Website: https://www.ffedu.co.zw
Platform: FFEDU
Data Controller: Firm Foundation Country School
Technical Platform Administrator / Data Processor: Authorised FFEDU Technical Service Provider
1. INTRODUCTION
Firm Foundation Country School ("the School", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of personal information entrusted to it by learners, parents and guardians, employees, prospective employees, applicants, teachers, contractors and other persons who interact with the School through the FFEDU platform.
This Privacy Policy explains how personal information is collected, used, stored, accessed, disclosed and otherwise processed through the FFEDU platform and the website:
FFEDU is an online education, recruitment, communication, document-management and learning platform operated for the benefit and administrative requirements of Firm Foundation Country School.
The School recognises its responsibilities under the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe, applicable regulations, guidance issued by the Postal and Telecommunications Regulatory Authority of Zimbabwe ("POTRAZ") in its capacity as the Data Protection Authority, and other applicable laws and regulatory requirements.
This Privacy Policy should be read together with any specific privacy notices, consent forms, indemnity forms, application forms, registration forms, surveys, terms and conditions or other notices presented to individuals at the time their information is collected.
2. IMPORTANT: WHO IS RESPONSIBLE FOR PERSONAL INFORMATION?
2.1 Firm Foundation Country School – Data Controller
For personal information processed through FFEDU for the School's educational, administrative, recruitment, safeguarding, communication and related institutional purposes, Firm Foundation Country School is the Data Controller.
The School determines the purposes for which personal information is collected and used and determines, within the requirements of applicable law, the manner in which such information is used in carrying out its institutional functions.
Accordingly, the School is responsible for ensuring that personal information under its control is processed lawfully, fairly, transparently and securely.
2.2 FFEDU Technical Service Provider – Data Processor
The FFEDU platform is technically administered and maintained by an authorised technical service provider engaged by the School.
Where that service provider accesses, stores, retrieves, maintains, configures, troubleshoots, backs up, secures or otherwise processes personal information on behalf of Firm Foundation Country School, such processing is undertaken in the capacity of a Data Processor and on behalf of the School.
The technical service provider does not, by virtue of operating, maintaining or technically administering the FFEDU platform, become the Data Controller of the personal information processed on behalf of the School.
The technical service provider is expected to process personal information only:
- on behalf of the School;
- for authorised purposes;
- in accordance with the School's documented instructions;
- in accordance with applicable data-protection requirements;
- to the extent reasonably necessary to provide and maintain the FFEDU service; and
- subject to appropriate confidentiality and security obligations.
The technical service provider does not independently determine the purposes for which the School's learner, parent, employee, applicant or other institutional personal information is collected or used.
2.3 Domain registration and technical administration
The domain name associated with FFEDU may be registered and technically administered by the School's authorised technical service provider or another person acting on behalf of the School.
Domain-name registration, hosting administration, technical administration or system administration does not, by itself, determine the identity of the Data Controller.
The School remains the Data Controller for personal information processed through FFEDU for the School's institutional purposes.
The School's technical service provider may have privileged technical access necessary to maintain the platform. Such access is administrative and operational in nature and does not constitute ownership of the School's personal information or independent authority to determine the purposes for which such information is processed.
3. ABOUT FFEDU
FFEDU is a digital platform used by Firm Foundation Country School for various institutional purposes, which may include:
- learner e-learning accounts; access to educational materials; textbooks and reading resources; past examination papers and learning resources; learner and parent communications; online forms and surveys; school-trip and activity documentation; electronic indemnity and consent forms; recruitment and employment applications; communication with prospective employees; administrative records; school-related notices; user authentication and account management; and other educational or administrative functions introduced by the School.
The particular information collected depends on the service or function being used.
4. PERSONAL INFORMATION WE MAY COLLECT
Depending on the relationship between an individual and the School, we may collect different categories of personal information.
4.1 Learner information
- full name; date of birth; learner identification information; gender where necessary; class and grade; subjects; academic information; examination-related information; username and account information; contact information where applicable; participation in educational activities; information relating to school activities and trips; and other information reasonably required for the provision and administration of education.
4.2 Parent and guardian information
- name; contact details; relationship to the learner; communication preferences; consent and authorisation records; electronic signatures; indemnity and consent information; information submitted in connection with school trips and activities; and other information reasonably required for communication and administration.
4.3 Job applicants and prospective employees
- full name; contact details; residential or correspondence information; qualifications; professional experience; curriculum vitae; references; teaching subjects; professional registrations where applicable; application responses; interview information; assessment or examination results; documents submitted as part of an application; correspondence with the applicant; and other information reasonably required for recruitment and selection.
4.4 User account information
- username; email address; telephone number; password or authentication credentials; account preferences; profile information; and information necessary to administer access to FFEDU.
4.5 Technical information
- IP address; browser type; device information; operating system; login activity; timestamps; security logs; system errors; and other technical information generated through ordinary operation of the platform.
5. PERSONAL INFORMATION RELATING TO CHILDREN
Firm Foundation Country School recognises that learners may be children under the age of eighteen. The School therefore applies additional care when processing information relating to children. Where required by law or applicable regulatory guidance, the School may obtain consent or authorisation from a parent, guardian or other legally authorised person before processing a child's personal information.
The School seeks to ensure that: information relating to children is collected only where reasonably necessary; access is limited to authorised persons; information is not unnecessarily disclosed; appropriate security measures are applied; information is retained only for as long as reasonably necessary; and parents or guardians can exercise applicable rights on behalf of learners where permitted by law.
6. PURPOSES FOR WHICH PERSONAL INFORMATION IS USED
Personal information may be processed for purposes including:
- providing learners with access to educational resources; administering learner accounts; providing access to e-learning materials; administering examinations and academic activities; communicating with learners and parents; administering school activities and trips; obtaining and retaining electronic indemnities, consents and authorisations; administering recruitment and employment applications; evaluating candidates for employment; communicating with applicants; maintaining institutional records; providing school-related notices and information; authenticating users; protecting FFEDU against unauthorised access and misuse; investigating technical or security incidents; complying with legal and regulatory obligations; maintaining the reliability and security of FFEDU; responding to enquiries and requests; enforcing applicable terms and policies; and carrying out other legitimate educational or administrative purposes of the School.
7. LAWFUL PROCESSING
The School processes personal information only where there is a lawful basis for doing so. Depending on the circumstances, processing may be based on: consent; performance of an agreement or provision of requested services; compliance with a legal obligation; protection of the vital interests of an individual; legitimate institutional interests where permitted by law; or another lawful basis recognised under applicable Zimbabwean law.
8. INFORMATION COLLECTED THROUGH ONLINE FORMS
FFEDU may contain online forms used by the School for educational, administrative and operational purposes. Examples include: learner registration forms; parent forms; surveys; school-trip forms; medical or dietary information forms where applicable; indemnity forms; consent forms; recruitment forms; and other institutional forms. Each form should collect only information reasonably necessary for its stated purpose.
9. ELECTRONIC INDEMNITY AND CONSENT FORMS
Where parents or guardians complete electronic indemnity, consent or authorisation forms through FFEDU, the information submitted may be retained as part of the School's administrative and evidentiary records. Such information may include: parent or guardian identity; learner identity; emergency or relevant contact information; consent or authorisation; electronic signature; date and time of submission; information concerning the relevant school activity; and other information reasonably necessary for the administration of the activity.
10. RECRUITMENT AND JOB APPLICATIONS
Where individuals apply for employment through FFEDU, their information may be processed for recruitment and selection purposes. The School may: review applications; assess qualifications; conduct interviews; conduct assessments; communicate with applicants; contact references where appropriate and lawfully permitted; maintain recruitment records; and consider an applicant for future opportunities where appropriate and legally permissible.
11. DATA MINIMISATION
The School seeks to collect personal information that is adequate, relevant and limited to what is reasonably necessary for the purpose for which it is processed.
12. ACCURACY OF INFORMATION
The School seeks to maintain accurate and up-to-date personal information. Users should notify the School if information associated with their account is inaccurate or requires updating.
13. DATA RETENTION
The School does not intend to retain identifiable personal information indefinitely without a legitimate reason. Retention periods depend on: the purpose for which the information was collected; the nature of the relationship with the School; legal and regulatory requirements; accounting or administrative requirements; safeguarding considerations; employment and recruitment requirements; examination and academic requirements; contractual obligations; potential disputes or legal claims; and legitimate institutional record-keeping requirements.
14. WHO MAY ACCESS PERSONAL INFORMATION?
Access to personal information is restricted according to the individual's role and legitimate need. Depending on the circumstances, information may be accessed by: authorised School administrators; authorised teaching staff; authorised examination or academic personnel; authorised recruitment personnel; authorised school management; authorised persons responsible for school activities; the School's authorised technical service provider; relevant technology and hosting providers; and public authorities or other persons where disclosure is legally required or otherwise lawfully permitted.
15. TECHNICAL SERVICE PROVIDER ACCESS
The School's authorised technical service provider may require administrative access to FFEDU in order to: maintain the system; troubleshoot technical problems; apply system updates; configure functionality; maintain security; investigate system failures; restore functionality; manage user access; perform necessary technical maintenance; and provide other authorised technical services.
16. THIRD-PARTY SERVICE PROVIDERS
FFEDU may rely on third-party technology providers necessary for its operation. Depending on the services enabled, these may include: hosting providers; cloud infrastructure providers; email providers; authentication providers; document or electronic-signature services; analytics or security services; software providers; and other technology service providers.
17. ODOO PLATFORM
FFEDU uses the Odoo platform and associated services to provide certain website, e-learning, recruitment, communication, document-management and administrative functionality. Personal information processed through Odoo may therefore be subject to the technical architecture, security controls and processing arrangements applicable to the relevant Odoo services.
18. SECURITY OF PERSONAL INFORMATION
The School takes reasonable technical and organisational measures to protect personal information against: unauthorised access; unauthorised disclosure; accidental loss; destruction; alteration; misuse; unlawful processing; and other reasonably foreseeable security risks.
19. DATA SECURITY INCIDENTS AND BREACHES
Where the School becomes aware of a personal-information security incident, it will assess the incident and take reasonable steps to contain, investigate, mitigate and remediate it. Where notification is required under applicable law or regulatory requirements, the School will make the necessary notifications within the applicable timeframe.
20. INTERNATIONAL OR CROSS-BORDER PROCESSING
Some technology services used by FFEDU may involve infrastructure, support or processing outside Zimbabwe. Where personal information is transferred, hosted or otherwise processed outside Zimbabwe, the School will seek to ensure that the transfer and processing comply with applicable Zimbabwean data-protection requirements.
21. COOKIES AND TECHNICAL TECHNOLOGIES
FFEDU may use cookies and similar technologies necessary for: user authentication; maintaining sessions; remembering preferences; security; system functionality; performance monitoring; and other legitimate website functions.
22. DATA SUBJECT RIGHTS
Subject to applicable law and any lawful limitations, individuals may have rights concerning their personal information, including the right to: be informed about the use of their personal information; request access to personal information held about them; request correction of inaccurate or misleading information; object to certain processing; request deletion where legally applicable; withdraw consent where processing is based on consent; raise a concern regarding the processing of their information; and exercise other rights provided by applicable law.
23. HOW TO EXERCISE YOUR RIGHTS
Requests relating to personal information processed by FFEDU should be directed to Firm Foundation Country School. A request should, where reasonably practicable, include: the name of the person making the request; sufficient information to identify the relevant account or record; the nature of the request; relevant supporting information; and appropriate information needed to verify the identity of the requester.
24. REQUESTS RECEIVED BY THE TECHNICAL SERVICE PROVIDER
Because Firm Foundation Country School is the Data Controller, requests concerning the purposes, use, disclosure, correction, retention or deletion of School-held personal information should ordinarily be directed to the School.
25. DISCLOSURE REQUIRED BY LAW
The School may disclose personal information where required or authorised by applicable law, court order, regulatory requirement or lawful request from an authorised public authority.
26. CONFIDENTIALITY
Persons authorised to access personal information through FFEDU are expected to maintain confidentiality and use information only for authorised purposes. Unauthorised copying, downloading, disclosure, sharing, sale, publication or other misuse of personal information is prohibited.
27. OWNERSHIP AND CONTROL OF SCHOOL DATA
Personal information submitted to FFEDU in connection with the educational, administrative, recruitment or operational activities of Firm Foundation Country School is processed for the School's institutional purposes.
28. SEPARATION BETWEEN PLATFORM ADMINISTRATION AND DATA CONTROL
The School acknowledges that technical administration of a digital platform may require access to system infrastructure and certain personal information. However, technical access should not be interpreted as an independent determination of the purposes for which personal information is processed.
29. CHILD SAFEGUARDING AND SENSITIVE INFORMATION
The School may, where reasonably necessary and lawful, process information requiring heightened confidentiality, including information relating to learner welfare, safeguarding, medical or dietary requirements, emergency arrangements or other matters relevant to the safe administration of School activities.
30. RECRUITMENT DATA RETENTION
Recruitment information may be retained for as long as reasonably necessary for recruitment administration, record-keeping, legal compliance, dispute resolution, future recruitment considerations where appropriate, or other legitimate purposes.
31. ACCURACY AND USER RESPONSIBILITY
Users are responsible for providing accurate information when completing forms or creating accounts. Submitting another person's personal information without appropriate authority is prohibited.
32. ACCOUNT SECURITY
Users must: keep passwords confidential; avoid sharing account credentials; use appropriate passwords; log out from shared devices where appropriate; notify the School of suspected unauthorised access; and avoid attempting to access another person's account.
33. CHANGES TO THIS PRIVACY POLICY
The School may update this Privacy Policy from time to time to reflect: changes in legislation; regulatory guidance; changes to FFEDU; new services; changes in data-processing practices; security improvements; or institutional requirements.
34. COMPLAINTS AND PRIVACY CONCERNS
Individuals who believe that their personal information has been processed improperly are encouraged to contact Firm Foundation Country School first so that the School can investigate and, where appropriate, remedy the concern.
35. DATA PROTECTION GOVERNANCE
Firm Foundation Country School is responsible for establishing appropriate data-protection governance for personal information under its control.
36. RESPONSIBILITIES OF THE TECHNICAL SERVICE PROVIDER
The authorised technical service provider supporting FFEDU is expected to: process School personal information only for authorised purposes; follow the School's documented instructions; maintain appropriate confidentiality; implement reasonable technical and organisational security measures; restrict administrative access to authorised persons; assist the School in responding to legitimate data-subject requests where technically necessary; notify the School of relevant security incidents within a reasonable period; cooperate with the School in investigating data-security incidents; avoid using School personal information for unrelated purposes; not sell School personal information; not disclose School personal information to unauthorised persons; assist with deletion, return or secure disposal of information where instructed and technically appropriate; and otherwise comply with the applicable obligations of a data processor.
37. RESPONSIBILITIES OF FIRM FOUNDATION COUNTRY SCHOOL
As Data Controller, Firm Foundation Country School is responsible for: determining the legitimate purposes for processing personal information; ensuring that appropriate lawful bases exist for processing; determining what personal information is reasonably necessary; providing appropriate privacy information to data subjects; establishing appropriate retention requirements; determining who within the School should have access to personal information; responding to data-subject requests; ensuring appropriate institutional data-protection governance; managing its relationship with processors; ensuring that appropriate contractual and operational safeguards are implemented; and overseeing the lawful use of personal information within the School.
38. NO SALE OF PERSONAL INFORMATION
The School does not sell learners', parents', applicants' or employees' personal information. Personal information is processed for legitimate educational, administrative, recruitment, operational, legal and related purposes.
39. MARKETING COMMUNICATIONS
Where the School sends communications that constitute direct marketing, it will seek to comply with applicable legal requirements concerning consent, objection and opt-out mechanisms.
40. PRIVACY OF JOB APPLICANTS
Applicants are encouraged to review this Privacy Policy before submitting information through the FFEDU recruitment platform. By submitting an application, an applicant acknowledges that the information provided may be processed for recruitment and related legitimate purposes as explained in this Privacy Policy and any specific recruitment notice.
41. PRIVACY OF PARENTS AND GUARDIANS
Parents and guardians may provide personal information when communicating with the School, completing forms, signing indemnities, consenting to activities, submitting surveys or administering learner-related matters. Such information will be used for the relevant educational, administrative, safeguarding or operational purpose for which it was collected.
42. PRIVACY OF LEARNERS
Learners may have access to FFEDU through individual accounts. Learner accounts may be used to access educational materials, assignments, textbooks, reading materials, examination resources, notices and other educational content provided by the School.
43. THIRD-PARTY LINKS
FFEDU may contain links to external websites, resources or services. The School is not responsible for the privacy practices of websites that it does not control.
44. ADMINISTRATIVE LOGS
For security, troubleshooting and accountability purposes, FFEDU may maintain administrative and technical logs. Such logs may contain information such as: account identifiers; login times; IP addresses; technical events; system errors; administrative actions; and other information necessary for security and system administration.
45. DATA PROTECTION BY DESIGN
The School seeks to incorporate privacy and security considerations into the design and operation of FFEDU. Where new functionality involves personal information, the School may consider: whether the information is necessary; the purpose for processing; access requirements; retention requirements; security implications; risks to data subjects; and appropriate safeguards.
46. DATA PROTECTION IMPACT ASSESSMENTS
Where a proposed processing activity is likely to create significant risks to the privacy or rights of individuals, the School may conduct an appropriate privacy or data-protection impact assessment where required or considered appropriate.
47. RECORDS OF CONSENT
Where consent is required and obtained through FFEDU, the system may retain an electronic record of: the person providing consent; the relevant activity or purpose; the date and time; the information presented at the time of consent; and the consent or authorisation provided.
48. WITHDRAWAL OF CONSENT
Where processing is based on consent, a person may withdraw consent where legally applicable. Withdrawal should be directed to the School using the contact details provided in this Privacy Policy or in the relevant form or communication.
49. MINORS AND PARENTAL/GUARDIAN RIGHTS
Where a request concerns information belonging to a learner under eighteen, the School may require the requesting parent or guardian to establish their identity and authority to act on behalf of the learner.
50. LIMITATION OF THIS PRIVACY POLICY
This Privacy Policy describes the School's intended privacy and data-processing practices. It does not remove or reduce any mandatory rights or obligations imposed by Zimbabwean law.
51. CONTACT INFORMATION
Data Controller: Firm Foundation Country School
For privacy, data-protection, learner-information, parent-information and recruitment-data matters, individuals should contact Firm Foundation Country School through the official contact channels published on: https://www.ffedu.co.zw
Technical Platform Administration
FFEDU is technically administered and maintained on behalf of Firm Foundation Country School by its authorised technical service provider. Requests concerning the purpose, use, disclosure, correction, deletion or other exercise of rights relating to School-held personal information should be directed to Firm Foundation Country School as the Data Controller.
52. GOVERNING LAW
This Privacy Policy is intended to operate in accordance with the laws of the Republic of Zimbabwe, including applicable data-protection legislation and regulations.
53. ACKNOWLEDGEMENT
By using FFEDU, users acknowledge that they have been provided with appropriate information concerning the processing of personal information through the platform. Firm Foundation Country School remains committed to protecting the privacy, dignity and security of every individual whose personal information is entrusted to the School.
END OF PRIVACY POLICY