: letstalk@theschoolconnect.com, School Connect, Karachi, Pakistan.
From visitors to this website
From schools using the platform
We may collect the following types of information:
Schools can record a child's blood group, allergies and medical notes, and can upload identity documents such as a B-Form. Health information is a special categoryof personal data under GDPR Art. 9 and gets stricter handling than the rest: it is visible only to staff whose role requires it, it is never used for analytics, it is never shared with any third party for their own purposes, and it is the first thing destroyed when a record is erased. The lawful basis is Art. 9(2)(g) together with the school's own duty of care — a school needs to know that a child is allergic to peanuts.
We use the collected data to:
We do not use school data to train machine-learning models, and no decision with a legal or similarly significant effect on anyone is made automatically (GDPR Art. 22). Attendance flags and progress summaries are presented to a teacher; the teacher decides.
Every purpose needs a named basis under GDPR Art. 6. Ours are:
| Purpose | Basis | Why |
|---|---|---|
| Running the platform for a school that has signed up | Contract — Art. 6(1)(b) | We cannot deliver the service the school is paying for without processing the records it puts into it. |
| Replying to a demo request from this website | Legitimate interests — Art. 6(1)(f) | You asked us to get in touch. We keep the enquiry only as long as the conversation is live, and you can ask us to delete it at any point. |
| Analytics and advertising measurement | Consent — Art. 6(1)(a) | Off unless you turn it on, withdrawable in one click, and nothing is loaded from the provider until you do. |
| Keeping the service secure and investigating abuse | Legitimate interests — Art. 6(1)(f) | Audit logs record who changed what. Schools rely on this, and so do we when something goes wrong. |
| Keeping financial and statutory records | Legal obligation — Art. 6(1)(c) | Fee and payroll records have to survive a deletion request. We anonymise the person and keep the figures. |
All data entered into School Connect remains the property of the School. We act as a data processor.
We handle student data under the authority of the School. Schools are responsible for obtaining parental consent.
Children do not hold their own School Connect accounts. Parents and guardians access their child's record through their own account, and a school can see at any time which guardian is linked to which child.
We do not sell user data. Data may be shared with:
Naming them, as GDPR Art. 13(1)(e) requires — these are the sub-processors behind this website:
| Provider | What they do | Where | Transfer safeguard |
|---|---|---|---|
| Google Ireland Ltd. | Google Analytics 4 — only after you opt in. | Ireland, with onward transfer to the United States | EU–US Data Privacy Framework and Standard Contractual Clauses |
| TODO_HOSTING_PROVIDER | Hosts this website and serves every page you load. | TODO_COUNTRY | TODO_SAFEGUARD |
The application adds Google Firebase Cloud Messaging, which delivers push notifications to phones, and Google Drive, which is connected per teacher and only when that teacher authorises it. A school's full, current sub-processor list forms part of its data processing agreement.
School Connect operates from Karachi, Pakistan, and Pakistan has not been the subject of an EU adequacy decision. Transfers of personal data out of the EEA therefore rely on the European Commission's Standard Contractual Clauses, which form part of every school's data processing agreement, together with the technical measures described in the next section.
We implement reasonable safeguards, but no system is completely secure.
In practice that means passwords stored only as salted hashes, access scoped by role and by branch so staff see only their own, Google Drive tokens encrypted at rest, an audit log of who changed what, and transport encrypted end to end. If a breach ever affects personal data we will notify the affected schools without undue delay so they can meet their own 72-hour obligation under GDPR Art. 33.
We retain data as long as necessary to provide services and comply with legal obligations.
| What | How long |
|---|---|
| Student and parent records | For as long as the school keeps them, then anonymised on the school’s instruction. |
| Attendance, homework and progress history | Retained as school records; anonymised rather than deleted so year-on-year figures survive. |
| Fee and payroll records | Kept for the period local tax and employment law requires, with the person anonymised on request. |
| Audit logs | 24 months, then purged. |
| Push-notification tokens | Until the device unregisters or the account is deactivated. |
| Demo enquiries from this website | 24 months from the last contact, unless you ask sooner. |
| Uploaded files (photographs, documents) | Deleted from storage when the record they belong to is erased or anonymised. |
Schools may request access, correction, or deletion of their data.
Individuals have these rights too. Because the school is the controller for everything inside the application, ask your school first — their administrator can produce an export or erase a record from their dashboard the same day. If they need our help, or if your request concerns this website rather than the application, write to letstalk@theschoolconnect.com. Either way you will get an answer within one month, free of charge.
| Right | Article | What it means here |
|---|---|---|
| Access | Art. 15 | A copy of the personal data held about you, in a readable form. |
| Rectification | Art. 16 | Correction of anything inaccurate or incomplete. |
| Erasure | Art. 17 | Deletion, where no legal obligation requires the record to be kept. Where figures must survive, the person behind them is anonymised instead. |
| Restriction | Art. 18 | A freeze on processing while a dispute about accuracy or lawfulness is resolved. |
| Portability | Art. 20 | The data you provided, exported as machine-readable JSON, for you to take elsewhere. |
| Objection | Art. 21 | A challenge to processing we base on legitimate interests. |
| Withdraw consent | Art. 7(3) | As easy as giving it. Withdrawal does not undo what was lawful beforehand. |
| Complain | Art. 77 | To your national data protection authority, at any time, without going through us first. |
One honest limitation on erasure: a school is required to keep certain financial and statutory records, and deleting an attendance history would corrupt figures the school reports elsewhere. Where that applies we anonymise instead — every piece of identifying information is overwritten and cannot be recovered, while the anonymous row that remains can no longer be traced back to a person.
This website sets nothing beyond what it needs to work until you say otherwise. Analytics and advertising are off by default, and the provider's script is not even fetched until you opt in. The full register — every cookie, its purpose and its lifetime — is on our Cookie Policy, along with a one-click way to change your mind. The application itself uses session cookies for sign-in only and carries no analytics or advertising at all.
Where a school connects School Connect to a service of its own choosing — a teacher linking their Google Drive, for example — what happens inside that service is governed by that provider's terms, not ours. That is not a disclaimer for the providers we ourselves engage: the sub-processors listed in section 8 act on our instructions under a data processing agreement, and we remain answerable for them.
If you think we or your school have handled your data badly, tell us and we will try to put it right. You do not have to go through us first: you can complain directly to the data protection authority where you live, work, or where you believe the problem occurred (GDPR Art. 77).
We may update this Privacy Policy. Continued use means acceptance.
Where a change is significant — a new purpose, a new category of data, a new sub-processor — we will tell schools directly rather than relying on you noticing the date at the top. A change that widens what we do with data on the basis of consent will re-ask for that consent rather than assume it.
Email: letstalk@theschoolconnect.com
Phone: +92 371 012 7787
Address: Karachi, Pakistan