Last updated 24 October 2026
Summary
EduSync is a school management system. Schools use it to keep records about their learners, parents and staff. This page explains what happens to that information, in line with Ghana's Data Protection Act, 2012 (Act 843).
- Schools own their records. Each school decides what it records and why. EduSync stores and processes those records for the school, under a written agreement.
- We never sell personal data, use school records for advertising, or send marketing messages to parents or staff.
- Each school's records are kept separate. Staff see only what their role allows, and parents see only their own children's records.
- You have rights. You can ask to see the information held about you, and ask for anything wrong to be corrected.
- If something goes wrong, we tell the school straight away and help it inform the Data Protection Commission and the people affected.
1. Who we are
About EduSync
EduSync ("EduSync", "we", "us") provides the EduSync school management platform, the staff portal (portal.edusyncghana.com), the parent portal (parent.edusyncghana.com) and this website.
Address: KNUST Campus, Kumasi, Ghana. Email: info@edusyncghana.com. Phone: +233 55 285 1039 or +233 53 290 0594.
Our two roles
The Act gives different duties to a data controller (who decides why information is collected) and a data processor (who handles it on the controller's behalf). EduSync plays both roles, for different information.
| Information | Who decides | EduSync's role |
|---|---|---|
| A school's records about its learners, parents and staff | The school | Data processor: we act only on the school's instructions |
| School contacts, billing, website enquiries, job applications, forms we send to school staff | EduSync | Data controller |
If your question is about a school's records, contact the school first. We will help the school answer you.
2. Information we handle
Records we keep for schools
What a school records depends on the school. EduSync lets schools keep the following:
| About | Information |
|---|---|
| Learners | Name, date and place of birth, gender, nationality, photo, admission number, classes and enrolment history, attendance, scores and reports, fees and payments, discipline and boarding records, home language, hometown, address, and national identifiers such as an NHIS or Ghana Card number |
| Parents and guardians | Name, phone numbers, email, address, occupation, employer, Ghana Card number, relationship to the learner, and parent portal sign-in details |
| Staff | Name, contact details, photo, qualifications and documents, role, attendance and leave, and for payroll their salary, bank details and SSNIT status |
| Everyone who signs in | Sign-in activity, and a record of the changes they make to records |
Special personal data
The Act gives extra protection to "special personal data". This includes all information about children under parental control, and information about health, religion and similar matters (section 37). In EduSync this covers:
- every learner's record;
- learners' medical details (blood group, allergies, conditions), disability and special educational needs; and
- learners' religion, orphan status, living arrangements and refugee status, where a school records them.
Schools record this information because it is necessary to teach and care for learners, and with the consent of parents. Most of the sensitive fields are optional, and schools are asked to record only what they need.
Information we collect for ourselves
- Schools and their contacts: the school's details, the people we deal with, and billing and payment records.
- Website enquiries: the name, role, school, phone number, email and message you send when you register interest.
- Job applications: what you enter in our application form, and any CV or document you attach.
- Forms we send to school staff: the answers given, and who gave them, unless the form is anonymous.
3. How we use it
What we use it for
- To provide EduSync to schools: records, attendance, results and reports, fees, payroll, timetables, lesson notes and messages.
- To send messages a school asks us to send, such as SMS to parents about attendance or fees.
- To send account messages, such as sign-in codes and password resets.
- To bill schools and keep our own accounts.
- To keep the platform secure, prevent misuse and fix problems.
- To answer enquiries and consider job applications.
What we never do
- We never sell personal data.
- We never use school records for advertising, and we never send marketing messages to parents or staff.
- We never use a school's records for our own purposes. We may produce statistics only from information that has been made anonymous, so that no person or school can be identified.
4. Who we share it with
Service providers
We share personal data only with the services that help us run EduSync. Each is bound by written terms to keep it confidential and secure.
| Service | What it does | Where |
|---|---|---|
| Microsoft Azure | Hosts the EduSync system and its database | European Union (Italy) |
| Arkesel | Sends SMS messages | Ghana |
| Namecheap Private Email | Sends email | United States |
| Paystack | Processes online payments: fees parents pay to schools, and schools' payments to EduSync | European Union (Ireland) |
| Vercel | Hosts this public website (no school records) | Global network |
Online payments
When a parent pays fees online, or a school asks a parent to pay, EduSync sends Paystack only what the payment needs: the amount, the school, the learner's name and EduSync ID, and a payment reference. When a school sends a mobile money prompt or a payment link, EduSync also sends the parent's phone number. EduSync does not send the parent's email address; Paystack is given an address made from the learner's ID that receives no mail.
Parents enter their mobile money or card details on Paystack's own secure page. EduSync never sees or stores card numbers or mobile money PINs. Paystack keeps a record of each payment as the law requires of payment providers.
Within a school
- Staff see only what their role allows. A teacher, for example, cannot see payroll.
- Parents see only the records of their own children.
- A school's records are never visible to another school.
When the law requires it
We disclose personal data only where the law requires it, such as a court order. Where the law allows, we tell the school first.
5. Where it is stored
The EduSync system and its database are hosted by Microsoft Azure in the European Union (Italy North). Messages and online payments are handled by the providers listed above.
The Act requires a controller to make sure that a processor based outside Ghana complies with Ghanaian law (section 30(4)). We have chosen providers with strong security standards, bind them by written terms, and declare where the data is held in our registration with the Data Protection Commission.
6. How long we keep it
We keep personal data only as long as its purpose needs, then delete it permanently or make it anonymous (section 24). Schools decide how long they keep their own records within these limits.
| Information | Kept for |
|---|---|
| A learner's core academic record (classes, end-of-term results, completion) | While the school uses EduSync, so it can issue transcripts and references |
| A learner's day-to-day records (attendance, continuous assessment, discipline, boarding) | Up to 3 years after the learner leaves |
| A learner's health, welfare and special needs details | Until the learner leaves |
| Learner photos and uploaded documents | Up to 1 year after the learner leaves |
| Parent and guardian details | Until their last linked learner leaves, plus 1 year |
| Fee bills and payments | 6 years after the end of the financial year |
| Staff employment and payroll records | 6 years after the staff member leaves |
| SMS and email logs | 12 months |
| Website enquiries that don't lead to a subscription | 12 months |
| Job applications | 6 months after the vacancy closes, unless you agree to longer |
| A school's data after it stops using EduSync | 90 days, so the school can take a copy, then deleted |
| Database backups | Up to 35 days, then overwritten automatically |
Anonymous statistics, from which no person or school can be identified, may be kept longer, as the Act allows for statistical and research purposes.
7. How we protect it
The Act requires reasonable technical and organisational measures against loss, damage and unauthorised access (section 28). Ours include:
| Area | What we do |
|---|---|
| Connections | Every connection to EduSync is encrypted (HTTPS) |
| Passwords | Stored only in a scrambled form that cannot be turned back into the password |
| Sign-in | Short-lived sessions; repeated sign-in attempts are limited to slow down password guessing |
| Separation | Every request is checked against the user's school and role, so a school's records are never visible to another school |
| Audit trail | Changes to records are logged with who made them and when |
| Backups | The database is backed up automatically |
| Secrets | Passwords and keys for our systems are kept in secure settings, never in our code |
| Uploads | Every upload has a size limit, and documents attached to forms are checked to be genuine PDF or Word files |
| Our team | Only EduSync staff who need access to provide or support the service can reach school data, and they are bound by confidentiality |
We review these measures regularly and update them as risks change.
8. Your rights
What you can ask for
Under the Act you can:
- Ask what we hold. Find out whether information about you is held, and get a description of it (section 32).
- Ask for corrections. Have information that is wrong, out of date, incomplete, excessive or unlawfully held corrected or deleted (section 33).
- Object. Object to your information being processed (section 20).
- Refuse marketing. Refuse to receive direct marketing. We do not send any.
- Complain. Complain to the Data Protection Commission.
Parents and guardians can make these requests for their children.
How to make a request
- About a school's records (a learner, parent or member of staff): contact the school. The school can see and correct most records directly in EduSync.
- About anything else, or if the school cannot help: email info@edusyncghana.com with your name, your school if relevant, and what you are asking for.
We may ask you to prove your identity before we act. We aim to reply within 21 days.
9. If something goes wrong
If personal data is accessed by someone who should not have it, the Act requires the Data Protection Commission and the people affected to be told as soon as reasonably practicable (section 31).
If this happens with a school's records, we will:
- close the gap and secure the system;
- tell the school's owner or head within 48 hours, with what happened, what information was involved and what we have done;
- help the school notify the Commission and the parents or staff affected, with enough detail for them to protect themselves; and
- find the cause and put it right.
10. Our commitments to schools
Every school signs a data processing agreement with EduSync, as section 30 of the Act requires. In it, EduSync commits to:
- process the school's data only to provide EduSync and on the school's instructions;
- keep it confidential, and let only staff who need it see it;
- maintain the security measures in section 7;
- use only the service providers listed in section 4, give 30 days' notice of any new one, and hold each to the same standards;
- never sell the data, use it for marketing or use it for our own purposes;
- pass on and help with requests from learners, parents and staff;
- tell the school of any breach within 48 hours;
- let the school export its data for 90 days when it leaves, then delete it permanently, including from backups within 35 days; and
- give the school the information it needs to show it complies with the Act.
To receive a copy of the agreement, email info@edusyncghana.com.
11. Guidance and templates for schools
As the data controller for its own records, each school has its own duties under the Act. This section helps you meet them. The templates are a starting point: adapt them to your school, and take legal advice if you are unsure.
What your school needs to do
- Register with the Data Protection Commission as a data controller. Processing personal data without registration is an offence (sections 27, 53 and 56). Registration is renewed every two years.
- Tell parents and staff what you record and why, using the notices below.
- Get parents' consent on your admission form, using the wording below.
- Record only what you need. Leave optional fields empty if you don't need them.
- Control access. Give staff only the roles they need, and remove access as soon as someone leaves.
- Keep exports safe. Lists and reports downloaded from EduSync contain personal data. Store them securely and delete them when no longer needed.
Privacy notice for parents and learners
How [School name] uses your child's information
[School name] keeps records about your child and about you to run the school. We use EduSync, a school management system, to store and manage these records on our behalf.
What we record: your child's name, date of birth, gender, photo, class, attendance, scores, reports, fees and payments; health and welfare details you choose to give us, such as allergies, medical conditions or special educational needs; and your details as parent or guardian: name, phone, email, address and relationship to the child.
Why: to teach and care for your child, report progress to you, manage fees, contact you, and meet our duties to the Ghana Education Service.
What you must give us: your child's name and date of birth, and at least one parent's name and phone number, are required for admission. Everything else is optional, but health information helps us keep your child safe.
Who sees it: only school staff who need it for their work, you, and EduSync, which stores it for us under a written agreement. Messages to you are sent by SMS or email. If you pay fees online, the payment is processed by Paystack, which receives your child's name, the amount and the phone number you pay from. We do not share your child's records with anyone else unless the law requires it, and we never use them for marketing.
Where it is stored: on secure servers run by Microsoft Azure in the European Union, under EduSync's protection measures.
How long we keep it: while your child is at the school, and for a limited time after they leave, as set out in our retention policy.
Your rights: you can see the records we hold about you and your child, ask us to correct anything wrong, and object to how we use them. Ask at the school office. You can also complain to the Data Protection Commission.
Contact: [School name], [address], [phone], [email].
Privacy notice for school staff
How [School name] uses your information
[School name] keeps your employment records in EduSync, which stores and manages them on the school's behalf.
What we record: your name, contact details, photo, qualifications and documents, role, attendance, leave, and for payroll your salary, bank details and SSNIT status. When you use the staff portal, EduSync also records your sign-in activity and the changes you make to records.
Why: to employ and pay you, meet our duties under Ghana's tax and pension laws (PAYE and SSNIT), plan teaching, and keep an accurate record of who changed what.
Who sees it: the Owner, Headmaster, HR and Accountant as their roles require, and EduSync under a written agreement. Payroll figures go to the authorities as the law requires.
Your duty with learners' information: you will see personal information about learners and parents. Use it only for your work at the school, do not share it outside the school, do not share your password, and sign out on shared computers. Report anything that looks like a data leak to [the Headmaster] at once.
Your rights: you can see and correct the information we hold about you. Ask [HR or the Headmaster].
Consent wording for admission forms
The Act allows special personal data, which includes all information about children, to be processed with consent (section 37). Separate optional boxes let a parent refuse one use without refusing admission.
Consent to the use of personal information
I have read [School name]'s privacy notice for parents and learners. As the parent or guardian of [learner's name], I agree that:
☐ Required. The school may record and use my child's and my personal information, including health and welfare details I provide, to admit, teach and care for my child, as described in the notice. I understand the school stores these records in EduSync, which keeps them on secure servers in the European Union.
☐ Optional. The school may take and keep my child's photo for school records, ID cards and class lists.
☐ Optional. The school may use photos of my child in school publications, its website or social media. I can withdraw this at any time.
☐ Optional. The school may contact me by SMS and email about my child's attendance, results, fees and school news.
I can withdraw any optional consent at any time by telling the school office.
Name of parent or guardian: ____________ Relationship: ________
Signature: ____________ Date: ________
12. Changes to this policy
We will publish any changes on this page with a new "last updated" date, and tell schools about important changes by email.
13. Contact us
- Email: info@edusyncghana.com
- Phone: +233 55 285 1039 or +233 53 290 0594
- Post: EduSync, KNUST Campus, Kumasi, Ghana
You can also contact the Data Protection Commission of Ghana if you are unhappy with how your information has been handled.