How SchoolHub handles personal data

For a school’s records, the school is the data controller. The school decides which students, parents and staff to record and what to record about them. TREADCO is the data processor: we store and process those records only to provide SchoolHub to the school, under the school’s instructions and our terms of service.

For SchoolHub’s own accounts and billing, TREADCO is the data controller. That covers the details a school gives when it signs up, the sign-in accounts of school staff and parents, subscription payments, demo requests and messages to our support team.

If you are a parent, student or member of staff with a question about your record, ask your school first: it decides what is kept. We’ll help the school answer.

What a school records depends on the school and its plan. It can include:

• Students: name, admission number, gender, date of birth, class, address, admission and leaving dates, scholarships or discounts, and notes the school adds.
• Parents and guardians: name, relationship to the student, phone number, and for online admissions an email address.
• School life: fees charged and paid (with receipts and Mobile Money or bank references), daily attendance, exam scores, report cards and promotion.
• Safe pickup (SafePick): the people allowed to collect each child (name, relationship, phone), whether the school has verified them, and who collected the child, when, and which member of staff released them.
• Admissions: what a parent enters on the school’s online application form, including the child’s previous school and any message.
• Staff records: name, position, contact details, date of birth, qualifications, Ghana Card and SSNIT numbers, salary, bank details and an emergency contact.
• Sign-in accounts: name, the email address used to sign in, role, a scrambled (hashed) form of the password, two-step sign-in settings, and when the account was last used.
• History: every change to a school’s records, with who made it and when.
• The school itself: its name, crest, town, region, phone, email, plan and subscription payments.

SchoolHub doesn’t ask for health, religious or similar sensitive details. Schools should only add such details in a notes field where they truly need them, and with the parent’s agreement.

TREADCO uses personal data only to:

• run SchoolHub for the school: showing, saving and printing its records, receipts and report cards;
• let people sign in, and keep accounts secure;
• take and record subscription payments, and keep our own accounts;
• answer support requests and demo requests;
• tell schools about changes to SchoolHub or their subscription.

TREADCO staff see each school’s subscription and counts (how many students and staff), not its students’ records. We only look at a school’s records when the school asks us to help with a problem, or when the law requires it. We don’t sell personal data, use it for advertising, or use one school’s records for anything to do with another school.

The legal basis is our contract with the school, and the school’s own legitimate purposes in running the school, including the duties it owes to its students and staff.

Inside a school, people see what their role needs: teachers see their own classes and not fee records, bursars see fees, and parents see only their own children. Outside the school, TREADCO uses these services:

• Vercel hosts SchoolHub and stores its records. Its servers may be outside Ghana; see “Where it is kept” below.
• Paystack takes online subscription payments. It receives the email address for the receipt, the amount and the school’s name. Card and Mobile Money details are entered on Paystack’s own page; TREADCO never sees them.
• WhatsApp. Fee reminders, receipts and pickup notices open in WhatsApp on the school’s own phone, which sends them. SchoolHub doesn’t send WhatsApp messages itself or pass contacts to WhatsApp.
• Cloudflare Turnstile, where it is switched on, checks that sign-up and application forms are filled in by a person, not a program.

We may also disclose personal data where the law requires it, for example to a court or regulator, and we’ll tell the school unless the law forbids it.

SchoolHub’s records are kept on cloud servers run by Vercel, which may be outside Ghana. Each school’s records are stored separately and privately, and are sent only over encrypted connections (HTTPS). We choose providers that protect data to a standard at least as high as Act 843 expects.

• Every request is checked against the school and role of the person making it, so one school can never see another’s records.
• Passwords are stored only in a scrambled (hashed) form. Five wrong passwords lock a sign-in name for 15 minutes, and sign-ins end after 12 hours.
• School owners and administrators, and TREADCO staff, must use two-step sign-in with an authenticator app.
• Every change is recorded with who made it and when.
• If personal data is ever exposed, we’ll tell the schools affected without delay, help them tell the people concerned, and inform the Data Protection Commission as the law requires.

A school’s records are kept for as long as the school uses SchoolHub. If its subscription ends, the records stay, read-only, so the school can renew or download them. The school can download all of its records at any time from School details.

When a school leaves and asks us to, we delete its records within 30 days, after giving it the chance to download them, unless the law requires us to keep something. Subscription payment records are kept as long as tax law requires.

Under Act 843, you can ask to:

• see the personal data kept about you or your child;
• have anything wrong or out of date corrected;
• have data deleted that is no longer needed or was kept without good reason;
• object to how it is used.

For a school’s records, make the request to the school; it can correct most details itself in SchoolHub, and we’ll help with the rest. For your own sign-in account, or anything TREADCO decides, contact us. We’ll reply within 21 days.

If you’re not satisfied, you can complain to the Data Protection Commission of Ghana.

Children don’t sign in to SchoolHub; their records are kept by their school. Parents and guardians can see their own children’s records on the parent portal where the school offers it. Schools are responsible for telling parents what they record and why, and may link to this notice to do so.

SchoolHub uses only the cookies it needs to keep you signed in. There are no advertising or tracking cookies.

If we change this notice in a way that matters, we’ll tell schools in SchoolHub before the change takes effect. The date at the top shows when it last changed.