Privacy Policy — Zyqual SMS

1. Who we are

Zyqual is the data controller for personal data collected through this platform. We operate the Zyqual SMS platform, a school management system used by educational institutions. Each school (“tenant”) that uses the platform is also a data controller for the data of their students, staff, and parents.

2. What data we collect

Account information: Name, email address, role, and school affiliation when you create an account.
Usage data: With your consent, we collect anonymised analytics about how you use the platform (pages visited, features used). We do not use third-party analytics tools.
School data: Student records, attendance, grades, and other information entered by school staff. This data is controlled by the school and processed by us as a data processor on their behalf.
Technical data: IP addresses (anonymised), device type, and browser information — stored in hashed form, never in plain text.
Cookies: Session cookies required for login, and optional cookies for preferences and analytics. See our Cookie Policy.

3. How we use your data

To provide and operate the Platform
To authenticate users and maintain session security
To improve the Platform based on anonymised usage analytics (with your consent)
To process payments and manage subscriptions
To send important operational notifications
To comply with legal obligations

4. Legal basis for processing

We process personal data under the following lawful bases under UK GDPR:

Contract: To perform our service agreement with schools
Consent: For optional analytics and preference cookies
Legitimate interests: For security monitoring and fraud prevention
Legal obligation: Where required by law

5. Children's privacy

The Platform is used by schools and may involve processing data about children. We apply strict safeguards:

No advertising or tracking of children
No sponsored content shown to students
No sale or sharing of children's data
Student-facing areas are strictly protected from commercial content

6. Data sharing

We do not sell your personal data. We do not share your data with advertising networks. We may share data with:

Cloud infrastructure providers (for hosting)
Payment processors (Stripe) for billing
Email delivery services for operational notifications

All processors are bound by data processing agreements and appropriate safeguards.

7. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion (“right to be forgotten”)
Restrict or object to processing
Data portability
Withdraw consent at any time (for consent-based processing)

To exercise these rights, contact privacy@zyqual.com. For school-held data, please contact your school directly as they are the data controller for that information.

8. Data retention

We retain data for as long as necessary to provide the service and meet legal obligations. School data is retained for the duration of the subscription plus a 30-day grace period. Analytics data is retained for up to 24 months. Consent records are retained for 7 years for audit purposes.

9. Contact

For privacy-related queries: privacy@zyqual.com
You also have the right to lodge a complaint with the ICO: ico.org.uk