Sfolio Privacy Policy
Last updated: 9 October 2026
1. Introduction & Scope
This Privacy Policy explains how Orinno Co. Limited ("Orinno", "we", "us"), the Ugandan company that owns and operates the Sfolio school management platform ("Sfolio", "the Platform"), collects, uses, stores, shares, and protects personal data in connection with the Service.
This Policy applies to: (a) personal data of School administrators, teachers, bursars, and other staff who hold an Sfolio account ("Authorised Users"); and (b) personal data that a School uploads to the Platform about students, parents and guardians, and school staff in the course of using Sfolio ("Customer Data", as defined in our Terms and Conditions). It also covers data collected automatically from anyone who visits sfolioapp.com or uses the Platform, such as technical and cookie data (Section 13).
This Policy forms part of, and should be read together with, our Terms and Conditions. Where a School itself collects data from parents, students, or staff to upload to Sfolio, the School is responsible for its own privacy notice to those individuals (Section 2 explains this division of responsibility in more detail).
2. Who We Are & Our Role
For Customer Data (student, parent, and staff records a School uploads to Sfolio), the School is the data controller, it decides what data to collect and why, and Orinno acts as a data processor, processing that data only on the School's instructions and only to provide the Service. This means the School, not Orinno, is primarily responsible for telling parents, students, and staff what data is collected about them and why, and for responding to their requests about that data, though Orinno supports Schools in meeting those obligations, as described throughout this Policy.
For Authorised User account data (the login and profile details of the staff who use Sfolio directly) and for data collected from visitors to our website, Orinno is the data controller and is directly responsible for that data under this Policy.
Orinno Co. Limited, a company registered in Uganda with its registered office at Plot 21B, Amazon Building, Last Floor, Mbarara City, Uganda [company registration number to follow].
3. What Personal Data We Collect
Student data: name, date of birth, sex, class/stream, admission number, photo (where uploaded), academic records, attendance, and disciplinary or promotion/transfer history.
Parent/guardian data: name, phone number, email, physical address, and relationship to the student.
Staff and teacher data: name, sex, date of birth, phone number, physical address, position/role, qualifications, bank or mobile money details used for payroll, salary and statutory deduction figures (NSSF, PAYE), and attendance records.
Financial data: fee invoices, payments, and balances linked to a student, and payroll and payslip records linked to a staff member.
Authorised User account data: name, email, phone number, role/permissions, and login activity for anyone who holds an Sfolio account.
Technical data: IP address, browser and device information, and usage/log data collected automatically when the Platform or website is used (see Section 13 on cookies).
We collect this data directly from Schools and their Authorised Users as they use the Platform. We do not knowingly collect personal data from any other source.
4. How We Use Personal Data
We use personal data to: provide and operate the Platform's core features (enrolment, academics, promotions, admissions and transfers, attendance, fees and payroll, reporting); generate documents such as fee statements, payslips, and report cards on the School's behalf; authenticate and manage Authorised User accounts and enforce access permissions between Schools, so that one School's data is never visible to another; communicate with Schools and Authorised Users about their account, billing, and service updates; maintain the security, integrity, and performance of the Platform, including detecting and preventing fraud, abuse, and unauthorised access; comply with our own legal and regulatory obligations; and, in de-identified and aggregated form only, understand usage patterns and improve the Service.
We do not sell personal data, and we do not use Customer Data for advertising or marketing to students, parents, or staff.
5. Legal Basis & Consent
For Customer Data, the School is responsible for establishing a lawful basis, typically the consent of a parent or guardian (for a minor student's data), the consent of a staff member, or another lawful basis available to the School (such as performance of the School's own contract with a parent, or a legal obligation the School has as an educational institution), before uploading that data to Sfolio. Our Terms and Conditions require the School to confirm it has done so.
For data Orinno controls directly (Authorised User accounts and website visitors), we process it on the basis that it is necessary to perform our contract with the School or to comply with our own legal obligations. Sfolio does not currently use any cookie or technology that requires separate consent, see Section 13.
6. Our Data Protection Registration Status
Under the Data Protection and Privacy Act, 2019, data collectors, controllers, and processors in Uganda are required to register with the Personal Data Protection Office (PDPO). Orinno Co. Limited has not yet completed this registration and is in the process of finalising it. We are disclosing this openly so that Schools and Data Subjects can make an informed decision about using the Platform in the meantime.
In the interim, we apply the data protection principles the Act is built on, collecting only what is needed, using it only for the purposes described in this Policy, keeping it secure, and honouring the rights described in Section 11, as a matter of policy and practice, even though formal registration is still pending. We will update this section, and notify Schools, once registration is complete, and will include our registration reference at that time.
7. How We Protect Your Data
We apply reasonable technical and organisational measures to protect personal data on the Platform, including encrypted connections (HTTPS/TLS) between your browser and our servers, secure session handling, access controls that keep each School's data separated from every other School's, role-based permissions within a School's own account, and restricted internal access to Customer Data on a need-to-know basis.
No system is completely secure, and we cannot guarantee absolute security of data transmitted to or stored on the Platform. Schools and Authorised Users also play a role in keeping data secure, by choosing strong passwords, not sharing login credentials, and promptly reporting any suspected unauthorised access, as described in our Terms and Conditions.
8. Data Retention
We retain Customer Data for as long as the School's Sfolio account remains active, so that academic, financial, and payroll records stay available for ongoing school operations and historical reference (for example, closed-term records and alumni history).
If a School's subscription ends, we retain Customer Data for [30] days to allow the School to export it, after which we will delete or anonymise it, except where we are required to retain it for longer to comply with a legal obligation, resolve a dispute, or enforce our agreements. Authorised User account data is retained for as long as the account is active, plus a reasonable period afterward for security and legal record-keeping purposes.
Schools should set and follow their own internal data retention practices for the records they manage within Sfolio, consistent with their obligations to students, parents, and staff.
9. Data Sharing, Sub-processors & Hosting
We do not sell or rent personal data. We share personal data only in the following circumstances: with our hosting provider (currently Hostinger, or any successor infrastructure provider we may use) to store and run the Platform; with payment processors to collect subscription fees from Schools; with professional advisers (lawyers, auditors) where necessary; with authorities where required by law, a valid court order, or to protect the rights, property, or safety of Orinno, a School, or any individual; and with a buyer or successor in the event of a merger, acquisition, or sale of our business, subject to this Policy continuing to apply to the data transferred.
Within the Platform itself, a School's Customer Data is only ever visible to that School's own Authorised Users (and, for platform administration purposes, a limited number of authorised Orinno personnel), never to another School.
Any third party we share personal data with is required to protect it under terms at least as protective as this Policy and to use it only for the purpose we share it for.
10. International Data Transfers
Our hosting provider may store or process data on servers located outside Uganda. Where personal data is transferred outside Uganda, we take reasonable steps to ensure it continues to receive a level of protection consistent with the Data Protection and Privacy Act, 2019, including choosing providers with recognised security practices and, where applicable under the Act, relying on contractual safeguards with those providers.
[This section should be finalised once Orinno confirms its hosting provider's exact server location(s) and reviews whether a cross-border transfer mechanism under the Act applies.]
11. Rights of Data Subjects
Subject to the Data Protection and Privacy Act, 2019, individuals whose data is processed on Sfolio have the right to: be informed that their data is being collected and how it is used; access a copy of their personal data; request correction of inaccurate or incomplete data; request deletion of their data, subject to the School's and Orinno's own legal retention obligations; object to or restrict certain processing; and lodge a complaint with the Personal Data Protection Office.
For Customer Data (student, parent, or staff records), these requests should first be directed to the relevant School, since the School controls that data and is best placed to action the request within its own records; Orinno will support the School in fulfilling a verified request. For Authorised User account data or website data that Orinno controls directly, requests can be sent to the contact details in Section 16.
We will respond to verified requests within a reasonable time and in line with the Act's requirements once our registration under Section 6 is complete.
12. Children's Data
Sfolio is used by schools to manage records belonging to students, many of whom are children. We do not knowingly allow children to create their own Sfolio accounts or interact with the Platform directly, all data about students is entered and managed by School staff (Authorised Users), not by students themselves.
Because student data is children's personal data, Schools must obtain appropriate parental or guardian consent before uploading it to Sfolio, as required under Section 5 of our Terms and Conditions, and must take particular care in deciding what student data is necessary to collect and who within the School can access it.
13. Cookies & Similar Technologies
Sfolio currently sets two strictly necessary cookies, one that keeps you signed in as you move between pages, and one security token that protects your account against cross-site forgery attacks. Both stop working the moment you log out, and the Service cannot function without them. Sfolio does not currently set any analytics, advertising, or other optional cookie, and you are never asked to consent to a cookie here, because none of them are optional.
The full list of cookies, their purpose, and how long each one lasts is published separately in our Cookie Policy, which forms part of this Privacy Policy by reference. If we ever add an analytics, payment, or support-chat tool that sets its own cookie, we will update both documents and seek consent first for anything beyond strictly necessary cookies, where required by law.
14. Data Breach Notification
If we become aware of a security incident that results in unauthorised access to, or loss of, personal data on the Platform, we will investigate promptly, take reasonable steps to contain and remedy it, and notify affected Schools without undue delay so they can, in turn, inform their own students, parents, or staff where appropriate. Once our registration under Section 6 is complete, we will also notify the Personal Data Protection Office of any breach as required under the Data Protection and Privacy Act, 2019.
15. Changes to This Policy
We may update this Privacy Policy from time to time, including once our data protection registration under Section 6 is complete. For material changes, we will notify Schools by email or in-app notice at least [14] days before the changes take effect. We encourage you to review this Policy periodically; the "last updated" date at the top of this document shows when it was last updated.
16. Contact Us
For questions about this Privacy Policy, to exercise a data subject right described in Section 11 (for Orinno-controlled data), or to report a concern:
Orinno Co. Limited Plot 21B, Amazon Building, Last Floor, Mbarara City, Uganda sfolioappadmin@gmail.com +256 750 465 940
If you are a parent, student, or staff member with a question about data a School has entered into Sfolio, please contact that School directly in the first instance, as explained in Section 2.