Privacy Policy
CledgeDesk (dk.cledgesolutions.com) is a school management system, provided by Cledge Solutions ("we", "us") to schools. This policy explains what personal information CledgeDesk handles, why, who can see it, how long it is kept and the rights you have. It is written to meet the UK and EU General Data Protection Regulation (GDPR), US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), and Ghana's Data Protection Act, 2012 (Act 843).
Who is responsible for your information
Each school that uses CledgeDesk decides what information about its students (including children), parents and guardians, teachers and other staff is recorded and how it is used. For those records the school is the controller (in US terms, the "business"), and Cledge Solutions is its processor (or "service provider") acting only on its instructions.
Cledge Solutions is the controller of a smaller set of information that we use to run our own business: the sign-in and security information of account holders, our customers' contact and billing details, and support requests.
If you are a student or parent with a question about your record, please contact the school first; we will help them answer you. You can always reach us at support@cledgesolutions.com or +233 203 222 172.
Information we handle
Account and sign-in information
- Name, email address, username, phone number, role and the branch or unit you work in.
- Your password, stored only as a one-way hash that cannot be turned back into the password.
- Two-step verification settings: an authenticator-app key stored encrypted, recovery codes stored only as hashes, or - if you chose codes by email - the fact that you did (each emailed code is kept only in the server session, hashed, for 5 minutes).
- Sign-in times, the IP address and browser used, and a record of important actions (audit log), used to keep accounts secure.
Records the school keeps in CledgeDesk
- student records: names, dates of birth, class, admission details, photographs and guardians
- attendance, timetables, assessments, grades and report cards
- fees, invoices, payments and receipts
- messages and notifications sent to parents and guardians by email or SMS
- staff records: contact details, roles, departments, qualifications, pay and bank details
Student records are children's data and may include health or support notes a school chooses to record. They are processed only to run the school on its instructions, and parents see only their own children's records.
Information we create to keep the service running
- Technical and security logs (for example errors, failed sign-in attempts and the IP address they came from).
- Emails and SMS messages the system sends, such as sign-in details, verification codes and notifications.
How and why we use it
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Provide CledgeDesk and its features to the school | Performing our contract with the school; for its records, its instructions to us |
| Sign you in, send sign-in details and verification codes, and sign you out after 10 minutes without activity | Contract; legitimate interests in keeping accounts secure |
| Protect the service: detect and stop fraud, abuse and attacks; keep audit logs | Legitimate interests; legal obligations |
| Answer support requests and tell you about changes to the service | Contract; legitimate interests |
| Bill customers and keep accounting records | Contract; legal obligations (tax and accounting law) |
| Improve the service using aggregated information that does not identify anyone | Legitimate interests |
| Comply with the law and respond to lawful requests | Legal obligations |
Where records include special category data, the school relies on its own lawful condition - here, its duties and public tasks as an education provider, including safeguarding - and we process that data only on its instructions.
We do not sell personal information, share it for cross-context behavioural advertising, use it to profile you for marketing, or make decisions about you by automated means that have legal or similarly significant effects.
Who we share it with
- The people your organisation authorises - access inside CledgeDesk is controlled by roles the school sets up.
- Our hosting provider, which runs the servers and databases CledgeDesk uses.
- Our email delivery provider, to send sign-in details, verification codes and notifications.
- An SMS gateway, when the school sends text messages through CledgeDesk.
- Content delivery networks that serve parts of the app such as style sheets and fonts; they receive your IP address, as any website you load does, but no account information.
- Authorities or other parties when the law requires it, to protect people's safety, or to establish or defend legal claims.
- A successor business if Cledge Solutions is reorganised or sold, under the same protections as this policy.
Each provider may use the information only to provide its service to us, under a written contract that requires it to keep the information confidential and secure.
International transfers
Cledge Solutions is based in Ghana, and our providers may store or process information in other countries. When personal information from the UK, the European Economic Area or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with the security measures described below. You can ask us for a copy of the safeguards that apply.
How long we keep it
- Records the school keeps in CledgeDesk are kept while its subscription is active and for as long as it decides, so it can meet its own legal duties (for example record-keeping rules for financial records). When a subscription ends, we delete or return the school's data within 90 days unless the law requires us to keep it longer.
- Account and billing records are kept while the account is open and then for as long as tax and accounting law requires.
- Emailed verification codes: 5 minutes. Remembered ("trusted") browsers: 14 days. Signed-in sessions end after 10 minutes without activity.
- Security logs and backups are kept for a limited period and then deleted or overwritten in the normal cycle.
How we protect it
- All connections are encrypted (HTTPS), with strict transport security.
- Two-step verification is required on every account (an authenticator app or a code by email); passwords are hashed and authenticator keys encrypted.
- One active session per account, and automatic sign-out after 10 minutes without activity (with a 2-minute warning).
- Role-based access, so people see only what their role needs; administrators cannot see passwords.
- Audit logs of important actions, protection against common web attacks, and regular security reviews.
No system is perfectly secure. If a personal-data breach is likely to put you at risk, we (or the school) will tell you and the regulators as the law requires.
Your rights (UK, EU and Ghana)
Subject to the law, you have the right to:
- access the personal information held about you and get a copy;
- correct it if it is inaccurate or incomplete;
- delete it, or restrict how it is used, in some circumstances;
- object to uses based on legitimate interests;
- receive information you gave in a portable format;
- withdraw consent where something is based on your consent (such as live location sharing), without affecting earlier use.
Send requests to the controller (the school) or to support@cledgesolutions.com. We will verify who you are and reply within one month (extendable by two more months for complex requests). You can complain to a data-protection authority: in the UK the Information Commissioner's Office (ico.org.uk); in the EU your local supervisory authority; in Ghana the Data Protection Commission (dataprotection.org.gh).
Your rights in the United States
In the last 12 months the categories of personal information handled were: identifiers and contact details, account log-in credentials, internet activity in the service (sign-in and audit records), commercial information (subscriptions and payments), professional information (staff records), education records and information about children. They come from the school, its users and you, and are used only for the purposes above. We do not sell or "share" personal information, and we use sensitive personal information only to provide the service, so there is nothing to opt out of; we also honour Global Privacy Control signals.
Depending on your state (for example California, Colorado, Connecticut, Virginia and others), you may have the right to know, access, correct and delete your personal information, to appeal a decision about your request, and not to be treated differently for using these rights. Where we act as a service provider, we will pass your request to the school and help it respond. You or an authorised agent can make a request at support@cledgesolutions.com; we will verify the request before acting on it.
Children and student records
CledgeDesk is used by schools, not by children directly. Schools give students and parents access and remain responsible for the records. In the United States we act as a "school official" under FERPA and process information from children under 13 only on the school's authorisation under COPPA, solely for the school's educational purposes; we never use it for advertising or to build profiles. In the UK we follow the principles of the ICO's Children's Code. Parents can ask the school to review, correct or delete their child's information.
For schools: how we process your data
When we process personal information on your behalf, we:
- act only on your documented instructions, given through your use and settings of CledgeDesk;
- make sure our staff are bound by confidentiality;
- apply the security measures described in this policy;
- use only providers bound by equivalent written obligations, and tell you about changes to them so you can object;
- help you respond to requests from individuals and meet your security, breach-notification and impact-assessment duties;
- notify you without undue delay after becoming aware of a personal-data breach affecting your data;
- delete or return your data at the end of the service, unless the law requires us to keep it; and
- make available the information needed to show compliance, and allow reasonable audits.
These commitments form our data-processing terms under Article 28 of the UK and EU GDPR and are part of our agreement with you.
Cookies
CledgeDesk uses only the cookies and browser storage it needs to work and to remember choices you make. We use no advertising or analytics cookies. See our Cookie Policy.
Changes to this policy
We may update this policy as the service or the law changes. The effective date above shows when it last changed, and we will tell account holders about important changes.
Contact us
Cledge Solutions · support@cledgesolutions.com · +233 203 222 172