Legal
Privacy Policy
How Crystal Heights International School collects, uses, and protects personal data, under Ghana's Data Protection Act, 2012 (Act 843).
Legal
Privacy Policy
How Crystal Heights International School collects, uses, and protects personal data, under Ghana's Data Protection Act, 2012 (Act 843).
Who we are
Crystal Heights International School is the data controller for the information described here. We are at Shikpontele, Amasaman, opposite China Mall, Accra, Ghana. For anything about your information, or your child's, the office is the place to ask: +233 26 471 2272, or info@crystalheights.edu.gh. We handle personal data in line with Ghana's Data Protection Act, 2012 (Act 843).
What this policy covers
This website, and the CrystalEDU app that families use on their phones. It does not cover a payment provider you choose to pay through. Those handle your payment details on their own pages, under their own terms.
What we hold, and why
Through this website we hold only what you send us: an enquiry or a request to visit, with the name, phone number and email you give alongside it. We use it to reply to you. Through the app we hold more, because the app is your child's school record shown back to you: Your name, phone number and email. The phone number is how you sign in; the rest is how we reach you. Your child's name, class, date of birth and photograph, so the app shows you the right child and the gate can check identity when your child is collected. Attendance, timetable, homework, marks, merits and conduct notes: the school day, as the school recorded it. Health information you have given the school, such as allergies, shown back to you as your own record. The people you authorise to collect your child, with their name, phone number and photograph, so the gate can check the person against a face. Fees, invoices and payments. Messages between you and the school, notices, and posts in your child's class space. Photographs and short reports from the classroom, where you have agreed to see them. Forms you sign in the app. A key held on your phone and a device identifier, so your phone can show a collection code that works with no signal, and so one lost phone can be switched off without affecting another. A notification token, so messages reach that handset. The app does not collect your location. It has no location permission and no code that reads one. "On my way" is a button you press. There is no advertising in the app, no advertising identifier, and no analytics or tracking of any kind.
Photographs of your child
Classroom photographs are shown to you only if you have said yes, in your child's settings in the app. You can change that answer at any time, and it applies from then on. Staff choose what to post. The app itself never takes a photograph of a child. The one photograph the app takes is of an adult you authorise to collect your child, and it goes to the school's record of that person so the gate can check it.
Where the information is kept
On the school's server, hosted in Germany by Hetzner Online GmbH, and in encrypted storage on your own phone so the app still works when the network does not. Everything travels between the two over an encrypted connection. When you sign out of the app, everything it held on the phone is erased at once, before the phone even tells the server, so a handset that changes hands holds nothing.
Who else sees it
Nobody sells your information, and nobody shares it for advertising. Three other organisations touch it, each for one purpose. Google delivers notifications to Android phones. It receives a device token and the text of each notification. We keep children's names out of notification text, so a lock screen shows nothing a stranger should read. The payment provider you choose receives the amount, a reference, and the details you type on its own page. It never receives your child's records. The school's SMS provider carries text messages to your phone number. Inside the school, staff see what their role allows. Your child's class teacher sees your child. The office sees the families it serves. A person you authorise to collect your child sees a collection code and the names of the children they may collect, and nothing else about them.
How long we keep it
Your child's school record is kept for as long as the law and good practice require of a school, and no longer. The periods are set out in the school's records retention policy, which the office will show you on request. Posts in a class space are removed a year after that class year ends. Messages and notices are kept with the child's record.
Your rights
Under Act 843 you may ask us what we hold about you and your child, ask us to correct anything that is wrong, ask us to stop using it for a particular purpose, and complain to Ghana's Data Protection Commission. Ask the office, in person, by telephone on +233 26 471 2272, or by email at info@crystalheights.edu.gh, and we will answer. The app is one way to reach us; it is never the only way.
Deleting your app account
In the app, under Account, you can ask the school to delete your login. Your access ends and everything the app held on your phone is erased straight away. It does not erase your child's school record. A school must keep that under its own retention policy, and no parent can remove it by deleting an app account. The app says so before you confirm, because we would rather you knew than found out later. If you cannot reach the app, email info@crystalheights.edu.gh from the address the school holds for you, or telephone the office, and we will action the same request.
Children
No child uses the app. It is for parents and guardians. It does hold children's information, and we treat it accordingly: no advertising, no tracking, and nothing shared beyond what is set out above.
Changes to this policy
If this policy changes, the new version appears here with the date it took effect, and the app tells you the next time you open it.