Privacy Policy

This Privacy Policy explains how Dugsify Inc. ('Dugsify', 'we', 'us', or 'our') collects, uses, stores, and protects information when schools and their authorised users ('School', 'you') access and use the Dugsify school management platform ('Platform').

Dugsify acts as a data processor on behalf of the School. The School is the data controller and is responsible for the lawful collection and use of personal data within its account. By using the Platform, the School agrees to this Privacy Policy.

We collect data in two categories. School & administrator data includes: school name, address, and contact details; administrator names, email addresses, and phone numbers; billing and subscription information; and platform configuration and settings.

User & student data (entered by the School) includes: student names, dates of birth, gender, and enrolment records; academic records including grades, assessments, and report cards; attendance and timetable data; parent and guardian contact information; staff profiles, roles, and employment records; and any other records the School uploads or creates within the Platform.

We also automatically collect technical data such as IP addresses, browser type, device information, session logs, and usage analytics to maintain and improve the Platform.

Dugsify uses the data collected solely to provide and support the Platform services. Specific purposes include: operating and maintaining the Platform; authenticating users and enforcing security; delivering features such as grade management, attendance tracking, and reporting; providing technical support to schools; sending service-related notifications (maintenance windows, security alerts, policy updates); and improving Platform performance and reliability.

We do not use student data for advertising, profiling, or any purpose other than delivering the school management services the School has subscribed to.

Dugsify does not sell, rent, or trade personal data with any third party. We may share data only in the following limited circumstances: with trusted sub-processors (cloud hosting, email delivery, analytics) who are contractually bound to process data only as instructed by Dugsify; with the School's own authorised administrators upon request for data exports; and with law enforcement or regulatory authorities where we are legally required to do so.

All sub-processors used by Dugsify are vetted for compliance with applicable data protection standards. A current list of sub-processors is available upon request from our support team.

Dugsify uses cookies and similar technologies to operate the Platform. Essential cookies are required for authentication, session management, and security — these cannot be disabled. Functional cookies remember user preferences such as language and display settings. Analytics cookies collect anonymised usage data to help us understand how the Platform is used and where it can be improved.

Schools and users can manage non-essential cookie preferences through the Platform's cookie settings panel. Blocking essential cookies will prevent access to the Platform.

Dugsify implements industry-standard technical and organisational measures to protect data against unauthorised access, loss, or disclosure. These include: encryption of data in transit (TLS 1.2+) and at rest (AES-256); role-based access controls limiting data access to authorised personnel; regular security audits and vulnerability assessments; automated backups with offsite redundancy; and multi-factor authentication support for administrator accounts.

While we take every reasonable precaution, no system is completely immune to risk. In the event of a data breach affecting your school, we will notify you in accordance with applicable legal requirements.

Dugsify may store and process data on servers located outside your country. Where data is transferred across borders, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) or equivalent mechanisms — to protect the data in accordance with applicable law.

Schools in regions with specific data residency requirements should contact our support team to discuss available options.

Dugsify retains school and user data for the duration of the active subscription. Upon account termination or expiry, the School has 30 days to export its data through the Platform's administration tools. After this period, data will be securely deleted from our systems within 90 days, unless retention is required by applicable law.

Anonymised and aggregated usage statistics may be retained indefinitely for Platform improvement purposes. These cannot be used to identify any individual.

As the data controller, the School holds rights over the personal data within its account. Depending on applicable law, these may include: the right to access and receive a copy of data held; the right to correct inaccurate or incomplete data; the right to request deletion of data ('right to be forgotten'); the right to restrict or object to certain processing; and the right to data portability.

Schools can exercise most of these rights directly through the Platform's admin settings. For requests that cannot be completed through the Platform, contact our support team. Dugsify will respond to valid requests within 30 days.

Dugsify may update this Privacy Policy to reflect changes in law, sub-processors, or Platform features. Material changes will be communicated to school administrators via the Platform dashboard or by email at least 14 days before they take effect.

The effective date at the top of this page will always reflect the most recent version. Continued use of the Platform after changes are published constitutes the School's acceptance of the updated Policy.

For privacy enquiries, data requests, or to report a concern about how Dugsify handles your school's data, please contact our Data Protection team. We are committed to responding to all privacy-related requests within 5 business days.