EduLink provides a data integration and student self-service platform for universities, including conversational support over WhatsApp and optional SMS verification for sensitive information.

EduLink (Processor):

· Legal name: [EduLink Legal Entity Name]

· Address: [Address]

· Contact: eric.kausu@jnetechno.com / +260 969469039

University (Controller):

Your university controls student data and decides what information is made available through EduLink.

· Conversation logs and operational logs are retained under the University’s environment and can be corrected or deleted through the University.

· Students should submit requests to access, correct, or delete personal data via the University’s official channels (Registrar, ICT Helpdesk, or Student Affairs).

Depending on what the University enables, EduLink may process the following categories of data:

· Student number and university ID, name and surname

· Phone number (WhatsApp) and mobile number for SMS verification

· Programs, courses, enrollments, timetable

· Attendance

· Grades and results (access protected as sensitive data)

· Tuition invoices and balances (access protected as sensitive data)

· Payments are not enabled yet. When introduced, additional verification and security controls will apply.

· Authentication events (for example, OTP sent and OTP verified)

· Audit events (for example, access attempts, sync status, and error events)

Universities may connect data to EduLink through:

· Excel/Spreadsheet sources (for institutions still using Excel), cleaned and structured for use

· APIs for modern web applications (including MCP where applicable)

· Windows services for legacy desktop systems (such as Access), moving data into Azure SQL

EduLink uses layered access controls based on the sensitivity of the information requested:

· Standard requests: the student number may be required.

· Sensitive information (for example, tuition balances and academic results): SMS one-time password (OTP) verification is required before details are disclosed via WhatsApp.

· Future payments: where payments are introduced, two-factor authentication (2FA) will be used before payment actions or payment confirmations are disclosed.

EduLink processes data only to:

· Provide student self-service responses (for example, timetable, attendance, results, and tuition status)

· Support university operations (for example, service queries and notifications as configured by the University)

· Maintain platform security, integrity, and auditing

EduLink uses third-party providers to deliver messages:

· WhatsApp/Meta to deliver WhatsApp communications

· SMS provider(s) to deliver OTP and verification messages

The University (and EduLink where applicable) is responsible for ensuring appropriate notices and consents are provided to users for business messaging.

University data is stored in Azure SQL hosted in Zambia via Paratus Zambia (as configured by the University).

If any cross-border transfer is required for a specific integration or support scenario, it will be handled only under University instruction and applicable law.

· Primary records retention (academic and finance) follows the University’s retention policies.

· Security and verification logs (for example, OTP events) are retained for the minimum period needed for security and audit as defined by the University.

EduLink does not sell student data. Data may be shared only with:

· The University (authorized staff)

· Messaging and SMS providers strictly for delivery

· Hosting and infrastructure providers as needed to operate the service

EduLink implements technical and organizational measures to protect data, including:

· Role-based access where applicable

· OTP verification controls for sensitive information

· Audit logging stored under the University’s environment

· Secure transfer methods for data ingestion (APIs and services) where configured

Requests to access, correct, delete, or restrict student data must be made through the University, which controls the records.

If you believe your data is being mishandled, you may raise a complaint through the University’s official channels and any relevant supervisory authority, in line with applicable law.

EduLink and participating Universities will comply with applicable data protection obligations for their roles, including any registration requirements that apply to controllers and processors.

We may update this policy from time to time. The latest version will be made available at: [privacy policy link], with an updated effective date.