Privacy Policy
How Wanguza handles personal data on the platform.
Last updated: Version 1.0 — effective 18 August 2026
This policy describes how Wanguza handles personal data today. It is reviewed with Ugandan counsel on an ongoing basis, and our registration with the Personal Data Protection Office (PDPO) at NITA-U is in progress. Material changes will be posted here.
Who we are
Wanguza (“we”, “us”) provides enrollment and marketing software to schools. For data a school collects about parents and pupils through Wanguza, the school is the data controller and Wanguza acts as a data processor on the school’s instructions. For account data we collect directly from school staff, Wanguza is the controller.
Information we process
- Account data: name, email, phone, role, school, and login credentials (stored hashed).
- School-provided contact data: parent/pupil names, phone numbers, source, pipeline stage, consent records, and messages.
- Usage and security data: log-in activity, device/IP, and audit logs used to keep accounts secure.
- Payment data: handled by our licensed payment processor; Wanguza does not store card or mobile-money credentials.
How we use it
- To provide the service: capture leads, run consented messaging, manage the enrollment pipeline, and process school payments.
- To secure accounts: authentication, lockout protection, and audit trails.
- To support and improve the product, and to communicate with account holders.
Consent & lawful basis
Marketing messages to parents are sent only on the basis of consent captured at the parent’s first interaction, consistent with Uganda’s Data Protection & Privacy Act, 2019. That consent isspecific and informed: it names one purpose — communications about the named child’s Senior One admission, covering study tips, event invitations, and application and admission updates — and it is asked once rather than at every step.
Contact about a family’s other children (for example a future intake) is a separate, optional and unbundled choice, never pre-ticked and never bundled into the first.
Confirmations of something a parent themselves started — an application receipt, a status update, an admission offer they applied for, a payment receipt — are service messages and are not marketing.
Parents can withdraw consent at any time by replying STOP to any message or using the self-service page on their school’s site. Withdrawal takes effect immediately and ends all marketing at once. We record which version of the consent wording a parent agreed to, and through which form or channel, so any consent can be evidenced on request.
Data sharing
We share data only with sub-processors needed to run the service (e.g. hosting, SMS/WhatsApp delivery, and payment processing) under appropriate agreements, and where required by law. We do not sell personal data.
Security & retention
Data is encrypted in transit, isolated per school (multi-tenant), and access-controlled. We retain personal data for as long as needed to provide the service and meet legal obligations, then delete or anonymise it.
Your rights
Parents and users may request access, correction, or deletion of their data. School-collected data is also manageable through each school’s self-service tools. Contact hello@wanguza.com for any privacy request.
Contact
Questions about this policy: hello@wanguza.com. See also our Data Protection (DPPA) statement.