Privacy Notice

1. Who This Notice Covers

This notice explains how Pass Always collects, uses, stores, protects, and shares personal data when learners, parents, administrators, or visitors use the platform. It is written with Uganda's Data Protection and Privacy Act, 2019 and Data Protection and Privacy Regulations, 2021 in mind, and also follows GDPR-style transparency for users who may be protected by EU data protection rules.

2. Personal Data We Collect

• Account data: name, username, email address, password, role, account status, and login activity.
• Learner profile data: user type, academic level, class, programme, year or stage, school name, selected subjects, selected domains, and profile photo where uploaded.
• Learning activity: viewed papers, downloaded papers, saved papers, completed papers, current question, completed questions, local study attempts, and locally stored bookmark or hard-question flags.
• Communication data: notifications, support messages, contact form messages, and related action links.
• Technical and security data: audit logs, timestamps, browser/session information available to the application, and security headers used to protect the service.

3. Why We Use Personal Data

We use personal data for clear learning and account purposes: creating accounts, personalizing the learner dashboard, showing relevant papers, tracking progress, saving study activity, sending service notifications, responding to support requests, improving content quality, protecting the system, and meeting legal or administrative obligations.

4. Legal Basis

We process data where it is needed to provide the learning service, where the user has given consent, where we have a legitimate interest in securing and improving the platform, or where we must comply with legal obligations. Where GDPR applies, these correspond to contract, consent, legitimate interests, and legal obligation bases.

5. Data Protection Principles

We aim to collect and use data fairly, lawfully, transparently, and only for relevant learning and platform purposes. We aim to keep data accurate, limit retention to what is needed, and apply security safeguards. These commitments reflect Uganda data protection principles and GDPR principles including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

6. Sharing and Disclosure

We do not sell learner personal data. Data may be visible to authorised administrators for support, content quality, security, and account management. We may also use hosting, email, storage, analytics, or security providers where needed to operate the service, subject to appropriate safeguards.

7. International Transfers

Some technical providers may process or store data outside Uganda. Where this occurs, we aim to use providers and safeguards appropriate for the nature of the data, including contractual or technical protections where required.

8. Retention

We keep account, learning, and progress records for as long as the account is active or as long as needed for learning continuity, security, dispute handling, audit, or legal reasons. Users can request account deletion from Profile settings. Deletion requests are reviewed before records are removed or anonymised.

9. Your Rights

Depending on applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction, objection to some processing, portability, withdrawal of consent, or information about how your data is used. Uganda law also recognises data subject participation and privacy protections, and GDPR provides rights such as access, rectification, erasure, restriction, portability, objection, and safeguards around automated decision-making.

10. Children and Learners

Pass Always is an education platform. Where a child or young learner uses the service, a parent, guardian, school, or authorised adult should guide account creation and use where required by applicable law or school policy.

11. Contact and Complaints

You can contact Pass Always through the Support page for privacy requests. You may also contact the relevant data protection authority where applicable, including Uganda's Personal Data Protection Office for Uganda data protection matters.