1. Introduction

This Privacy Policy explains how CampusBook collects, uses, stores, shares and protects personal information when you use our websites, portals, applications and related services.

CampusBook is an education management platform operated by QuestLyft Ltd. Depending on how you interact with CampusBook, information may be provided directly by you, created through your use of the platform, or provided by an education institution that uses CampusBook to manage its operations.

We process personal information in accordance with applicable data-protection requirements in Uganda, including the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.

2. Scope of this policy

This policy applies to people who interact with CampusBook, including:

• prospective students and applicants;
• enrolled students and alumni where applicable;
• parents, guardians or sponsors where their information is required;
• institution administrators, lecturers, instructors and other staff;
• authorised institutional users;
• visitors to CampusBook websites and portals; and
• persons who contact us for support, product enquiries or other services.

3. Information we collect

The information processed through CampusBook depends on the services being used and the requirements of the institution providing those services.

3.1 Personal and contact information

This may include your name, date of birth, gender, nationality, telephone number, email address, residential address, photograph and other identification details.

3.2 Application and admission information

Where you apply to an institution through CampusBook, we may process course selections, academic qualifications, previous schools or institutions, supporting documents, application status, admission decisions and related correspondence.

3.3 Student and academic information

For enrolled students, CampusBook may process registration information, programme and course information, class records, academic results, attendance, progression, examination eligibility, completion status and other records maintained by the institution.

3.4 Financial and payment information

CampusBook may process student account balances, fees assessed, payments, receipts, sponsorship information and financial transaction references. Where payments are processed by third-party payment providers, CampusBook may receive transaction status and reference information needed to reconcile the payment with the relevant student or applicant account.

3.5 Account and technical information

We may collect usernames, account identifiers, login records, device and browser information, IP addresses, security logs, activity records and other technical information required to operate, secure and troubleshoot the platform.

3.6 Support and communication information

When you contact CampusBook or your institution through the platform, we may retain the details of your enquiry, correspondence and any information you provide in order to respond and maintain an appropriate support record.

4. How we use information

Personal information may be processed to:

• create and manage user accounts;
• receive and process applications for admission;
• manage student registration and academic records;
• support fee assessment, payment recording and financial reconciliation;
• enable authorised institutional workflows and approvals;
• issue notifications, documents and service-related communications;
• provide technical and customer support;
• protect users, institutions and the platform from misuse or unauthorised access;
• maintain audit trails and operational records;
• improve the reliability and usability of CampusBook; and
• meet applicable legal, regulatory and contractual obligations.

5. Basis for processing personal information

Depending on the circumstances, personal information may be processed with your consent, for the performance of a service or contractual relationship, to comply with a legal obligation, to protect legitimate interests permitted by law, or on another lawful basis available under applicable data-protection requirements.

Where consent is the appropriate basis for processing, we will seek consent in a manner appropriate to the information and service involved.

6. Education institutions and CampusBook

CampusBook is used by education institutions to manage admissions, students, academic processes, financial records and related institutional operations. In many of these situations, the institution determines why particular student or applicant information is required and how that information should be used.

CampusBook processes such information to provide the services requested by the institution, subject to applicable law, contractual requirements, authorised access controls and documented platform functionality.

Questions about an institution's academic, admissions, financial or student records may therefore need to be directed to the institution concerned.

7. When information may be shared

We do not sell personal information. Information may be disclosed only where reasonably necessary for the operation of CampusBook or where disclosure is otherwise permitted or required by law.

This may include disclosure to:

• the education institution responsible for the relevant applicant or student record;
• authorised personnel acting on behalf of that institution;
• technology, hosting, communication or payment service providers supporting CampusBook;
• professional advisers or auditors where appropriately required; and
• public authorities, regulators or law-enforcement bodies where disclosure is legally required.

Service providers that process personal information on our behalf are expected to use it only for the relevant service and to protect it appropriately.

8. How we protect information

CampusBook uses administrative, organisational and technical safeguards intended to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

These measures may include:

• role-based access controls and user permissions;
• authentication and account-security controls;
• secure transmission of information;
• logging and audit trails;
• backup and recovery procedures;
• restricted administrative access; and
• ongoing security and system maintenance practices.

No electronic service can guarantee absolute security. Users are also responsible for keeping their account credentials confidential and for promptly reporting suspected unauthorised access.

9. How long we keep information

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, to provide the relevant service, to satisfy institutional recordkeeping requirements, or to comply with applicable legal and regulatory obligations.

Retention periods may therefore differ between application records, student academic records, financial records, system logs and support information. Where CampusBook processes information on behalf of an institution, retention may also be determined by that institution's lawful recordkeeping requirements.

10. Your privacy rights

Subject to applicable law and the circumstances in which your information is processed, you may have rights relating to your personal information, including the right to:

• be informed about the collection and use of your personal information;
• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request blocking, erasure or destruction where permitted by law;
• object to or prevent certain processing, including direct marketing;
• raise concerns about automated decision-making where applicable; and
• make a complaint regarding the handling of your personal information.

Some requests concerning student or applicant records may need to be handled directly by the education institution responsible for those records. We will assist in directing or processing such requests where appropriate.

11. Children and minors

CampusBook may be used by education institutions whose applicants or students include persons below the age of majority. Where personal information relating to a child is collected or processed, the institution and CampusBook will apply the consent, authorisation and other safeguards required by applicable law.

Parents, guardians or other authorised persons may be required to provide information or consent where legally necessary.

12. Cookies and similar technologies

CampusBook websites and portals may use cookies and similar technologies to maintain sessions, remember user preferences, improve security, understand platform usage and support reliable operation of the service.

More information about the categories of cookies we use and the choices available to you is provided in our Cookie Policy.

13. Storage and transfer of information

CampusBook may use technology and service providers that store or process information using infrastructure located in Uganda or in other jurisdictions. Where personal information is transferred across borders, appropriate measures will be applied as required by applicable data-protection law.

14. Changes to this Privacy Policy

We may update this Privacy Policy when CampusBook services, legal requirements, technology or our privacy practices change. The current version will be published on this page together with the date it was last updated.

Where a change materially affects how personal information is processed, we may provide additional notice through CampusBook or other appropriate communication channels.

15. Contact us

If you have a question about this Privacy Policy, wish to exercise a privacy right, or believe your personal information has not been handled appropriately, please contact CampusBook.

If you believe your data-protection rights have been infringed, you may also have the right to lodge a complaint with Uganda's Personal Data Protection Office.