Privacy & Data Protection Policy

The Matigo Examinations Board ("we", "our", "us", or "Platform") is committed to protecting the privacy, confidentiality, and security of all personal data entrusted to us. This Privacy & Data Protection Policy explains how we collect, process, store, retain, and protect the personal data of:

1. School Administrators & Teachers: Educational representatives who register and manage institutional accounts.
2. Student Candidates (Minors): Students enrolled by their schools for mock examinations and assessment tracking.
3. Scorers & Examiners: Educators applying or appointed to score mock examination scripts.
4. General Visitors: Individuals accessing public informational pages on matigoexams.org.

Under the Uganda Data Protection and Privacy Act, 2019:

• The Educational Institution (School): Acts as the Data Controller in respect of student and candidate records. The school determines the necessity of mock assessment participation, verifies parental/guardian consent, and authorizes student data upload.
• Matigo Examinations Board: Acts as the Data Processor. We process candidate records solely pursuant to documented instructions from the school, as formalized in our Data Processing Agreement.
• In respect of registered account credentials (administrators, examiners, inquiries): Matigo Examinations Board acts as the Data Controller for the administration and security of user accounts.

3.1 Student / Candidate Data (Minors)

Submitted exclusively by authorized school administrators via bulk spreadsheets, UNEB draft registers, or manual enrollment:

• Full Legal Name
• Student Identification Number / UNEB Index Number
• Education Level: (PLE, UCE, or UACE)
• Gender / Sex and Age (where included in official registers)
• Class Stream / Division
• Enrolled Subject Combinations and Papers
• Academic Assessment Scores, Paper Marks, Aggregate Points, and Computed Grades

3.2 School Representative & Account Data

• School Name, UNEB Center Number, and District Location
• Administrator Full Name, Contact Telephone Number, and Official Email Address
• Account Password (cryptographically hashed using standard secure protocols; never stored in plaintext)
• Recovery Email Address
• Billing Records, Invoices, and Proof of Payment

3.3 Scorer & Examiner Data

• Teacher Full Name, Telephone Number, and Personal Email Address
• School of Contact / Current Educational Institution
• Subject Competencies, Paper Codes, and Education Levels
• Teaching Experience and Ministry of Education / NTC Registration Number
• Marking Activity Logs and Assessment Audit Records

3.4 Technical & Interaction Data

• IP addresses, device metadata, browser type, and authentication session tokens (__session)
• Inquiry submissions made through the contact portal

We process personal data strictly under valid lawful bases recognized by data protection legislation:

1. Performance of Contract: Processing required to administer mock examinations, compute grades, generate report slips, and fulfill service agreements with participating schools.
2. Legal & Institutional Authorization: Educational institutions submit minor candidate data under statutory educational mandates or verifiable parental/guardian consent.
3. Legitimate Educational Interest: Ensuring standardized assessment benchmarks, detecting data entry anomalies, and providing robust comparative academic analytics.
4. Consent: Freely given consent provided by examiners and public inquirers upon submitting applications or contact requests.

Given that student candidates are primarily minors:

• No Direct Marketing: Student data is never used for commercial advertising, targeted profiling, behavioral tracking, or sales solicitation.
• Strict Need-to-Know Access: Candidate details are visible only to authorized school administrators from their respective school, assigned examiners during active grading windows, and authorized platform technicians.
• No Public Results Directory: Candidate scores are private and accessible solely behind authenticated, role-based institutional portals.

Matigo Examinations Board implements enterprise-grade technical safeguards:

• Encryption in Transit: All traffic is encrypted using modern TLS (Transport Layer Security) 1.3 / HTTPS.
• Encryption at Rest: All databases, file stores, and backups are hosted in secure, ISO/IEC 27001-certified Google Cloud / Firebase data centers with AES-256 encryption at rest.
• Granular Database Security Rules: Cloud Firestore security rules enforce strict tenant isolation, preventing unauthorized cross-school data access at the database layer.
• Audit Logging & Incident Monitoring: Continuous monitoring of data mutations, marks submissions, and authentication events.

1. Active Academic Year: Student records, assessment marks, and digital result slips are retained for the duration of the academic year and the subsequent audit cycle.
2. Archival & Record Integrity: Aggregated school performance figures are retained for historical comparative analytics.
3. School Account Termination / Data Purge: Upon formal written request by a school controller or upon account termination, student candidate records may be exported and securely purged from active production databases within sixty (60) days, subject to statutory tax and accounting retention requirements.

We engage reputable cloud infrastructure subprocessors bound by strict data protection agreements:

• Google Cloud Platform / Firebase: Database hosting, authentication services, and cloud storage (compliant with SOC 1/2/3, ISO 27001, and GDPR).
• Email Delivery Providers: Transactional notifications (account approvals, password resets).

We do not sell, rent, or lease personal data to any commercial broker or third-party marketing agency.

Under applicable data protection laws, individuals (and parents/guardians on behalf of minor students through their respective schools) have the right to:

1. Request Access: Obtain confirmation of whether their personal data is being processed and receive a copy of such data.
2. Request Rectification: Correct inaccurate, incomplete, or outdated personal or academic records.
3. Request Erasure: Request deletion of personal records where there is no longer a lawful basis for continued retention.
4. Object to Processing: Object to specific processing activities on legitimate grounds.
5. Lodge a Complaint: Lodge a complaint with the National Information Technology Authority - Uganda (NITA-U) Data Protection Office if you believe your data protection rights have been violated.

> *Note for Parents/Students:* Because candidate records are submitted by schools, requests regarding student marks and personal information should first be directed to the respective school administrator (the Data Controller).

Our use of cookies and local browser storage is restricted to essential authentication session maintenance, security tokens, and functional preferences. Full disclosures are available in our Cookie Policy.

We may update this Privacy Policy periodically to reflect technological, operational, or legal developments. The "Last Updated" date at the top indicates the latest revision. Substantial changes will be communicated via portal announcements or email notifications to registered administrators.

For inquiries regarding this policy, data subject requests, or security notices, contact:

Data Protection & Privacy Desk

Matigo Examinations Board

• Email: privacy@matigoexams.org / compliance@matigoexams.org
• Postal Address: P.O. Box 9060, Kampala, Uganda
• Website: https://matigoexams.org