Privacy notice
Effective 15 November 2026. This notice explains what this website collects, and how Books-pro handles school data when a school runs it on its own server.
1. Who this notice covers
This notice covers two different relationships, so it helps to separate them:
- You browse this website. We are the controller of what the website collects from you as a visitor or a prospective customer.
- A school runs Books-pro. The school is the controller of its own pupil, guardian and staff data. We are at most a processor — for example when installing, supporting or troubleshooting at the school's request.
2. What this website collects
This site is deliberately built to collect as little as possible.
- Demo request form: the form on the contact page sends the details you type — name, school, role, enrolment band, plan of interest, email, phone, preferred time, modules and notes — to our server. The server emails the request to our sales inbox, sends a WhatsApp notification to our sales numbers, and keeps a copy in our lead log. The same step also offers to open your own email application or WhatsApp with the request written out; that message is sent from your account only if you press send there. A confirmation is emailed to the address you give. We use this only to answer your request and manage the relationship.
- ObPay licence checkout: when you start a payment from the pricing page, our server sends your name, school, email, phone number and plan to ObPay and receives the payment status and reference. Mobile-money and card details are entered on ObPay's own checkout page; they never pass through this website or our server. ObPay's privacy notice applies to that payment.
- Email and phone: if you write or call us, we keep that correspondence so we can answer and follow up. We do not add you to a marketing list without a clear opt-in.
- Click events: the site records button clicks into a browser-side event queue (for example “demo request started”). The queue is designed for your analytics tool if the site owner later connects one. No analytics provider is loaded by default and no event is sent anywhere unless a provider is added.
- Server logs: whichever host serves the site may keep standard access logs — IP address, page requested, time and browser type — for security and capacity. Those logs are controlled by that host.
We do not sell data, we do not run advertising trackers, and we do not build a profile of you across other websites.
3. Data a school holds in Books-pro
When a school uses Books-pro, the database holds the records the school chooses to keep, typically:
- Learners: name, learner identification number (LIN), class and stream, guardians, contact numbers, fee account, attendance term totals, marks and report cards.
- Guardians: name, phone number, email where supplied, and portal sign-in details.
- Staff: employment and payroll records, which may include National Identification Number, NSSF and TIN details, and appraisal or leave notes.
- Finance: receipts, vouchers, ledgers, bank records and payment references from digital providers.
- Messages: the SMS text the school composes, the recipient number, and the delivery status the provider returns.
Because the school decides what to collect and why, questions about a learner's record — access, correction, withdrawal of consent — should go to that school first. We will help the school respond where it asks us to.
4. Why data is processed
Inside the software, data is processed to run school administration: registering learners, receipting fees, posting to the ledger, entering marks, producing report cards, tracking attendance term totals, keeping a timetable, sending messages the school has approved, and giving guardians portal access. The school's own privacy policy and the consents it collects determine the lawful basis.
Where we act as processor, we handle data only to install, support, train or maintain the software, on the school's instructions, and only for as long as needed for that task.
5. Where the data is stored
By default the database is a file on the school's server, under the school's Windows user profile, and it is backed up locally on a daily schedule. We do not operate a central copy of school records. Remote access, if the school enables it, exposes that same school-hosted system over HTTPS through a tunnel the school controls; it does not move the data to us.
There is therefore no routine international transfer of school data by us. If a school chooses a hosting or backup arrangement outside Uganda, the school is responsible for that arrangement and for any transfer safeguards the law requires.
6. Providers the school may connect
Books-pro can be connected to third parties the school selects. When connected, those providers receive what the integration needs:
- Digital payment providers — SchoolPay, Airtel Money and ObPay. The school's credentials are stored encrypted on the school server. Payment references and amounts come back into the ledger. Card details are never entered into Books-pro.
- SMS providers — Ego, Yoola, Genius, Africa's Talking, an Android bridge or a GSM modem. Recipient numbers and message text are passed to whichever provider the school configures.
- Biometric devices — where used, the bridge imports attendance records into the database; the device vendor's own notice applies to data held on the device.
Each provider has its own privacy notice. The school should review it before enabling an integration and should record that decision in its own data register.
7. How long data is kept
The school decides retention, because it owns the data. Two defaults matter:
- Backups: the built-in schedule keeps 30 days of daily backups by default. Older backups roll off. Copies the school makes elsewhere are outside the software's control.
- Website enquiries: we keep demo requests and correspondence for as long as needed to respond and to manage the relationship, then delete them on request.
8. How data is protected
Access is controlled by individual staff accounts and screen-level rights, passwords are stored as salted scrypt hashes, and payment and SMS provider secrets are encrypted at rest. Licences are signed so the software can verify its own permissions offline. The full picture is on the security overview.
No system is unbreakable. A school server on a local network without HTTPS is protected by the network, not by encryption in transit, and the school should keep that network private.
9. Children's data
Books-pro processes data about children because a school has to run admissions, attendance, assessments and fee accounts. That processing belongs to the school, which is expected to inform guardians and to follow Uganda's Data Protection and Privacy Act and the guidance of the Personal Data Protection Office. We do not market to children, we do not profile them for advertising, and the parent and student portal is set up by the school for its own families.
10. Your rights
Under the Data Protection and Privacy Act, 2019, a person may ask to be informed about how their data is used, to access it, to correct it, to object to or restrict certain processing, and in some cases to have it erased. Where a school holds the record, direct the request to the school. Where we hold it — for example a demo enquiry — write to rbisiki@gmail.com and we will respond within a reasonable period.
If you are not satisfied, you may complain to the Personal Data Protection Office in Uganda.
11. Cookies
This website does not set advertising or analytics cookies, and it does not use a cookie banner because there is nothing to consent to. If the site owner later adds an analytics or chat tool, this section and the on-page consent behaviour must be updated first.
12. If something goes wrong
A school that suffers a data incident should follow its own procedure and contact us on the support line so we can help contain it. Where we become aware of a breach affecting data we process for a school, we will tell that school without undue delay and give the facts we have, so the school can meet its own notification duties to the regulator and to affected people.
13. Changes to this notice
We will update this page when the way the website or the software handles data changes, and we will change the effective date. Material changes affecting a school will be raised with that school directly.
14. Contact
Privacy questions and demo-enquiry requests: rbisiki@gmail.com. Sales: bisikirogers@gmail.com. Telephone: +256 765 248 047 or +256 755 761 108. Location: Kampala, Uganda. Registered details and the nominated data-protection contact are to be inserted before publication.
See also: Terms of use and licence · Security overview