Privacy Policy

ShuleSystem is a digital platform developed and operated by Find Solution Technology (“FST”).

ShuleSystem supports schools in managing their:

• administration;
• finances;
• teaching and learning;
• communication;
• analytics.

The platform includes, among other things, a web interface, mobile apps, communication tools, dashboards, data analysis services and, depending on the plans subscribed to, artificial intelligence features.

FST’s role may vary depending on the context in which the data is processed.

3.1 Data processed on behalf of a school

When a school uses ShuleSystem to manage its students, teachers, parents, or school activities, the school generally determines the main purposes for which this school data is used.

In that case, FST provides the technology infrastructure that enables the school to process this information through ShuleSystem.

The respective obligations of FST and the school may be set out in a Data Processing Agreement (DPA).

3.2 Data processed directly by FST

In certain situations, FST may itself determine the purposes and means of certain processing, in particular when it comes to:

• creating and administering Shule accounts;
• securing the platform;
• managing subscriptions;
• providing technical support;
• preventing fraud and abuse;
• ensuring the availability of the service;
• complying with its legal obligations;
• or directly managing certain services offered to users.

This distinction makes it possible to determine the respective responsibilities of FST and the schools.

ShuleSystem applies, in particular, the following principles:

Lawfulness and transparency

Data is processed in accordance with legitimate purposes and the applicable rules.

Purpose limitation

Data must not be used in a manner incompatible with the purposes for which it was collected.

Data minimization

We seek to limit the data collected to what is reasonably necessary for the operation of the services concerned.

Accuracy

Schools and users have, in accordance with their rights, means of keeping information up to date.

Storage limitation

Data is not intended to be retained indefinitely without justification.

Confidentiality

Access to data is limited to authorized users and persons.

Security

Technical and organizational measures are implemented to protect data.

Special protection of minors

Data relating to students who are minors receives heightened attention.

The data processed depends on the services used.

5.1 Student data

Shule may process, in particular:

• last name;
• first name;
• sex, where necessary for school management;
• date of birth or age;
• student number or ID;
• photograph, where used by the school;
• class;
• school year;
• school;
• academic history;
• attendance;
• absences;
• late arrivals;
• assessments;
• homework;
• quizzes;
• exams;
• grades;
• averages;
• report cards;
• teacher observations;
• information relating to school fees;
• school documents;
• communications relating to the student’s schooling;
• information necessary for the relationship between the student, their school, and their legal guardians.

ShuleSystem seeks to avoid collecting particularly sensitive data when it is not necessary to provide the service.

We may process, in particular:

• first and last name;
• phone number;
• email address;
• relationship to the student;
• account ID;
• information necessary to link the account to one or more children;
• communication preferences;
• history of certain communications with the school or Shule;
• technical information related to the use of the app.

The information accessible from the Parent account must be limited to the children the parent or legal guardian is authorized to access.

Shule may process, in particular:

• identity;
• work contact details;
• school;
• position;
• subjects taught;
• assigned classes;
• schedules;
• teaching activities;
• login information;
• permissions and roles within the platform;
• professional documents necessary for the operation of the service.

Some data may be entered directly by the school.

When ShuleSystem is used, certain technical information may be generated automatically.

This may include, in particular:

• IP address;
• device type;
• operating system;
• browser;
• app version;
• date and time of login;
• technical logs;
• security events;
• technical identifiers;
• information necessary for diagnosing errors.

This information is used, in particular, to ensure the security and stability of the service and to improve it.

When ShuleSystem enables or facilitates certain payment transactions, the information necessary for the transaction may be processed.

Depending on the payment method used, certain financial data may be processed directly by a payment service provider or a telecommunications operator.

ShuleSystem seeks to limit the retention of sensitive financial data that is not necessary for its operation.

Data may be used, in particular, to:

• provide the ShuleSystem services;
• manage enrollments and student records;
• manage attendance;
• manage assessments and results;
• produce report cards;
• manage school fees;
• facilitate communication between schools and parents;
• enable parents to follow their children’s schooling;
• enable teachers to carry out certain teaching activities;
• produce dashboards;
• generate statistics;
• provide user support;
• secure the platform;
• detect suspicious behavior;
• prevent unauthorized access;
• maintain and improve the services;
• comply with applicable legal obligations.

Data must not be used in a manner incompatible with these purposes without an appropriate basis.

ShuleSystem is an educational platform that may process the data of many users who are minors.

We therefore consider the protection of children to be a central element of our privacy policy.

In particular:

• We do not sell students’ personal data.
• We do not use students’ personal data to serve them targeted behavioral advertising.
• We do not allow a parent to access the data of a child they are not authorized to access.
• We seek to limit collection to the information necessary for school management and the educational services concerned.

Schools must also take care not to enter into Shule any sensitive data that is not necessary for school management.

Certain versions of ShuleSystem may offer features based on artificial intelligence.

These may include, in particular:

• an assistant for teachers;
• a virtual tutor for students;
• tools to help with lesson preparation;
• analyses of school data;
• recommendations or summaries;
• tools to assist school leadership.

The use of these features does not mean that school data becomes the property of an artificial intelligence provider.

FST seeks to limit the data sent to artificial intelligence services to what is necessary for the operation of the feature concerned.

Where appropriate, minimization, pseudonymization, or other protective measures may be used.

Students’ identifiable personal data must not be used by FST for the sole purpose of freely training general-purpose artificial intelligence models without an appropriate legal basis, adequate safeguards, and corresponding notice.

When an external artificial intelligence provider is used, FST seeks to select configurations and contractual commitments that are compatible with its data protection requirements.

The detailed rules applicable to artificial intelligence features are described in the ShuleSystem Responsible Artificial Intelligence Use Policy.

Shule may use algorithms to produce statistics, analyses, alerts, or recommendations.

However, ShuleSystem is designed as an assistance tool.

An important decision likely to have a significant effect on a student, in particular regarding:

• a final assessment;
• academic guidance;
• a disciplinary sanction;
• expulsion;
• or an important educational decision,

should not be made solely on the basis of a result generated automatically by Shule without appropriate human involvement.

Data is accessible only to persons and organizations that have a legitimate reason and appropriate authorization.

Depending on the circumstances, this may include, in particular:

The school

Authorized members of the school may access the information corresponding to their duties.

Parents or legal guardians

They may access the data of the children who are properly linked to them.

Teachers

They may access the information necessary for their teaching responsibilities.

Find Solution Technology

Certain authorized members of FST may access data when necessary, in particular to:

• provide support;
• resolve an incident;
• ensure security;
• carry out certain technical operations;
• or comply with a legal obligation.

Such access must be limited to the corresponding needs.

Technical service providers

Certain service providers may be involved in the operation of ShuleSystem, in particular for:

• hosting;
• cybersecurity;
• communications;
• text messages (SMS);
• email;
• payments;
• technical analysis;
• artificial intelligence;
• or other necessary services.

They may process data only within the scope of the services they provide to FST and in accordance with the applicable contractual obligations.

FST does not sell the personal data of students, teachers, or parents to advertisers or data brokers.

The school data entrusted to Shule is not a product intended to be sold to third parties.

When aggregated or statistical data is used to improve the service, produce general analyses, or measure the use of Shule, FST implements measures designed to prevent it from being used to identify an individual unnecessarily.

ShuleSystem uses professional cloud infrastructure to host and operate its services.

As of the date of this version, some of Shule’s infrastructure may rely, in particular, on cloud services provided by Amazon Web Services (AWS).

The use of a cloud provider does not mean that the provider becomes the owner of school data.

FST remains responsible for the configuration and governance of its technology environment in accordance with the responsibilities incumbent upon it.

The precise location of the environments used and any international transfers must be documented in the technical documentation, the DPA and, where necessary, the list of subprocessors.

FST implements a security approach based on multiple layers of protection.

Depending on the systems and risks involved, these measures may include, in particular:

• encryption of communications;
• encryption of data where appropriate;
• access control;
• management of roles and permissions;
• the principle of least privilege;
• strong authentication for certain accounts;
• logging of certain operations;
• application protection;
• network protection;
• monitoring of security events;
• backups;
• restoration mechanisms;
• vulnerability management;
• security updates;
• incident response procedures.

As part of this architecture, FST may use specialized solutions such as AWS and Cloudflare services.

The website’s forms are protected by Cloudflare Turnstile, which checks that they are filled in by a person rather than a robot. For this sole purpose, the service processes technical connection data such as the IP address and browser information.

Since no IT infrastructure can guarantee zero risk, FST takes a continuous improvement approach to its security.

FST employees, staff, and service providers do not automatically have unrestricted access to school data.

Access must be granted based on job responsibilities and operational needs.

FST applies the principle of least privilege: a person should have only the permissions necessary to carry out their assignment.

Authorized persons are subject to appropriate confidentiality obligations.

Sensitive access may be subject to logging and control mechanisms.

FST retains data for as long as necessary for the purposes for which it is processed and in accordance with the applicable contractual and legal obligations.

The retention period may vary depending on:

• the nature of the data;
• the length of the relationship with the school;
• legal obligations;
• security needs;
• accounting or contractual obligations;
• the school’s requests;
• and the rights of the data subjects.

The precise retention periods applicable to the various categories of data are defined in the ShuleSystem Data Retention and Deletion Policy.

When a school stops using ShuleSystem, FST implements a procedure that provides, in accordance with the applicable contractual terms, for:

• the closure or restriction of accounts;
• the export or retrieval of data, where applicable;
• a transitional retention period;
• then the deletion or anonymization of the data concerned, subject to legal obligations or legitimate grounds for retention.

As a general policy, Shule may provide for a maximum retrieval period of 90 days after the actual end of the contract, unless otherwise provided by contract or required by law.

At the end of this period, the data concerned is intended to be deleted from active systems in accordance with the applicable deletion process.

Some data may temporarily remain in secure backups until they are rotated in the normal course.

ShuleSystem maintains backup mechanisms designed to reduce the risk of data loss.

Backups are protected by measures appropriate to their level of sensitivity.

They are not intended to serve as permanent archives.

When data is deleted from active systems, it may temporarily remain in certain backups until they expire or are replaced according to the applicable retention cycle.

Subject to the conditions set out in the applicable legislation, a person may have, in particular, rights relating to their personal data.

These rights may include, in particular:

• the right to be informed;
• the right of access;
• the right to request the correction of inaccurate data;
• the right to request, when the conditions are met, the erasure of certain data;
• the right to object to certain processing;
• the right to request certain restrictions;
• as well as the other rights recognized by the applicable legislation.

When a request concerns data administered by a school, Shule may forward the request to, or coordinate it with, the school concerned when that school is the controller for the corresponding processing.

When a student is a minor, certain rights may be exercised by their parent or legal representative in accordance with the applicable rules.

FST and the school may request the information reasonably necessary to verify:

• the identity of the requester;
• their relationship to the child;
• and their authorization to make the request.

This verification is intended to prevent an unauthorized person from gaining access to a child’s information.

Deleting a user account does not necessarily mean that all the school information associated with that person is deleted immediately.

Some information may need to be retained by the school as part of the student record, its legal obligations, or its administrative responsibilities.

Shule therefore distinguishes between:

These two operations may be subject to different rules.

The website and certain ShuleSystem interfaces may use cookies or similar technologies that are necessary, in particular, for:

• authentication;
• security;
• maintaining sessions;
• user preferences;
• technical measurement of how the service is operating.

When technologies that are not strictly necessary require a choice by the user, Shule implements the appropriate mechanisms in accordance with the applicable rules.

Detailed information can be found in the ShuleSystem Cookie Policy.

ShuleSystem may send certain communications necessary for the operation of the service, in particular:

• school alerts;
• notifications;
• communications from the school;
• security information;
• account-related messages;
• contractual information;
• support.

Commercial or promotional communications are managed separately when they require a specific choice by the user.

In the event of a security incident affecting personal data, FST applies an internal incident response procedure.

This procedure may include, in particular:

• detection;
• containment;
• investigation;
• assessment of the data concerned;
• remediation of the vulnerability;
• restoration where necessary;
• documentation of the incident;
• notification of the parties concerned or the competent authorities when required by regulations.

For this purpose, FST maintains a Data Breach & Incident Response Policy.

FST may use technical service providers to supply certain components of ShuleSystem.

Before entrusting a service provider with processing that involves personal data, FST assesses, in particular and depending on the level of risk:

• the nature of the service;
• the data concerned;
• the security measures;
• the confidentiality obligations;
• the location of the processing;
• the contractual terms;
• and any further subprocessors.

A list of the main subprocessors involved in the processing of personal data may be made available in the ShuleSystem Trust Center.

This Privacy Policy may be updated to take into account, in particular:

• the evolution of ShuleSystem;
• new features;
• new technologies;
• regulatory changes;
• or changes in our data protection practices.

The date of the last update is shown at the beginning of the document.

When a change is significant, the users or schools concerned may be informed by appropriate means.

This Policy is interpreted in accordance with the legislation applicable in the Democratic Republic of the Congo, in particular the relevant provisions of Ordinance-Law No. 23/010 of March 13, 2023 on the Digital Code, as well as the other texts applicable to personal data protection and digital services.

When ShuleSystem is offered in other countries, additional provisions may be adopted to take into account the applicable local legislation.

For any question relating to this Policy, to data protection, or to the exercise of a right, you may contact:

When a request directly concerns school data administered by a school, the user may also contact the school concerned.

»

School data belongs to the educational community that entrusts it to us. Our role is to provide the technology that allows it to be used in a useful, secure, and responsible way.

ShuleSystem considers the protection of school data to be an essential responsibility in the digital transformation of education.