Smart Technologies1. Introduction and Scope
This Privacy Policy explains how Smart Technologies Ltd collects, uses, discloses, stores, and protects personal data when you access or use the SmartFees mobile application, associated web portals, USSD or mobile money integrations, and related services.
- Parents and guardians who register for and use SmartFees.
- Information about students processed through the service in connection with school fee payments.
- School or education institution staff who access the SmartFees dashboard.
- Visitors to SmartFees websites and marketing pages.
This policy does not apply to third-party websites, mobile money platforms, or banking applications that you may access through SmartFees. Those services have their own privacy policies.
2. Who We Are
Smart Technologies Ltd is the data controller responsible for personal data processed through SmartFees, except where a school remains the controller for student records and Smart Technologies acts only as a processor on the school's instructions.
Data Controller
Smart Technologies Ltd, trading as SmartFees
Privacy Contact
smartfees@esl.mw
Registered Address
O&C Investments House, Gouji Shopping Complex
P.O. Box 48, Lilongwe, Malawi
MACRA Registration
Registration details will be published once applicable registration requirements are completed.
3. Definitions
- Personal data means any information relating to an identified or identifiable natural person.
- Processing means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
- Data subject means the individual to whom personal data relates, such as a parent, guardian, school user, or student.
- Data controller means the entity that determines the purposes and means of processing personal data.
- Data processor means an entity that processes personal data on behalf of a controller.
4. Information We Collect
4.1 Information You Provide
- Identity data: full name, title, date of birth where needed for verification, and ID details where required for regulatory or KYC purposes.
- Contact data: phone number, email address, and physical or postal address.
- Account credentials: username, password, PIN, and authentication information stored in protected form.
- Relationship data: your connection to the student, such as parent, guardian, or sponsor.
- Financial and payment data: wallet or bank details needed to initiate payment, transaction history, payment amounts, fee balances, and convenience fee charges.
- Communications: customer support messages, school-parent communications delivered through the platform, and consent or preference records.
4.2 Student Information Processed on Behalf of Schools
To process payments and display fee balances, SmartFees may process limited student information supplied by a partner school, such as the student's name, admission number, class, fee structure, and balance information.
In this context, the school is generally the controller and Smart Technologies acts as the processor, handling the data only to enable fee payment, reconciliation, and related communication.
4.3 Information Collected Automatically
- Device and technical data: device type, operating system, device identifiers, IP address, mobile network information, and app version.
- Usage data: login timestamps, session duration, features used, and crash or diagnostics data.
- Approximate location data: where enabled, general location information used for fraud prevention, availability, and compliance.
4.4 Information from Third Parties
- Payment confirmations and transaction references from banks and mobile money operators.
- School-provided fee structures, reminders, and student records required for payment workflows.
- Identity verification information from regulated financial partners where required.
5. How We Use Your Information
We process personal data only where we have a valid legal basis to do so. The table below summarizes our main purposes and the corresponding legal bases.
| Purpose | Malawi DPA basis | GDPR-style basis |
|---|---|---|
| Creating and managing your SmartFees account | Performance of a contract | Article 6(1)(b) - contract |
| Processing fee payments and routing funds to the school's bank account | Performance of a contract | Article 6(1)(b) - contract |
| Charging and collecting convenience fees payable to Smart Technologies and payment partners | Performance of a contract | Article 6(1)(b) - contract |
| Reconciling payments against student records on the school's instructions | Processor obligations under contract with the school | Article 6(1)(b) and Article 28 processor obligations |
| Verifying identity, preventing fraud, and complying with AML or KYC duties | Legal obligation and legitimate interest | Article 6(1)(c) and Article 6(1)(f) |
| Sending payment confirmations, digital receipts, and fee reminders | Performance of a contract and legitimate interest | Article 6(1)(b) and Article 6(1)(f) |
| Customer support and complaint handling | Legitimate interest and legal obligation | Article 6(1)(f) and Article 6(1)(c) |
| Improving the service, analytics, and diagnostics | Legitimate interest | Article 6(1)(f) |
| Optional marketing communications | Consent | Article 6(1)(a) - consent |
| Responding to regulators, tax authorities, courts, and law enforcement | Legal obligation | Article 6(1)(c) |
Where we rely on consent, such as optional marketing, you may withdraw that consent at any time without affecting processing that took place before withdrawal.
6. Automated Decision-Making and Profiling
SmartFees may use limited automated checks, such as unusual transaction flags, to help prevent fraud and protect accounts. These checks are not intended to create legal or similarly significant effects without a route to human review.
7. Children's Privacy and Student Data
SmartFees is designed for adults such as parents, guardians, or sponsors. Children are not expected to independently create or operate SmartFees accounts.
- Student data is processed only as necessary for fee payment, reconciliation, and related school communication.
- Schools remain responsible for the lawful collection of student data and any required permissions.
- We do not use student data for advertising, unrelated profiling, or unrelated commercial purposes.
8. How We Share Your Information
We do not sell personal data. We share personal data only when needed to operate SmartFees, meet legal obligations, or carry out a request you have made.
- With the school or institution being paid so the payment can be matched to the correct student and account.
- With licensed mobile money operators, banks, and payment partners that help process transactions.
- With service providers supporting hosting, messaging, analytics, support, and security under appropriate contractual controls.
- With regulators, courts, law enforcement, or tax authorities where required by law.
- As part of a merger, investment, acquisition, or sale of assets, subject to confidentiality and data protection safeguards.
- With your consent for another clearly disclosed purpose.
9. International Data Transfers
Where data is transferred outside Malawi, including through cloud infrastructure or specialist service providers, we take steps to ensure appropriate safeguards are in place and that the transfer remains limited to operating, supporting, and securing the service.
10. Data Retention
- Account data is retained while your SmartFees account is active and for a reasonable period afterward for compliance, dispute handling, and support.
- Transaction and payment records are retained for the periods required by financial, tax, audit, and anti-money-laundering obligations.
- Support and communication records are retained as needed to resolve requests and maintain audit trails.
- Student data is retained in line with school instructions and record-keeping obligations.
When personal data is no longer needed, we delete, destroy, or anonymize it using appropriate security measures.
11. Data Security
We use technical and organizational controls designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. These controls may include encryption, access controls, authentication, monitoring, backups, staff confidentiality duties, and periodic review of security practices.
12. Data Protection Impact Assessments
Where a new feature or processing activity is likely to create higher risk to people's rights, we assess that risk before implementation and document appropriate safeguards.
13. Your Rights
Subject to applicable law and any relevant exemptions, you may have the right to:
- be informed about how your data is collected and used,
- request access to the personal data we hold about you,
- request correction of inaccurate or incomplete data,
- request deletion of your data where retention is no longer required,
- request restriction of certain processing,
- request a portable copy of your data where feasible,
- object to certain processing, including direct marketing,
- withdraw consent where consent is the legal basis,
- request human review of significant automated decisions, and
- lodge a complaint with a supervisory authority.
To exercise these rights, contact smartfees@esl.mw. We may need to verify your identity before acting on a request.
14. Complaints and Supervisory Authorities
If you believe we have handled your data improperly, please contact us first so we can try to resolve the issue directly. You may also lodge a complaint with the Malawi Communications Regulatory Authority or another relevant data protection authority where applicable.
15. Marketing Communications and Preferences
We send optional promotional communications only where you have consented or where the law otherwise allows it. You can opt out at any time. Essential service messages such as payment confirmations, receipts, and account notices may still be sent while your account is active.
16. Cookies, SDKs, and Similar Technologies
SmartFees may use cookies, SDKs, and similar tools to keep users signed in, remember preferences, measure service performance, and support fraud prevention. Where required, we will ask for consent before enabling non-essential tracking.
17. Third-Party Links and Integrations
SmartFees may link to or integrate with third-party platforms such as bank systems, mobile money apps, and school websites. We are not responsible for the privacy practices of those third parties, and we encourage users to review their policies separately.
18. Data Breach Notification
If a personal data breach is likely to create a risk to your rights, we will follow applicable breach response duties, including notifying relevant authorities and affected persons where required.
19. Contact Us
SmartFees Data Protection / Privacy Team
Smart Technologies Ltd
O&C Investments House, Gouji Shopping Complex
P.O. Box 48, Lilongwe, Malawi
Email: smartfees@esl.mw
20. Changes to This Policy
We may update this policy from time to time to reflect changes in our services, legal obligations, or operating practices. Any updated version will be posted on this page with a revised last-updated date.
21. Governing Law
This policy is governed by the laws of the Republic of Malawi, including the Data Protection Act, 2024, without limiting any mandatory rights available under other applicable data protection laws.