Privacy notice

Who is responsible

For student, applicant, guardian and staff records, schools and organisations are the data controllers. Veridyl acts as their data processor and follows their documented instructions. Veridyl is the controller for SenaSuite account administration, billing, marketing, security and direct support records.

Information we handle

Depending on the services your institution enables, this can include identity and contact details, applications, enrolment and academic records, attendance, fees and payment references, staff records, learning activity, submitted files, messages, support requests, device and security events, and AI conversations. SenaSuite does not store payment-card details.

Why we use it

We use personal information to deliver the services requested by an institution, maintain accounts and security, support users, issue and verify school records, process enabled payments and notifications, meet legal obligations, and improve reliability. Where consent is required, including for a child, the institution must obtain and record valid consent. We do not sell personal data.

Service providers and international transfers

SenaSuite is hosted in Germany, so information used by Cameroonian institutions crosses national borders. We share only what is necessary with contracted hosting, email, payment or AI providers when the relevant feature is enabled. Production use is subject to the institution agreement and applicable transfer safeguards. We do not disclose personal information to advertisers.

How long we keep information

School records follow the institution's approved schedule and applicable legal retention periods. Account and support records are kept only while needed for the service, security, disputes or legal duties. Erasure can anonymise records that must remain for accounting, academic integrity or audit obligations. Your institution can explain the schedule that applies to your records.

Your choices and rights

• Access and receive a copy of your information.
• Correct inaccurate or incomplete information.
• Delete or anonymise information when the law permits.
• Withdraw consent and object to processing where applicable.

Start with your school when it controls the record. You can also contact us. We will verify the requester and, for a child, the guardian relationship before releasing or changing information. We target a response within 30 days, subject to the applicable legal deadline.

Security

We use encrypted connections, role-based access, audit records, short-lived access tokens, protected credentials, monitoring and backups. No system is risk-free. If we confirm an incident, we work with the affected institution and follow the applicable notification process.