Privacy Policy

1. Who we are (data controller)

The data controller responsible for your personal data is Alonyo Technologies Limited, a company being established in the Republic of Uganda. Registered office address and company registration number will be published here upon completion of registration. In the interim, contact us at [email protected] or [email protected] ("AlonyoCloud", "we", "us", or "our").

We are the controller of data you provide to us directly (for example, when you sign up or contact us). When a school uses our Services to process student data, the school is the controller and we are the processor — see our Data Processing Agreement and Student Data Addendum for those arrangements.

We are not currently required to appoint a Data Protection Officer under Article 37 of the GDPR, but you can direct privacy questions to [email protected] and we will respond within 30 days.

2. What we collect

We collect only the information we need to run the Services. Nothing more.

Account data — your name, work email, school name, role, and login credentials when you sign up.
School data — student records, staff records, grades, attendance, and fee information that your school enters. When you enter student data, your school is the controller and we are the processor.
Usage data — pages visited, features used, IP address, browser type, and error logs to help us improve the product.
Billing data — payment method details processed securely by our payment providers. We never store full card numbers.
Communications — emails, support tickets, and chat messages you send us.
Cookies and similar technologies — see our Cookie Policy for details.

3. Why we collect it

Every data point we ask for has a job to do. We use the data we collect to:

Provide the Services you have signed up for.
Send transactional emails (receipts, password resets, verification codes, notifications).
Respond to your support requests.
Improve the product based on how it is actually used.
Protect the security and integrity of the Services.
Comply with legal and tax obligations.

We never sell your data. We never share student data with advertisers. We never train AI models on your school's data. Where a purpose requires your consent, we ask for it clearly and you can withdraw it at any time.

4. Legal basis for processing

Under the GDPR (and equivalent laws), we must have a valid legal basis for each type of processing. The list below shows the legal basis we rely on for each purpose:

Creating and managing your account — Contract (Art. 6(1)(b))
Providing the Services (including hosting, processing, and backing up your data) — Contract (Art. 6(1)(b))
Billing and payment processing — Contract (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c))
Sending transactional emails — Contract (Art. 6(1)(b))
Sending marketing emails (if you opt in) — Consent (Art. 6(1)(a))
Analytics and product improvement (anonymized) — Legitimate interest (Art. 6(1)(f))
Security, fraud prevention, and abuse detection — Legitimate interest (Art. 6(1)(f))
Legal and tax record-keeping — Legal obligation (Art. 6(1)(c))
Responding to legal requests and enforcing our Terms — Legitimate interest (Art. 6(1)(f))
Student data processing — Contract with the School (Art. 6(1)(b)), and the School is responsible for the lawful basis for its own processing.

Where we rely on legitimate interest, we have carried out a balancing test to ensure our interests do not override your rights. You can request details of that test by emailing [email protected].

5. Who we share data with

We share data with the following categories of recipients. These providers are contractually bound to process data only on our instructions and to protect it:

Ultahost — cloud infrastructure and application hosting. Processing in EU (Frankfurt). Safeguards: EU-based, GDPR-compliant.
Brevo — transactional email delivery (verification codes, password resets, notifications). Processing in EU (France). Safeguards: EU-based, GDPR-compliant.
NeoSpace — mailbox hosting for [email protected]. Processing location and safeguards per NeoSpace's published data protection terms; contact [email protected] for the current data sheet.
Cloudflare — DNS, network security, DDoS protection, content delivery, and email routing. Processing globally (USA HQ). Safeguards: SCCs (Module 2), SOC 2 Type II, ISO 27001.
Pesapal — payment processing for paid plans. Processing in Kenya (with operations across East Africa including Uganda). Safeguards: Kenya Data Protection Act 2019, Uganda Data Protection and Privacy Act 2019, contractual data protection terms.

A complete and up-to-date list of sub-processors is maintained in our Data Processing Agreement at https://alonyocloud.com/dpa/annex-3. We will notify you at least 30 days before adding a new sub-processor.

6. International data transfers

Our primary data storage is located in EU (Frankfurt). However, some of our service providers process data outside the country where you are located, including in the United States and the European Union.

Where we transfer personal data outside the European Economic Area, the United Kingdom, or any other jurisdiction with restrictions on international transfers (including Uganda under the Data Protection and Privacy Act 2019), we rely on:

European Commission adequacy decisions (where available).
Standard Contractual Clauses approved by the European Commission (2021/914).
The UK International Data Transfer Addendum (where applicable).
Contractual, organizational, and technical safeguards that ensure an equivalent level of protection.

You can request a copy of the relevant transfer mechanisms by emailing [email protected].

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this policy, unless a longer period is required by law. Typical retention periods:

Account data — while your account is active, then 30 days after closure to allow data export, then permanently deleted.
School data (student records, etc.) — while the school's subscription is active. On cancellation, 30 days for export, then permanently deleted unless the school requests earlier deletion.
Billing and tax records — 7 years from the end of the fiscal year, as required by tax law.
Support communications — 3 years from the date of last contact.
Security and error logs — 90 days.
Cookies — see our Cookie Policy for each cookie's lifetime.

Data that has been fully anonymized (so it can no longer be linked to an individual) may be kept indefinitely for statistical and product improvement purposes.

8. Children's privacy and student data

AlonyoCloud is used by schools to manage student records, which means the Services process personal data about children. We take this responsibility extremely seriously.

The school is the data controller for student data. Under COPPA (US), GDPR-K (EU/UK), and Uganda's Data Protection and Privacy Act 2019, the school is responsible for obtaining any required parental or guardian consent before entering a student's data into the Services. AlonyoCloud acts as a data processor on the school's instructions and does not itself collect data directly from children.

We apply the following principles to student data:

Data minimization — we collect only what is necessary to provide the school management features the school has enabled.
No advertising — we never serve behavioral advertising to students or use student data for advertising.
No data sales — we never sell student data.
No AI training — we never train AI models on identifiable student data. Aggregate, de-identified insights may be used to improve the product only with the school's explicit permission.
Parental rights — parents and guardians can request access to, correction of, or deletion of their child's data through the school. The school can then exercise these requests through the Services or by contacting us.
Age considerations — for users under 13 (US COPPA) or under 16 (EU/UK GDPR-K), the school must obtain verifiable parental consent before creating accounts.

Additional commitments specific to student data are set out in our Student Data Addendum at https://alonyocloud.com/student-data. That document forms part of the agreement

9. How we protect your data

Security is a foundation, not a feature. We protect your data using a layered approach that we review and improve as the platform grows:

All data is encrypted in transit using industry-standard TLS.
Sensitive data is encrypted at rest.
Access to production systems is restricted and protected by multi-factor authentication.
We take regular backups of school data.
We perform security reviews of our code and third-party dependencies.
We limit internal access to personal data to team members who need it to operate the Services.
We train our team in security best practices.
We work only with third-party providers who meet our security standards.

No system is perfectly secure. If we ever become aware of a security incident affecting your data, we will notify you and the relevant authorities in accordance with applicable law — see Section 14 below.

10. Your rights

Under the GDPR, CCPA, and similar laws, you have the following rights over your personal data:

Access — request a copy of all data we hold about you.
Correction — update or fix inaccurate information.
Deletion — request deletion of your account and data ("right to be forgotten").
Portability — download your data in a machine-readable format at any time.
Restriction — ask us to stop or limit certain processing.
Objection — opt out of processing based on legitimate interest, and opt out of direct marketing at any time.
Withdraw consent — where we rely on consent, you can withdraw it at any time.
Automated decisions — object to decisions made solely by automated means (see Section 13).
Complaint — lodge a complaint with a supervisory authority (see below).

To exercise any of these rights, email [email protected]. We respond within 30 days (or sooner). You will not be charged for exercising your rights. If you are not satisfied with our response, you have the right to complain to your local data protection authority — in Uganda, the Personal Data Protection Office; in the EU, your national DPA; in the UK, the ICO.

11. Third-party links

The Services may contain links to websites, plugins, or applications operated by third parties. This Privacy Policy does not apply to those third parties. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before providing them with any data.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email at least 30 days before they take effect, and the version number and effective date at the top of this page will always reflect the current version.

If a material change requires your consent under applicable law, we will ask for it explicitly rather than assuming it.

13. Automated decision-making

Currently, we do not make decisions with legal or similarly significant effects on you solely by automated means.

When we introduce AI-powered features (currently planned for AlonyoCloud AI in 2027), any automated grading or student-risk prediction will be presented as a suggestion only. The teacher or administrator will always make the final decision. If that changes for any feature, we will update this policy, notify affected schools in advance, and give you the right to object.

14. Data breach notification

If we become aware of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where legally required).
Notify affected schools without undue delay, including a description of the breach, its likely consequences, and the measures we have taken or propose to take.
Cooperate with schools so they can meet their own obligations to notify parents, students, and regulators.

Where we act as a processor, we notify the school (the controller) without undue delay, and the school is then responsible for notifying the relevant authority.

15. Do Not Sell or Share (CCPA)

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We have never sold personal information, and we have no plans to do so.

If our practices ever change, we will display a clear "Do Not Sell or Share My Personal Information" link on our homepage and honor it in accordance with California law.

California residents can also exercise any CCPA rights by emailing [email protected]. You have the right not to be discriminated against for exercising any privacy right.

16. Contact us

If you have any questions about this policy or how we handle your data:

Privacy: [email protected]
General: [email protected]
Legal: [email protected]
Mail: Kampala, Uganda (full address to be published upon completion of registration)

If you are not satisfied with our response, you can lodge a complaint with your supervisory authority. In Uganda: Personal Data Protection Office (PDPO). In the EU: your national data protection authority. In the UK: Information Commissioner's Office (ICO).