Privacy Notice

1. Who is responsible for your information

2. Information we collect

• From teachers and principals: name, position, email, phone, school, password.
• From partner organisations: organisation name and type, country, contact name, position, email, phone, areas of interest, free-text notes.
• From community applicants: name, phone, optional email, village, district, province, optional GPS coordinates, description of activity, estimated people served.
• From health facilities: facility name and type, operator, province, district, ward or village, optional GPS coordinates, contact name, position, phone, optional email, staff and population estimates, connectivity details. No patient or medical information is collected.
• From educators: name, status (for example practising or retired teacher), optional current school, optional Teaching Service Commission number, experience and qualifications, subjects and grade levels, province, district, phone, optional email, how they would like to contribute, comments.
• From education managers and providers: organisation name and type, province, district, contact name, position, phone, optional email, approximate number of schools supported, areas of work, notes.
• From parents and guardians: name, phone, optional email, province, district, optional ward or village, number of children in school and the count of children in each grade, optional school names, comments. No identifying details about children — no names, ages, dates of birth, gender or student IDs — are collected through this form.
• From schools about students: full name, year level, gender, year of birth, student ID number, guardian name, guardian contact.
• Automatically: IP address for rate limiting and abuse prevention, browser and device information, pages visited.

3. Information about children

• Student records are provided by the school, not by the child.
• Only the registered principal of that school and authorised provincial administrators can access them. Teachers cannot.
• We collect year of birth rather than full date of birth, deliberately, to hold less identifying information about each child.
• Student records are never used for advertising, never sold, and never shared with commercial third parties.
• No student names or contact details are ever included in emails.
• Every administrative access to student records is logged.
• Guardians may contact their school or service@kumul.ai to ask what is held about their child, to correct it, or to request its removal.

4. Why we use it, and our legal basis

• Establishing student accounts and access.
• Verifying that registrants are who they claim to be.
• Planning kit deployment.
• Contacting registrants about the programme.
• Securing the platform against abuse.

5. Who we share it with

• We use trusted third-party service providers to host the platform, store information securely, and send emails. These providers act on our instructions and may only use the information to deliver those services.
• PNG EduTech Limited handles personal information only as needed to operate the platform on behalf of the East Sepik Provincial Government, and does not use it for its own purposes.
• Information may be shared with the East Sepik Provincial Administration and relevant Papua New Guinea education authorities for the purposes of administering the programme.
• We do not sell personal information.
• We do not use personal information for advertising.
• Student records are never shared with commercial third parties.

6. Where information is stored

7. How long we keep it

• Student records are kept while the student is enrolled at a participating school and for as long as needed to provide access to the programme. Records are removed or anonymised when no longer needed.
• Registration details are kept while the account is active. If a registration is not approved, details are kept only as long as needed to administer the application process.
• Contact form messages are kept only as long as needed to respond and keep a record of the enquiry.
• Records of administrative actions are kept longer, so decisions about the programme can be accounted for.
• Where we are required to keep information for legal or administrative reasons, we keep it for that period.

8. Your rights

• Give you a copy of what is held about you.
• Correct information that is wrong.
• Delete information we hold about you.
• Stop or limit certain uses of your information.
• Send you a copy in a portable format you can reuse.
• Deal with a complaint about how your information has been handled.

9. Security

• Connections to the platform are encrypted.
• Row-level access controls limit each principal to their own school's records.
• Every account is approved before it is activated.
• Administrative access to records is logged.
• Passwords are stored hashed, never in readable form.

10. Cookies and local storage

• Sign-in information, so you stay logged in.
• Your language choice, so the site remembers English or Tok Pisin.
• Saved drafts of forms, so a dropped connection does not lose your work.

11. Changes to this notice

12. Contact and complaints