1. About this policy
This policy explains how Bitosoft Innovations Hub Co. Ltd ("we", "us") handles personal data when you visit this website, ask for a demo, or use Twegese, our school management service. We follow the Data Protection and Privacy Act, 2019 of Uganda and its regulations.
Who we are:
- Bitosoft Innovations Hub Co. Ltd, a company registered in Uganda.
- Address: Masindi, Uganda.
- Email: [email protected]
2. Our role and your school's role
- Information your school puts into Twegese — about learners, parents and guardians, and staff — belongs to the school. The school is the data controller: it decides what is collected and why. We are the school's data processor: we store and process that information only to provide Twegese to the school, following the school's instructions and our agreement with it.
- Information about website visitors, people who request a demo, and our schools' contact and billing details is handled by us as data controller.
If you are a parent, guardian, learner or staff member and have a question about your records in Twegese, please contact your school first. We will help the school answer you.
3. Information we collect
3.1 When you visit this website
We do not use analytics, advertising or social media trackers, and we do not load fonts, scripts or images from other companies. Like most websites, our web server records technical information when a page is requested — IP address, date and time, the page requested and browser type — to keep the service secure and working. See also our Cookie Policy.
3.2 When you ask for a demo
Your name, your school's name, and an email address or phone number are required. Your role, the number of learners and a message are optional. We also record that you agreed to this policy, the date, the policy version, and whether you asked to receive news from us.
3.3 When you message us on WhatsApp
The WhatsApp button opens WhatsApp with a message you can edit before sending. Nothing is sent until you press send in WhatsApp. If you do, we receive your WhatsApp name, number and messages. WhatsApp (Meta) handles that conversation under its own privacy terms. We use it only to reply to you.
3.4 When your school uses Twegese
- User accounts: name, email address and/or phone number, role, and a one-way hash of the password (we never store passwords in readable form). Parent portal users sign in with the phone number the school holds and a PIN, which is also stored as a hash.
- Activity records: an audit trail of important actions (for example approvals, payments and changes to settings) with the user, time, IP address and browser type, and technical error reports.
- Staff clock-in and clock-out, if the school uses it: the time, the device location (GPS coordinates and accuracy), the distance from the school site, a selfie taken at that moment, and the IP address and browser. The school uses these only to confirm attendance.
- AI Support questions: the text staff type into the optional AI Support assistant and the user's role (see section 6).
- School records, entered by the school: depending on the modules the school uses, these can include learners' names, dates of birth, sex, nationality, photos, classes, admission details, marks, results, report-card comments, attendance, library and hostel records, fees and payments; parents' and guardians' names, relationship, phone numbers, email and address; and staff names, contact details, employment details, salary and bank details, and payslips.
- Sensitive information, if the school chooses to record it: learners' health and medical notes, sick-bay visits, blood type, special needs and religion, and national identification numbers. The law gives this kind of information extra protection. Schools should record it only when they have a lawful reason and, where required, consent.
- Billing records: your school's subscription plan, invoices and payments to us.
4. How we use information and why
| Purpose | Information | Lawful basis |
|---|---|---|
| Reply to your demo request and arrange a demo | Demo request details | Your consent, which you can withdraw at any time |
| Send occasional news about Twegese | Name and email or phone | Your separate, optional consent; every message explains how to stop |
| Provide Twegese to schools, including support | User accounts, school records | Our contract with the school, and the school's own lawful basis for its records |
| Keep the service secure, prevent misuse and fix faults | Server logs, audit trail, error reports | Our contract with the school and our legal duty to keep data secure |
| Invoice schools and keep accounts | Billing records and school contact details | Our contract with the school and tax and accounting laws |
We do not sell personal data, use it for advertising, or use school records — including learners' information — to build marketing profiles or to train artificial intelligence models.
Twegese can calculate grades and positions and suggest report-card comments automatically, using rules the school sets. The school reviews and can change these before publishing results.
5. Children's information
This website and the demo form are meant for adults acting for a school. Learners' information reaches Twegese only through their school. Under the Data Protection and Privacy Act, 2019, schools are responsible for having a lawful basis for collecting children's information — including the consent of a parent or guardian where the law requires it. We process it only on the school's instructions.
6. Service providers and sharing
We use a small number of service providers who process personal data for us under confidentiality and security obligations:
| Provider | What they do | Information involved |
|---|---|---|
| Our hosting provider | Servers, databases and backups that run Twegese | All information held in Twegese |
| Cloudflare, Inc. (global network; United States company) | Delivers the website securely and protects it against attacks. All traffic to Twegese passes through it. | IP address, browser details and the pages requested; encrypted traffic is decrypted at Cloudflare to route it |
| ThinkX Cloud (ThinkSMS), Uganda | Delivers SMS messages from schools to parents, guardians and staff | Recipient phone numbers and message text |
| Groq, Inc. (United States) | Answers questions typed into the optional AI Support assistant | The question text and the user's role. We do not send user names or school records. Staff are asked not to type personal details into the assistant. |
If a school connects SchoolPay, MTN Mobile Money or Airtel Money, those providers send payment notifications to Twegese so the school's records update. Those providers work for the school under the school's own agreements with them. Twegese does not receive or hold school fees.
We may also disclose information when the law requires it (for example a court order), to protect people's safety or our legal rights, or to a buyer of our business, who must keep this policy's protections.
7. Transfers outside Uganda
Some of our providers process data outside Uganda. For example, website traffic passes through Cloudflare's global network, and AI Support questions are processed in the United States. We only transfer personal data outside Uganda where the Data Protection and Privacy Act, 2019 allows it, for example where the provider protects the data at least as well as Ugandan law requires. Staff who do not want their questions processed abroad can simply not use AI Support. You can ask us for details of any transfer.
8. How long we keep information
- Demo requests: up to 24 months after our last contact with you, then deleted. You can ask us to delete them sooner.
- School records: for as long as the school uses Twegese. When a subscription ends, the school can ask for a copy of its records. We then delete the school's data from our live systems, and it is removed from backups as those backups expire, unless the school asks us to keep it longer or the law requires us to.
- Billing records: for as long as tax and accounting laws require.
- Server logs and error reports: only as long as needed for security and fixing faults.
- AI Support: we do not store AI Support conversations on our servers. The conversation stays in the browser tab until it is closed.
9. How we protect information
- Each school's records are kept in a separate database.
- Access is controlled by role, and teachers can be limited to the classes they teach.
- Passwords and PINs are stored only as one-way hashes, and repeated failed sign-in attempts are temporarily blocked.
- Forms are protected against cross-site request forgery, and important actions are recorded in an audit trail.
- Each school's database can be backed up and restored.
- All connections to Twegese are encrypted with HTTPS.
No system is completely secure. Schools should give each person their own account, choose strong passwords, and remove accounts when staff leave.
10. Your rights
Under the Data Protection and Privacy Act, 2019 you have the right to:
- be told how your personal data is used, and get a copy of it;
- have inaccurate or out-of-date data corrected, and ask for data to be deleted where there is no longer a lawful reason to keep it;
- object to or ask us to stop processing that is causing you damage or distress;
- stop direct marketing at any time;
- withdraw consent you have given, without affecting what was done before; and
- complain to the Personal Data Protection Office.
To use these rights for information we control, email [email protected]. We may need to confirm your identity first. For school records, contact the school; if you contact us, we will pass your request to the school and help it respond.
11. Security incidents
If a security incident affects personal data, we will tell the affected school without undue delay so it can meet its own obligations. Where the law requires, we will notify the Personal Data Protection Office and, where appropriate, the people affected.
12. Cookies
We only use cookies that are needed for the website and sign-in to work securely. Read the Cookie Policy for the full list.
13. Changes to this policy
We may update this policy when our service or the law changes. We will post the new version here with a new effective date and, for important changes, tell our schools in advance.
14. Contact us and complaints
For privacy questions or requests, email [email protected].
If you are not satisfied with our answer, you can complain to the Personal Data Protection Office of Uganda.