Privacy Policy

Last updated: May 2026

school365.ky is operated by Sanmol Software. We take the privacy of school staff, parents, students and ministry users seriously. This page summarises what we collect, why, and the choices you have. It's not legal jargon — if anything's unclear, email privacy@school365.ky.

Who we are

The platform is operated by Sanmol Software, a private software company. Each tenant (a school, a food vendor or a Ministry of Education) is a separate data controller for the personal data it loads or generates. We act as a data processor for our tenants.

What we collect

• Account data — name, email, hashed password, preferred language.
• Membership data — which organisations you belong to and what role you have.
• Operational data — meal orders, fee payments, attendance records and similar, uploaded by tenants for the function of their school operations.
• Payment data — only gateway-issued tokens, last 4 digits, card brand and expiry. We never store full card numbers or CVVs.
• Technical data — IP address, user agent, request timestamps, audit-log events. Used for security and abuse prevention only.

Where data lives

Data for European tenants is hosted on Oracle Cloud Infrastructure in the EU region. We're planning a Caribbean region in 2026. Backups stay in the same region as the primary data.

Children's data

Most students using school365.ky are under 16. We rely on the school as the data controller and the parent/guardian's express consent for processing. School admins are responsible for obtaining that consent and recording it.

Your rights (GDPR)

• Access — request a copy of your data via your tenant admin or privacy@school365.ky.
• Rectification — correct it yourself in your account settings or ask your admin.
• Erasure — close your account; data is anonymised after the retention period required for tax/accounting in your jurisdiction (typically 7 years for financial records).
• Portability — request a machine-readable export.
• Complain — to your local supervisory authority.

Subprocessors

• Oracle Cloud Infrastructure — hosting (EU region)
• SMTP2GO — transactional email delivery
• PlugnPay / CyberSource — payment processing (only when a tenant configures them)

Cookies

We use only essential cookies (authentication, anti-forgery, language preference). No tracking, no advertising, no third-party analytics that profile you. See our cookie banner on first visit.

Contact

Questions about this policy: privacy@school365.ky.
Data Protection Officer: dpo@school365.ky.