Privacy Policy

Skulio - Dusome (“we”, “us”, “the platform”) is a cloud-based, mobile-first school operating platform operated by Izyo Digital Suite for schools, teachers, parents and students in Rwanda and East Africa. This Privacy Policy explains what personal data we collect, why we collect it, how it is used and shared, and the rights you have over it.

It applies to every user of the platform — school administrators, finance officers, teachers, parents, guardians — and to students whose data is recorded by their school. By creating an account or allowing your school to record your or your child’s data, you agree to the practices described here.

Izyo Digital Suite is the data controller for platform account data (logins, roles, profile settings, audit logs). The school that creates a record is the controller for the student, guardian and educational data it enters; the platform acts as a processor on the school’s behalf for that data.

Controller contact: Izyo Digital Suite · info@izyogroup.com · +250 788 304 995 · izyodigital.com.

To operate Student 360 and the connected modules, we process:

• Account & identity: full name, email, phone, role, school assignment and authentication credentials.
• Student records: full name, admission number, date and place of birth, gender, photo (optional), grade and class, academic status, attendance, performance, behavior and welfare notes.
• Family & guardians: guardian name, email, phone, relationship, emergency and authorized contacts.
• Financial: fee structures, invoices, payments, method and transaction references.
• Operational: transport assignments and routes, homework, report cards, communications and audit-trail metadata.
• Usage & security: login times, IP address, device type and security events, used for protection and audit.

We use your data to provide the platform’s features — maintaining student records, recording attendance, managing fees and payments, sharing homework and report cards with parents, scheduling transport, and sending notifications and reminders.

We also use it to operate billing and subscriptions, to comply with legal obligations, to secure the platform, and to improve the product. Aggregated, de-identified statistics may be used for analytics and development. We never sell personal data.

We process personal data on the following lawful bases under Rwanda’s Data Protection & Privacy Law (Law N°058/2021):

• Consent — when you register an account or a school records a student with parental authorization.
• Contract — to deliver the services in your subscription.
• Legal obligation — record-keeping required by Rwandan education regulations.
• Legitimate interests — security, fraud prevention and audit, balanced against your rights.

Because student data concerns children, the platform is built around Rwanda’s Data Protection & Privacy Law (Law N°058/2021). A school must obtain parental or guardian authorization before creating a student record, and attests to that consent on enrollment.

We collect the minimum data needed to operate the school. Photos are optional. Parents and guardians may request access to, correction of, or deletion of their child’s data through their school. We do not profile children or use their data for marketing.

Data is shared only within the school community it belongs to, with authorized roles under strict role-based access control. Schools are organization-isolated: one school can never access another’s records.

We share data with processors — payment providers (MTN Mobile Money, Airtel Money, banks, card networks), email and SMS gateways, and hosting — solely to complete the relevant transaction, under contract and limited to what is necessary. We share with Rwanda’s SDMS only where a school authorizes an integration. Disclosure to authorities happens only where compelled by Rwandan law.

Records are encrypted in transit (TLS) and at rest. Access is role-based, least-privilege and logged for audit. Each school’s data is tenant-isolated. We review access regularly and maintain an incident-response process. Despite these measures, no system can be guaranteed perfectly secure.

Student and educational records are retained for the duration a student is enrolled and for the period required by Rwandan education record-keeping regulations, after which they are archived or deleted at the school’s direction. Account data is kept while a subscription is active and during any grace period for export. Audit logs are retained per our internal retention schedule.

Under Rwanda’s Data Protection & Privacy Law you may:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion (“right to be forgotten”), subject to record-keeping duties;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing relied on it;
• lodge a complaint with the relevant data-protection authority.

Submit requests through your school administrator or to info@izyogroup.com. We respond within 30 days.

The app uses essential local storage to keep you signed in and remember preferences such as theme and language. We do not use third-party advertising cookies. Any analytics is anonymized and used only to improve the product.

Data is primarily stored and processed with providers that may operate outside Rwanda. Where a transfer occurs, we rely on appropriate safeguards such as contractual clauses and limit the data to what is strictly necessary for the service.

We may update this Privacy Policy as the platform evolves. Material changes will be announced in-app and, where significant, by email. Continued use after the effective date constitutes acceptance. The “Last updated” date above reflects the latest revision.

Izyo Digital Suite · Email: info@izyogroup.com · Phone: +250 788 304 995 · Web: izyodigital.com.

If we cannot resolve a concern, you may complain to Rwanda’s data-protection authority.