MIS for Manifest International Schools (web application and Android app)
Last updated: 6 October 2026
This policy explains what personal data MIS collects, why, who it is shared with, how long it is kept, and the rights you have. It applies to everyone who uses MIS: school staff, learners, parents and guardians, and people whose details the school records, such as emergency contacts and suppliers.
1. Who is responsible for your data
Manifest International Schools (“the school”, “we”) decides why and how personal data in MIS is used, and is the data controller.
- Address: Makaya Close, Plot 2, Naguru, Kampala, Uganda
- Email: [email protected]
- Phone: +256-200-977600
- Data Protection Officer: the School Administrator
- Registration with the Personal Data Protection Office: in progress
We follow Uganda’s Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.
2. What we collect
Staff and other account holders
- Name, display name, email address, role, job title and the modules you can open.
- Sign-in records: last sign-in time, the devices and browsers signed in, and session information.
- Your password, which you set yourself and which the school cannot see.
- Personal API keys you choose to create.
- Staff attendance: clock-in and clock-out times, lateness, and leave, sick or off days.
Learners
- Identity: full name, admission number, Learner Identification Number (LIN), date of birth, age, sex and passport photo.
- School placement: ACE level, office number, Supervisor, enrolment date, and status (enrolled, withdrawn, archived, graduated or transferred, with where they went).
- Learning records: daily attendance, PACEs issued, Goal Cards, Goal Checks, termly goals, checkups, PACE Test scores, diagnostics, mark sheets, Supervisor remarks, habit grades and report cards.
- Health: allergies, medical conditions, medication, blood group, and whether an immunization card has been seen.
- Documents: whether the birth certificate, immunization card and leaving letter have been seen.
- Fees: amounts billed, payments, balances and adjustments.
- Questions a learner types into the learning tools, such as Ask, the revision tutor and the Science Museum, and quiz results.
Parents, guardians and emergency contacts
- Name, relationship to the learner, phone numbers and email address.
- Whether you have a parent portal account, and your sign-in records if you do.
- Conference bookings.
- Messages the school sends you by SMS (and WhatsApp, once enabled), with their delivery status, and whether you have opted out.
- Fee payment details you give the school, such as the payment method and the mobile money or bank reference. MIS does not collect card numbers or process payments itself.
Suppliers
- Business name, category, contact person, phone, email, Tax Identification Number (TIN), invoices and payments.
Collected automatically
- An audit trail of actions in MIS (for example “marked attendance” or “recorded a fee payment”), with the account, time and outcome. The school may also log page views.
- Technical data needed to deliver and protect the service: IP address, browser or device type, and request logs, processed by our hosting and security providers.
- A single sign-in cookie that keeps you signed in, and a saved preference for light or dark mode on your device. We do not use advertising or tracking cookies.
Device permissions (Android app)
The app asks for these only when you use the feature that needs them: – Camera: to take a learner’s passport photo, scan a PACE booklet barcode, or join a video meeting. – Microphone: to talk to the OM TA trainer by voice, or to speak in a video meeting. – Files and storage: to upload a photo or a class list, and to save exports such as CSV, Excel and PDF files. – Notifications: to send you reminders and notices from the school. The app stores a notification token for your device so messages reach it.
You can withdraw any of these permissions in your device settings. The rest of the app keeps working.
3. Why we use it
| Purpose | Data used | Legal basis |
|---|---|---|
| Running the learning centre: enrolment, attendance, PACE progress, Goal Cards and supervision | Learner identity, placement and learning records | Performing the education service the school provides, and the school’s legal duties |
| Report cards and reporting progress to parents | Learning records, parent contacts | Performing the education service |
| Duty of care and emergencies | Health data, emergency contacts | Protecting the learner’s vital interests, and consent of the parent or guardian |
| Fees, receipts and school accounting | Fee, payment and supplier records | Contract, and legal obligations under tax and accounting law |
| Contacting parents by SMS, WhatsApp or app notification about attendance, fees, events and report cards | Parent names and phone numbers, notification tokens, message content | The school’s legitimate interest in communicating with families. You can opt out of non-essential messages. |
| Parent and Supervisor conferences | Booking details, parent contacts | Performing the education service |
| Staff administration and attendance | Staff accounts and attendance | Employment and legitimate interest |
| Learning and training tools: Ask, the revision tutor, the Science Museum and the OM TA trainer | The questions you type or speak, and the answers | Performing the education service, and the school’s legitimate interest in supporting staff |
| Security, preventing misuse and investigating problems | Sign-in records, audit trail, technical data | Legitimate interest and legal obligations |
We do not sell personal data. We do not use it for advertising. We do not make decisions about learners by automated means alone; Supervisors and the principal check every score, mark and report card.
4. Children’s data
Most learners in MIS are children. We process a child’s personal data only with the consent of a parent or guardian, which is given at enrolment, or where the law otherwise allows it.
- Learners see only their own desk, goals and learning tools. They cannot see other learners’ records.
- Health information is visible only to staff with a duty-of-care need.
- Parents can see their own child’s progress and report cards.
- Learners should not type personal or health information into the learning tools.
5. Who we share data with
We share personal data only as needed to run MIS, and only with:
- Our hosting and technology provider: runs the MIS servers and supports the system on the school’s behalf.
- Cloudflare, Inc.: network delivery, security and protection against attacks. It may provide privacy-focused, cookie-free site statistics.
- Africa’s Talking: delivers SMS messages to parents’ phones.
- LipaChat: delivers WhatsApp messages, once the school enables WhatsApp. Only parents who agree receive WhatsApp messages.
- Video meeting service: online classrooms, video conferences and training rooms.
- Google: distributes the Android app through Google Play and delivers app notifications.
- Authorities: the Ministry of Education and Sports, Uganda Revenue Authority, examination bodies, courts or the police, when the law requires it.
Each provider may use the data only to provide its service to us.
6. Where your data is stored
MIS data is stored on servers in Uganda. Some providers, such as Cloudflare, Google and our SMS and WhatsApp providers, may process data outside Uganda while delivering their service. We allow this only where the country or the provider gives adequate protection, as the Data Protection and Privacy Act requires, or with your consent.
7. How long we keep it
| Record | Kept for |
|---|---|
| Learner academic records and report cards | While the learner is enrolled, then 7 years after they leave |
| Learner health records | While the learner is enrolled, then deleted within 6 months of leaving |
| Fee, payment and accounting records | 7 years |
| Staff accounts and attendance | While employed, then 3 years |
| Parent contacts and message logs | While a child is enrolled, then 12 months |
| Audit trail | 5 years |
| Questions typed into the learning tools | 12 months |
When a retention period ends, we delete the data or anonymise it so it no longer identifies anyone.
8. How we protect it
- Every account is created by the school administrator, and each role sees only the modules it needs.
- Sessions use a secure, HttpOnly sign-in cookie, and data travels over encrypted HTTPS connections.
- The finance books require a second person to approve each entry, and closed months cannot be changed.
- Every significant action is recorded in an audit trail that cannot be edited.
- Staff are trained to keep health and personal information confidential.
No system is perfectly secure. If a breach puts your personal data at risk, we will tell the Personal Data Protection Office and the people affected, as the law requires.
9. Your rights
You have the right to:
- know what personal data we hold about you, and get a copy of it;
- have inaccurate data corrected;
- have data deleted, or its use restricted, where we no longer need it or have no lawful basis to keep it;
- object to processing, including SMS, WhatsApp or app notifications that are not essential;
- withdraw consent you have given, at any time;
- complain to the Personal Data Protection Office.
Parents and guardians can use these rights on behalf of their children.
To use any of these rights, email [email protected], call +256-200-977600, or visit the school office. We will reply within 30 days. We may need to confirm your identity first.
10. Deleting your account
School accounts are created and removed by the school administrator.
- Staff: your account is disabled when you leave the school, and deleted at the end of the staff retention period.
- Parents: to delete your parent portal account, email [email protected] or ask at the school office. We delete it within 30 days.
- Learners: a learner’s account is closed when they leave. Their academic and fee records are kept for the periods in section 7, then deleted.
You do not need the app installed to request deletion. An email to [email protected] is enough.
11. Changes to this policy
We will update this policy when MIS or the law changes. The date at the top shows the latest version. If a change is significant, we will tell users in the app or by message before it takes effect.
12. Contact
Manifest International Schools · Makaya Close, Plot 2, Naguru, Kampala, Uganda · [email protected] · +256-200-977600
If you are not satisfied with our answer, you can complain to the Personal Data Protection Office, National Information Technology Authority – Uganda (NITA-U), Kampala.