What we do with your school's records.
ZimSchool holds information about children. This page says plainly what is stored, who can reach it, and what we will never do with it.
Who controls the data
The school is the controller of its own records. Statotech Systems processes them on the school's behalf, to run the service the school has asked for — nothing else. A school can ask for its records to be exported or deleted at any time.
What is stored
Learner records (names, admission numbers, dates of birth, class history and any documents or medical notes the school adds), guardian names and contact numbers, staff accounts and roles, attendance marks, exam marks, fee structures, invoices and payments. In short: the things a school already keeps, kept in one place instead of six.
Who can see it
Only accounts your school creates, and only the parts their role allows. Every route in the application is permission-checked, so a teacher does not reach the fee ledger and a bursar does not reach exam marks unless the school grants it. Guardians signing in to the parent portal see their own children and nobody else's.
Where it lives
On a server Statotech operates, reached over HTTPS only. Passwords are stored hashed and are not recoverable by us or by anyone else. Backups are taken so that a failure does not lose a term of work.
What we never do
We do not sell school or learner data. We do not share it with advertisers. We do not use a school's records to train anything. We do not look at a school's data except when the school asks us to help with a specific problem.
Payments
When a fee is paid through the portal, the payment is handled by the payment provider. Card and mobile-money credentials are entered with that provider, not with us — ZimSchool records that a payment happened and its reference, not the instrument used to make it.
Messages to families
To tell a family about an absence, a fee, a payment, a report card or a notice, ZimSchool passes the guardian's email address or phone number and the message to the service that delivers it: an email service for email, and an SMS gateway for text messages. Those services use them only to deliver the message.
Cookies and analytics
ZimSchool sets a session cookie to keep you signed in and a token that protects forms from forgery. That is all. There are no analytics scripts, no advertising and no third-party trackers on this site or in the application.
How long we keep it
A school's records are kept for as long as the school uses ZimSchool. When a school leaves, we provide an export and delete its records within 30 days of being asked, except payment references, which are kept for seven years as Zimbabwean tax law requires. Backups are overwritten within 90 days.
The law this is written against
Statotech Systems operates from Zimbabwe under the Cyber and Data Protection Act [Chapter 12:07]. A school outside Zimbabwe remains responsible for its own local requirements, and we will sign a processing agreement with it on request.
Asking us something about your data
A school, a parent or a member of staff can ask what is held about them and ask for it to be corrected. Write to contact@statotec.com and we will answer.
Last reviewed 16 October 2026. If we change how any of this works we will say so here before the change takes effect.