Privacy policy

1. Who is responsible for what

Thuto360 holds two kinds of personal information, and the responsibility for each is different.

• Information a school keeps about its own people — students, parents and guardians, staff — belongs to that school. Under Botswana's Data Protection Act, 2024, the school is the data controller and we are its data processor: we handle that information only on the school's instructions and only to run Thuto360 for it.
• Information about the schools themselves and the people who run them — the owner's name, email and phone, the school's billing details — and about visitors to our website is ours to look after. For that, we are the data controller.

2. If you are a parent, student or member of staff

Your school decided to use Thuto360 and decides what it records about you. To see, correct or remove that information, or to ask why it is held, please contact the school first; it is the one that can act on it. If you contact us, we will pass your request to the school and help it respond.

3. What we collect for ourselves

• When a school signs up: the school's name, code, town and phone, and the owner's name, email address and password (stored only in a form that cannot be read back).
• When someone books a demo: their name, school, email, phone and message.
• When anyone uses Thuto360: sign-in times, the device's network address, and a record of significant actions in the school's audit log, to keep accounts secure and to let the school see who did what.
• Small cookies that keep you signed in and remember which school you use. We do not use tracking cookies; on the public Revision Bank only, the non-personalised adverts described below may set Google's own cookie.

4. How we use it

We use it only for the purposes below. We never sell personal information, and we never use a school's information about its students, families or staff for advertising.

• To provide Thuto360: signing people in, sending the emails and text messages the school asks for, producing report cards and invoices.
• To run our relationship with the school: confirming the owner's email address, trial and payment reminders, support, and telling schools about changes that affect them.
• To keep the service secure and to fix problems.
• Where the law requires it.

5. Children's information

Schools use Thuto360 to keep records about children. The Act gives children's information special protection, and the school is responsible for having the authority — usually from a parent or guardian — to record it. We treat it with the same care as the school must: we use it only to provide Thuto360 to that school, and we never use it to build profiles or to advertise.

6. Who else sees it

We share personal information only with the service providers we need to run Thuto360 — the company that hosts our servers, and the email and text-message services that deliver the school's messages — under contracts that bind them to protect it and use it only for us. We share it with authorities only when the law requires us to.

Our servers may be outside Botswana. Where personal information leaves Botswana, we transfer it only as the Act allows, to providers that protect it at least as well as the Act requires.

7. How long we keep it

• A school's information is kept while the school uses Thuto360, then for 90 days after the school closes its account so it can still export it, and then deleted.
• A school on the Free plan that nobody has signed in to for 90 days, or whose paid plan ran out more than 90 days ago without being renewed, is closed and all its information permanently deleted.
• The school decides how long it keeps records about its own people, within the law, and can remove them itself.
• Demo requests are kept for up to a year.
• Backups are kept for a limited time and then overwritten.

8. How we protect it

Every school's records are walled off from every other school's at the database itself, and we test that on every release. Passwords are stored only as one-way hashes. Connections are encrypted. Access to our systems is limited to the people who need it. If a breach puts personal information at risk, we will tell the school concerned and the Information and Data Protection Commission as the Act requires, without undue delay.

9. Your rights

Under the Data Protection Act, 2024 you may ask to see the personal information held about you, to have it corrected or deleted, to object to how it is used, and to have it in a form you can take elsewhere. For information a school holds about you, ask the school. For information we hold for ourselves, email us at the address below; we will answer within the time the Act allows.

If you are not satisfied, you may complain to the Information and Data Protection Commission of Botswana.

10. The Revision Bank

For learner and parent accounts with no school, and for visitors to the Revision Bank, we are the data controller.

• Learner accounts: name, email, password (as a one-way hash), year of birth, and — under 18 — a parent or guardian's email, used to ask them to confirm the account. Your practice: answers, scores, points, streaks, badges and certificates.
• Leaderboards show only a nickname you choose, and only if you switch them on. An under-18 learner can only switch them on after a parent or guardian has confirmed the account.
• Parents: a parent account sees the scores, subjects, badges and certificates of each child who gave them their family code or whose account they confirmed — never the child's answers. A school parent sees the same for their child through the school's portal, and a child's teachers see how their class is doing.
• Visitors' practice is tied to their browser by a cookie and deleted after 90 days.
• Certificates carry a number anyone can check at thuto360.co.bw/verify; the check shows only what is printed on the certificate.
• Adverts appear only on the public Revision Bank pages, never to anyone signed in through a school, to Learner Plus members, or inside a test. We ask Google for non-personalised adverts only, so they are not chosen by tracking you. Google may still set a cookie needed to show and count them.
• Read aloud uses your own device's voice; nothing you read is sent to us or anyone else.
• Learner and parent accounts are kept while they are used, and we delete yours, with its practice, whenever you ask us to.

11. Changes

We will update this policy when what we do changes, and tell schools about changes that matter before they take effect. The date at the top shows when it last changed.