How school data is processed

The school decides what is recorded about its pupils, why, and for how long. In data-protection language the school is the controller of that data.

The software is supplied by ⁦Gandalfooli⁩, the company that makes Lekkol. When a school runs Lekkol offline — the default, and the normal case — we are not handling the data at all, because none of it reaches us. We become a handler only for a school that turns on cloud sync, or that asks us to host it.

• Offline installation: nothing. No account with us, no telemetry, no error reports, no copy of anything.
• Cloud sync turned on: the school’s operational records, listed on the privacy page, pushed by the school’s own server so that the school can restore them and use features needing a connection. The hub is built but is not yet running, and no school’s data is on it.
• Hosted by us: everything, because in that arrangement the database is ours to run on the school’s behalf. No school is hosted today.

Where we do process a school’s data, we do it to provide the service the school asked for, and on the school’s instruction.

We do not use school data to train anything, to advertise, to build something for a third party, or to contact families ourselves.

On an offline installation, nobody.

For the hub, or for hosting, a hosting company and a database company are unavoidable. They will be named on this page before any school’s data is placed on them, and schools will be told before one is added or changed.

A lawyer must settle this: The hosting and database providers have not been chosen, so there is nothing honest to name here yet.

• Passwords stored as one-way hashes, with lock-out after repeated wrong guesses.
• Role-based access inside the school, with health and emergency details behind a permission of their own.
• The sync channel authenticated by a key unique to each school.
• An audit trail of consequential actions, naming who did them.
• Automatic local backups at start-up, with an integrity check that refuses to back up a damaged database rather than overwriting a good copy with a bad one.

Written out rather than implied, because they are not yet done: backup files are not encrypted at rest, and the desktop application is not yet signed.

If data held by us is exposed, we will tell the affected schools without undue delay, and tell them what happened, what we know about which records are involved, what we have done, and what the school should do.

A lawyer must settle this: The deadline for notifying schools, and whether a regulator must be told as well, differs by country and has to be written in here.

A school can export everything at any time, without asking us.

A school that leaves can ask us to delete what is held on the hub.

What is on the school’s own computer stays the school’s to keep or to destroy; we cannot reach it, and we cannot delete it for you.

A lawyer must settle this: How long after a request deletion takes, and how long a copy survives in our own backups.

Sierra Leone, Guinea and Liberia do not share one data-protection law, and the rules in each are changing. Rather than claim compliance with three regimes, this statement sets out what actually happens and holds to a single standard: collect only what the school needs, show it only to those who need it, keep it where the school can control it, and say plainly where something is missing.

A lawyer must settle this: A lawyer in each of the three countries must confirm what registration, notification or consent this product additionally requires, and whether any of this data may not leave the country.