Software as a Service and Data Processing Agreement

In short. SchoolPort runs the school information system as a hosted service. The school owns its records; SchoolPort owns the software.

A-1. The service. SchoolPort provides its school information system to the school as a hosted service over the internet: the school portal, the mySchoolPort account, and the apps and features SchoolPort makes available to schools on its plan. SchoolPort runs, maintains and updates the service; the school installs nothing on its own equipment except the apps it chooses to use.

A-2. Who may use it. The school may let its portal administrator, staff, students and their parents or guardians use the service for the school’s own work. Each person uses their own account. The school decides who has access in its portal and is responsible for those decisions.

A-3. Ownership. The school owns the records it keeps in the service: its students’, parents’ and staff’s information, its results, attendance, finances and documents. SchoolPort owns the software, its design and its content, and grants the school, for as long as this agreement lasts, the right to use the service under these terms. Nothing in this agreement transfers either party’s ownership to the other.

A-4. Changes to the service. SchoolPort may improve and change the service. It does not remove a feature the school relies on for its records without notice under term 18, and it never removes the school’s ability to take a full copy of its data.

In short. How long the agreement runs, how it ends, service levels, backups, and the school’s right to a full copy of its data.

B-1. Term. This agreement takes effect on the day SchoolPort activates the school and runs until the school closes its account under SP 21, para 7-3, either party ends it by 90 days’ written notice, or it ends under clause B-2 or term 18.

B-2. Ending for cause and suspension. Either party may end this agreement by written notice if the other seriously breaches it and has not fixed the breach within 30 days of written notice describing it. SchoolPort may suspend the service, after notice, if an invoice is not paid by the end of its grace period (SP 21, para 6-4) or if the school does not keep its documents current (SP 21, para 3-7); records are kept while the service is suspended. Misuse is handled under Part D and SP 21, para 7-4. If SchoolPort revokes the school’s activation under SP 21, para 7-4, service and billing stop and the school’s data is kept; if the school is not reinstated within 90 days, this agreement ends and clause C-7 applies.

B-3. Service levels. SchoolPort aims to keep the service available 99.5% of each calendar month, not counting planned maintenance. It answers support requests from Monday to Friday, 8:00 to 17:00 Liberia time, except public holidays, and gives at least 48 hours’ notice of planned maintenance, scheduled where it can outside school hours.

B-4. Backups and security. SchoolPort backs up the school’s data every day and keeps each backup for 30 days. Data is encrypted in transit and at rest. Only the SchoolPort associates and the listed providers who need the data for their work can reach it, under confidentiality duties. SchoolPort keeps a record of who reaches the school’s data in its systems and reviews its security regularly.

B-5. A copy of the school’s data. Until this agreement ends, and on written request for 90 days after it ends, the school may take a full copy of its data in a common format, at no charge.

In short. SchoolPort handles the school’s information only on its instructions and only to run the service; breaches are reported within 72 hours.

C-1. Roles and instructions. The school decides why and how its students’, parents’ and staff’s information is used. SchoolPort processes that information only on the school’s instructions, given through this agreement and the school’s use of the service, and only to provide, secure and support the service. SchoolPort does not sell it, does not use it for advertising, and does not use it to build profiles of children.

C-2. Basis for the records and the Notice to Parents. The school keeps its records under its mandate to educate the students it enrolls. It tells parents and guardians how their children’s information is kept by sharing SchoolPort’s Notice to Parents (Section IV): at enrollment, at a parents’ meeting or on its notice board, and by message. Families who enroll online acknowledge it on the enrollment form. Optional features, such as notifications, stay off until a parent turns them on.

C-3. Where data is held and providers. The school’s data may be hosted outside Liberia with the service providers listed at hello.schoolportsis.com/legal (Security and Trust). Each provider is bound to protect the data at least as well as this agreement requires. SchoolPort gives the school 30 days’ notice before adding a provider (term 18); if a provider must be replaced urgently to keep the service running or secure, SchoolPort tells the school within 7 days.

C-4. Breaches. If SchoolPort learns of a breach of security affecting the school’s data, it tells the school’s data protection contact (Section III) within 72 hours: what happened, what data is affected, what SchoolPort has done, and what the school should do. SchoolPort helps the school meet any duty it has to tell the people affected or an authority.

C-5. Requests from authorities. If a court or authority demands the school’s data, SchoolPort tells the school first, unless the law forbids it, and gives no more than the demand requires.

C-6. Children’s information. Students under 16 have the restricted features set out in SchoolPort’s Child Safety Standards. The school may turn on only the features those standards allow for them.

C-7. After the agreement ends. When this agreement ends, SchoolPort returns the school’s data on request (clause B-5) and deletes it 90 days after the end, including from backups as they expire, except records the law requires SchoolPort to keep, which it keeps only for that purpose.

C-8. Requests from individuals. If a student, parent or staff member asks SchoolPort to see, correct or delete their information, SchoolPort passes the request to the school and helps the school answer it.

C-9. The school’s duties. The school keeps its information accurate, keeps sign-ins private, gives each person only the access their role needs, supervises its portal administrator and staff, and tells SchoolPort at once of any misuse it suspects. The school tells SchoolPort at once if its data protection contact changes.

In short. One person, one account; school work only; no reaching another school’s information.

D-1. One person, one account. Each person uses only their own account. Accounts, passwords and sign-in codes are never shared.

D-2. School work only. The service is used only for the school’s education and administration. It is not used to harass, threaten or harm anyone, to send messages unrelated to the school, or to store material that is unlawful or unsuitable for children.

D-3. Other schools and the service itself. No one may try to reach another school’s information, get around the service’s security or limits, or disrupt the service.

D-4. What happens after misuse. SchoolPort may suspend the account concerned at once to stop misuse, and tells the school. Repeated or serious misuse is handled under SP 21, para 7-4.

In short. The notice each school shares with families: at enrollment, at a parents’ meeting or on its notice board, and by message.

Our school keeps its records on SchoolPort, a school information system. These records include your child’s name, class, attendance, results and fees, and your name and phone number so the school can reach you.

The school keeps these records because it is responsible for educating your child. SchoolPort keeps them safe for the school and uses them only to provide the system. SchoolPort does not sell them or use them for advertising.

Students under 16 have restricted features. Optional features, such as app notifications, stay off until you turn them on.

You may ask the school to see or correct your child’s records. If you have a question about how they are kept, ask the school office.

See also the Child Safety Standards and the list of service providers.