MySapienta

Privacy Policy

MySapienta LTD
Effective Date: 17 April 2026

1. Introduction

MySapienta LTD ("MySapienta", "we", "us", "our") is committed to protecting the privacy and security of all personal data processed through the MySapienta platform (the "Platform"). This Privacy Policy explains how we collect, use, store, share, and protect personal information in compliance with the Ghana Data Protection Act 2012 (Act 843) and all other applicable data protection laws.

This Policy applies to all individuals whose personal data is processed through the Platform, including school administrators, teachers, support staff, parents, guardians, and students (including minor students of any age). By using the Platform, you acknowledge that you have read and understood this Policy.

2. Data Controller Information

MySapienta LTD is the data processor in respect of School Data. The subscribing school (the "School") is the data controller of all student, parent, and staff personal data entered into the Platform. MySapienta processes such data solely on the School's behalf and instructions.

For data related to MySapienta's own business operations (e.g., School contact information, billing records), MySapienta acts as the data controller.

Registered Name: MySapienta LTD Address: Mankrah St, Haatso, Accra, Ghana Email: support@mysapienta.com

3. Data We Collect

3.1 School and Administrator Data

When a School registers and manages its account, we collect:

  • School name, physical address, and contact details
  • Billing and payment information (processed securely via our payment processor)
  • Names and email addresses of administrators and designated account contacts
  • Login credentials (passwords stored in hashed form and never readable by MySapienta staff)

3.2 Staff and Teacher Data

Schools may enter the following staff data into the Platform:

  • Full name, employee ID, and contact details
  • Role, department, and subject assignments
  • Attendance and payroll-relevant data (where the School uses those modules)

3.3 Student Data

Schools may enter the following student data into the Platform:

  • Full name, date of birth, and student ID
  • Class, year group, and enrolment history
  • Academic results, grades, and report card data
  • Attendance records
  • Fee payment history and outstanding balances
  • Parent/guardian contact information linked to the student record
  • Any additional notes or records entered by school staff

Because students may be of any age, including infants and toddlers in nursery settings, MySapienta treats all Student Data with the highest level of care and applies special protections under this Policy and Act 843.

3.4 Parent and Guardian Data

Schools may enter the following data for parents and guardians:

  • Full name and contact number
  • Email address (for portal access where enabled)
  • Payment details for fee transactions via the Platform

3.5 Biometric Data (Future Feature)

MySapienta intends to introduce biometric-based attendance verification (such as fingerprint scanning) in a future release. When this feature is activated:

  • Schools will be required to obtain explicit written consent from parents or guardians before enrolling any student's biometric data;
  • Biometric templates will be stored in encrypted form and used solely for attendance identification;
  • Biometric data will never be shared with third parties except as required to operate the feature;
  • Schools and individuals will be given the option to use an alternative non-biometric method of attendance tracking.

This Policy will be updated prior to the rollout of biometric features to reflect any additional obligations.

3.6 Usage and Technical Data

MySapienta automatically collects technical data when the Platform is accessed, including:

  • IP address, browser type, and device identifiers
  • Pages visited, features used, and session duration
  • Error logs and performance metrics

This data is used solely for maintaining Platform security and improving service quality. Google Analytics is used on the MySapienta public website (www.mysapienta.com) and not within the authenticated school Platform.

4. Legal Basis for Processing

Under the Ghana Data Protection Act 2012 (Act 843), MySapienta relies on the following lawful bases for processing personal data:

  • Contractual necessity: Processing required to deliver the Platform services under the subscription agreement with the School.
  • Consent: Where the School has obtained consent from parents, guardians, or adult users, particularly for sensitive data categories such as biometric data.
  • Legal obligation: Processing required to comply with applicable Ghanaian laws, including financial record-keeping and tax obligations.
  • Legitimate interests: Processing carried out for MySapienta's legitimate business interests (e.g., security monitoring, service improvement), where such interests are not overridden by the rights of the data subjects.

Schools, as data controllers, are solely responsible for identifying and maintaining their own lawful basis for entering personal data into the Platform, including ensuring that consents from parents and guardians are properly obtained and recorded, particularly for students who are minors.

5. How We Use Personal Data

MySapienta uses personal data for the following purposes:

  • Providing, operating, and maintaining the Platform and its features
  • Processing fee payments and generating financial records
  • Sending SMS and in-app notifications on behalf of Schools
  • Responding to support requests and enquiries
  • Detecting and preventing fraud, security breaches, and Platform misuse
  • Improving Platform functionality, user experience, and performance
  • Complying with legal and regulatory obligations

We do not use Student Data for advertising purposes. We do not sell, rent, or trade personal data with any third party for their own commercial use.

6. Artificial Intelligence and Automated Processing

MySapienta may incorporate AI-powered features using models provided by third-party AI providers, including but not limited to OpenAI, Google, and Anthropic. Where AI features process personal or School Data:

  • Data submitted to AI features will be processed in accordance with the applicable AI provider's data processing terms and agreements;
  • MySapienta will enter into data processing agreements with AI providers to ensure appropriate data protections are in place;
  • MySapienta will not use Student Data to train or fine-tune external AI models without the explicit written consent of the School;
  • Where AI features produce outputs affecting students (such as academic predictions or risk flags), Schools are responsible for human review before any action is taken;
  • Schools and Users will be informed when an AI-powered feature is active and when their data may be processed by a third-party AI model.

7. Data Sharing and Disclosure

MySapienta shares personal data only in the following circumstances:

  • Payment Processors: Fee transaction data is shared with our authorised payment processor to facilitate MoMo, bank, and card payments. Payment processors are contractually required to process data securely and only for payment purposes.
  • SMS Providers: Where bulk SMS features are used, contact numbers may be transmitted to our SMS gateway provider solely to deliver messages on behalf of the School.
  • AI Service Providers: Where AI features are enabled, relevant data may be processed by third-party AI providers under appropriate data processing agreements.
  • Analytics: Google Analytics is used on the MySapienta public website only. Anonymised, aggregated usage data may be used for service improvement.
  • Legal Requirements: We may disclose data if required to do so by a court order, law enforcement authority, or applicable Ghanaian law. Where legally permissible, we will notify the School before making such a disclosure.
  • Business Transfers: In the event of a merger, acquisition, or sale of MySapienta, School Data may be transferred to the successor entity, subject to equivalent data protection obligations.

We do not share personal data with any other third parties without the explicit written consent of the School.

8. Children's Data

MySapienta recognises that the Platform may process data relating to children of any age, including infants in nursery and pre-school settings. We apply the following protections:

  • Schools must obtain verifiable parental or guardian consent before entering any student data into the Platform, regardless of the student's age;
  • Student Data is never used for advertising or marketing purposes;
  • MySapienta restricts internal access to Student Data to staff who require it to operate and maintain the Platform;
  • Student Data is not shared with third parties except as described in Section 7 of this Policy;
  • Parents and guardians may request access to, correction of, or deletion of their child's data by contacting their School directly, as the School is the data controller.

MySapienta encourages all Schools to develop and maintain their own child data protection policies aligned with Ghana's Children's Act 1998 (Act 560) and Act 843.

9. Data Retention

MySapienta retains personal data for as long as necessary to provide the Platform services and to comply with applicable legal obligations. Specifically:

  • Active account data is retained for the duration of the School's subscription;
  • Following termination of a subscription, School Data is retained for a period of thirty (30) days, during which the School may request a data export;
  • After the thirty (30) day retention period, School Data is permanently and irreversibly deleted from all production systems;
  • Billing and financial transaction records are retained for a minimum of five (5) years in compliance with Ghanaian tax and financial reporting requirements;
  • Technical logs are retained for up to ninety (90) days for security and diagnostic purposes.

10. Data Security

MySapienta implements commercially reasonable technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include:

  • Encryption of data in transit using industry-standard TLS protocols
  • Encryption of sensitive data at rest
  • Hashed storage of user passwords
  • Role-based access controls limiting data access to authorised personnel only
  • Regular security reviews and vulnerability assessments
  • Server infrastructure maintained in a secure, monitored environment

No system can be guaranteed to be completely secure. In the event of a data breach that is likely to result in a risk to the rights and freedoms of data subjects, MySapienta will notify the affected Schools and, where required under Act 843, the Data Protection Commission (DPC), within a reasonable timeframe.

11. International Data Transfers

Where MySapienta uses third-party service providers (including AI providers and cloud infrastructure) that are located outside Ghana, personal data may be transferred internationally. MySapienta ensures that any such transfers are subject to appropriate safeguards, including contractual data processing agreements that require the recipient to protect data to a standard equivalent to Act 843.

Schools will be informed of any significant changes to the countries in which their data is processed.

12. Data Subject Rights

Under Act 843 and applicable law, individuals whose data is processed through the Platform have the following rights, which they may exercise through the School as the data controller:

  • Right to Access: The right to request a copy of the personal data held about them.
  • Right to Correction: The right to request correction of inaccurate or incomplete personal data.
  • Right to Deletion: The right to request deletion of personal data, subject to any legal retention obligations.
  • Right to Object: The right to object to certain types of processing.
  • Right to Data Portability: The right to receive their data in a structured, machine-readable format.

Schools are responsible for responding to data subject requests from their students, parents, and staff. Where MySapienta's assistance is required to fulfil a request, Schools should contact support@mysapienta.com. MySapienta will respond to such requests within thirty (30) days.

13. Cookies and Tracking

The MySapienta public website (www.mysapienta.com) uses cookies and Google Analytics to analyse visitor traffic and improve the website experience. This analytics tracking applies only to the public website and not to the authenticated school management Platform.

Users of the public website may manage cookie preferences through their browser settings. Disabling cookies on the public website will not affect access to or functionality of the Platform.

14. Changes to This Policy

MySapienta reserves the right to update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations, or regulatory requirements. Material changes will be communicated to Schools via the registered email address at least thirty (30) days before taking effect. Continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Policy.

15. Complaints and the Data Protection Commission

If you believe your personal data has been processed in a manner that violates Act 843 or this Policy, you have the right to lodge a complaint with the Data Protection Commission of Ghana (DPC). Information about filing a complaint with the DPC is available at www.dataprotection.org.gh.

We encourage individuals to contact us first at support@mysapienta.com so we can attempt to resolve any concerns directly before a formal complaint is made.

16. Contact Us

For any privacy-related questions, data access requests, or concerns, please contact us at:

MySapienta LTD Mankrah St, Haatso, Accra, Ghana support@mysapienta.com

MySapienta LTD | Mankrah St, Haatso, Accra, Ghana | support@mysapienta.com