Privacy Policy
The short version
- EduMock helps schools run BECE mock exams: register students, enter scores, and print result slips.
- Schools put in their students' details. The school decides what is added and is responsible for having the right to add it. We keep it safe and use it only to run the service.
- We do not sell personal data, show adverts, or use tracking or analytics tools. We use one cookie, to keep you signed in.
- Each school can only see its own students. EduMock's administrators can see data where needed to run and support the service.
- You can ask us to correct or delete your data at privacy@example.com.
This Privacy Policy explains how EduMock Educational Publications ("we", "us", trading as EduMock) handles personal data when schools, teachers and others use the EduMock website and portal (the "Service"). We follow the Data Protection Act, 2012 (Act 843) of Ghana.
1. Who we are
EduMock Educational Publications, Ghana. Email: privacy@example.com.
2. Roles: school and EduMock
Two different parties are involved, and it matters which is which:
- The school is the "data controller" for its students' data. The school decides to hold mock exams, chooses which students to add, and decides why. We act as the school's "data processor": we store and process student records on the school's behalf and on its instructions, under our Terms of Service.
- We are the "data controller" for account and security data of the people who use the Service (school staff and administrators), and for the records we need to run, protect and bill for the Service.
If you are a parent or student and want to see, correct or remove a student's record, the quickest route is usually to ask your school. You can also contact us and we will help (see section 15).
3. Information we handle
| Who it is about | What we handle | Where it comes from |
|---|---|---|
| Students (candidates) | Full name, student/index number, sex, date of birth (if provided), photograph (if uploaded), subjects registered, scores entered, grades, aggregates, positions, and the verification code printed on result slips. | Entered or uploaded by the school (forms and Excel files). Scores are entered by the school's staff. |
| School staff and administrators | Name, username, email and telephone (if given), staff ID (if given), profile picture (if uploaded), role and school, a one-way scrambled ("hashed") password, last sign-in time and IP address, signed-in devices (browser type and IP address), notifications, and a record of the terms version they accepted. | You, your school administrator, or Super Admin when an account is created. |
| Schools | School name, region, district, address, telephone, email, logo, contact person, mock registrations and, where payment is switched on, invoices and payment records and uploaded payment proofs. | The school. |
| Anyone using the Service | IP address and browser details when signing in or using the site, failed sign-in attempts, request counters used to block abuse, and an activity log (audit trail) of important actions such as publishing results or changing accounts. | Collected automatically by the website. |
We do not ask for, and schools should not upload, national ID numbers, health information, religion, or other sensitive categories of personal data. Student data is limited to what is needed for mock exams.
4. Why we use it
- To run the Service for schools: registering students, collecting and checking scores, calculating grades and positions, printing result slips, and supporting teachers and administrators. (Contract with the school; the school's own lawful basis for student data.)
- To keep accounts and data safe: sign-in, password resets, blocking repeated failed attempts, spotting misuse, and keeping an audit trail. (Our legitimate interest in protecting the Service and its users.)
- To communicate with you about your account, approvals, activation codes, results and important changes. We do not send marketing messages without asking you first.
- To meet legal duties and to establish or defend legal claims.
We do not use student data to build profiles, for advertising, or to train artificial-intelligence models, and we do not sell it. Grades and positions are produced by fixed, published calculation rules; no decision about a student is made by a machine without the school's staff being able to review it.
5. Students are children
Most BECE candidates are under 18. Students do not have accounts and we do not collect information directly from them. The school adds their details.
Because the data concerns children, the Data Protection Act expects extra care. Schools must therefore only add students if they have a lawful basis to do so, and should inform parents or guardians (for example in the school's admission or exam notice) that student names, dates of birth, photographs and scores are processed in EduMock, and obtain the parent's or guardian's consent where the law or the school's policy requires it. Our Terms make this a condition of use. If a parent or guardian tells us they object, we will pass the request to the school and, where appropriate, remove the record.
6. Who sees it
- Your school. Staff see only what their role allows. A school can never see another school's students or results.
- EduMock administrators. Super Admin staff can see data across schools where needed to approve schools, process and publish results, give support, investigate problems or enforce our Terms. Access is limited to people who need it and is recorded in the audit log.
- Our hosting provider. The Service runs on servers provided by StormerHost. The provider stores data for us and may not use it for its own purposes.
- Authorities and advisers. We may disclose data when the law, a court or a regulator requires it, or to professional advisers under a duty of confidentiality.
- A successor. If the business is sold or merged, data may move to the new owner, who must honour this policy.
We do not sell personal data or share it with advertisers or data brokers. Schools may print result slips, download exports and share them with parents; once a school or a parent holds a copy, it is outside our control.
7. Result verification page
Each published result slip carries a verification code and QR code. Anyone who has the code can open a public page that shows the student's name, student number, school, mock exam, subject scores and grades, aggregate, positions and photograph (if any), so that people can check that a slip is genuine. The codes are random and cannot be browsed or searched, lookups are rate-limited, and the page is hidden from search engines. Please treat a slip like any other school record and only share it with people who should see it.
8. Cookies and tracking
We use one essential cookie (edumock_session) to keep you signed in and to protect forms from forgery. It is deleted when your session ends and expires after 120 minutes of inactivity. We do not use advertising, analytics or social-media trackers, and the fonts, icons and scripts on the Service are served from our own server. Because the cookie is strictly necessary, no cookie banner is needed.
9. How we protect it
- Passwords are stored only as one-way hashes, never in readable form. Sign-in attempts are rate-limited.
- Each school's data is separated by access rules; staff roles limit what each person can do.
- Forms are protected against forgery; uploads are checked and stored outside the public web folder; profile pictures and student photographs are served only to people allowed to see them.
- Important actions are recorded in an audit log. You can see where your account is signed in and sign out other devices from My account.
- Permanent deletion of a whole cohort needs a typed confirmation by Super Admin and a safety backup is taken first.
No online service is perfectly secure. Please choose a strong password, do not share it, and sign out on shared computers.
10. How long we keep it
- Student and result records are kept for the cohort they belong to until the school asks us to delete them or Super Admin permanently deletes the cohort, and no longer than needed for the school's mock-exam purposes.
- Staff accounts are kept while the person has access. When a school removes a user or closes its account, we delete or anonymise the account details within 90 days of a request, except records we must keep.
- Sessions end after 120 minutes of inactivity. Audit records, sign-in attempt logs and acceptance records are kept as long as needed for security, dispute resolution and legal reasons.
- Backups may hold copies of deleted data for a limited period until they are overwritten, and are not used for any other purpose.
11. Your rights
Under the Data Protection Act you can ask:
- whether we hold personal data about you, and for a copy of it;
- for wrong or incomplete data to be corrected;
- for data to be deleted or destroyed where we no longer have a good reason to keep it;
- for us to stop or limit processing, or to object to it, including for direct marketing; and
- for a person to review any decision made only by automated means.
To use these rights, write to privacy@example.com from the email or phone number linked to the account, or ask your school administrator. We may need to confirm who you are first. We aim to answer within 30 days. Signed-in users can correct their own details, picture and password under My account. If you are a parent or guardian asking about a student, we may need the school to confirm the request. If you withdraw a consent, it does not affect what was done before.
12. Where data is stored
Data is stored on servers located in Ghana. If we ever move data to another country, we will make sure it is protected to a standard at least equal to Ghanaian law and update this policy.
13. If something goes wrong
If personal data is lost, stolen or accessed without permission in a way that puts people at risk, we will act quickly to contain it, tell the Data Protection Commission and the affected schools or people as soon as reasonably practicable, and explain what happened and what to do.
14. Changes to this policy
We may update this policy, for example when we add features. The version number and date at the top show the latest version. For important changes we will ask signed-in users to accept the new version and, where practical, notify school administrators beforehand.
15. Contact and complaints
Questions, requests or concerns: privacy@example.com, Ghana.
You also have the right to complain to the Data Protection Commission of Ghana (www.dataprotection.org.gh). We would appreciate the chance to put things right first.