This School Management System is provided by Greenfield SMS, a software service operating under the Data Protection Act, 2012 (Act 843) of Ghana. We act as a data processor on behalf of your school, which is the data controller.

Contact: info@greenfieldsms.com · Accra, Ghana

We collect and process the following categories of personal data:

• Students: Full name, date of birth, gender, class, home address
• Parents/Guardians: Full name, phone number, email address
• Staff: Full name, role, department, phone, email, subjects taught
• Academic Records: Attendance, grades, term results, report cards
• Financial Records: Fee payments and balances (no bank or card data)
• System Users: Login email, role, access logs

We collect personal data under the following lawful grounds as defined in Section 20 of Act 843:

• To perform the school management service under contract with the school
• To enable teachers to mark attendance and record grades
• To enable parents to view their child's academic progress
• To enable the school to manage fee collection and financial reporting
• To send school announcements and notices to the relevant audience

We only collect what is necessary to run the school management system. We do not collect health records, political opinions, religious beliefs, ethnicity, or any other special category data as defined under Section 37 of Act 843.

We take the following technical and organisational measures to protect personal data:

• All data is stored on Google Firebase (Firestore), a secure cloud database with encryption at rest and in transit
• All connections use HTTPS encryption via Cloudflare
• Access is controlled by role-based authentication — admins, teachers, parents and students each see only what is relevant to them
• Passwords are never stored in plain text
• Firebase security rules prevent unauthorised access to collections

• School Admin: Full access to all school data
• Teachers: Access to academic data only — no financial records
• Parents: Access only to their own child's records
• Students: Access only to their own timetable, grades and notices
• Greenfield SMS: Technical access for system maintenance only — we do not read or share school data
• Google Firebase: Hosts the data under Google's own data protection policies

We do not sell, share, or disclose personal data to any third party for any commercial purpose. This is prohibited under Sections 88 and 89 of Act 843.

Student and academic data is retained for the duration of the school's subscription. When a school ends its subscription, all data is deleted within 30 days unless the school requests a data export before deletion. The school is responsible for keeping their own archives.

Data is stored on Google Firebase servers located in Europe (eur3). This transfer is necessary to provide the cloud-based service. Google operates under internationally recognised data protection standards and the data is protected under their processing agreements.

Under the Data Protection Act, 2012, you have the right to:

• Access — request to see the personal data held about you or your child
• Correction — request that inaccurate data be corrected
• Deletion — request that your data be deleted when no longer needed
• Object — object to certain types of processing

To exercise these rights, contact your school admin directly. The school is the data controller and will respond within 40 days as required by Section 35(10) of Act 843.

In the event of a data breach, we will notify the school and the Data Protection Commission as soon as reasonably practicable. The school will then notify affected data subjects as required by law.

Greenfield SMS is registered with the Ghana Data Protection Commission as a data processor under the Data Protection Act, 2012 (Act 843). Each school using this system is also required to register as a data controller.