1. Introduction & Entity
This Privacy Policy describes how EduCreds Labs ("EduCreds", "we", "our", or "us") collects, uses, stores, and protects personal data in connection with the EduCreds digital credential management platform (the "Platform") available at educreds.xyz.
EduCreds Labs is currently completing formal incorporation under the Uganda Registration Services Bureau (URSB) and is operated by its founding team based in Kampala, Uganda. Contact details: admin@educreds.xyz | +256757282316.
We are committed to protecting the privacy and security of personal data in compliance with the Uganda Data Protection and Privacy Act 2019 ("PDPA 2019") and applicable data protection principles.
By using the EduCreds Platform, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please discontinue use of the Platform.
2. Data We Collect
Institution Data (provided by institutions)
- Institution name, registration number, accreditation details
- Authorised administrator names and contact email addresses
- Institution billing and contract information
- Institution DID (Decentralised Identifier — a public, non-personal identifier)
Student Identifiers (provided by institutions)
- Internal student identifier (as assigned by the institution)
- Student name (as it appears on the academic credential)
- Student email address (for credential delivery notification, if provided)
- Credential subject data as defined by the issuing institution (e.g., degree, graduation date, grades — only if institution chooses to include)
Credential Metadata
- Credential type, title, issuance date, expiry date (if applicable)
- Cryptographic proof and signature data (non-personal)
- Credential status (active, revoked, expired)
Platform Usage Data
- IP addresses and browser user agents (for security and fraud detection)
- Platform access logs (anonymised after 90 days)
- API usage statistics (aggregate, non-personal)
3. How We Use Data
| Purpose | Data Used | Legal Basis (PDPA 2019) |
|---|---|---|
| Issue digital credentials on behalf of institutions | Student identifiers, credential metadata | Contract performance (institution DPA); legitimate interest of institution |
| Deliver credentials to students | Student email (if provided) | Contract performance; student consent via institution |
| Enable credential verification by employers | Credential metadata (not PII) + cryptographic proof | Legitimate interest; institution authorisation |
| Platform security and fraud detection | IP addresses, access logs | Legitimate interest; legal obligation |
| Customer relationship management | Institution contact data | Contract performance |
| Legal and regulatory compliance | As required by applicable law | Legal obligation |
4. What Is NEVER Written On-Chain
🔒 Our Blockchain Privacy Pledge
The following categories of personal data are NEVER written to any public blockchain, IPFS storage, or any other public distributed ledger — this is an architectural constraint, not a configuration choice:
- Student names
- Student email addresses
- Grades, marks, or assessment results
- Dates of birth or age information
- National identification numbers
- Biometric data of any kind
- Physical addresses or phone numbers
- Any other personally identifiable information
What IS written on-chain: cryptographic hashes, public institution identifiers, revocation status flags, and IPFS URIs for public schema metadata. None of these contain personal information.
5. Data Sharing
We do NOT sell personal data.
EduCreds does not sell, rent, or trade personal data to third parties for marketing or commercial purposes.
Sub-Processors
We use the following sub-processors to deliver the Platform services:
| Sub-Processor | Location | Purpose | Data Processed |
|---|---|---|---|
| Microsoft Azure | USA (centralus region) / Global | Cloud infrastructure hosting — compute, database, key vault, monitoring | All Platform data (encrypted at rest and in transit) |
| IPFS / Pinata | Decentralised / USA | Decentralised storage for public credential schema metadata and public documents | Public metadata only — NO student PII |
All sub-processors are subject to data processing agreements and are required to maintain appropriate security measures. EduCreds will notify institutions of any material changes to sub-processors with 30 days' notice.
Legal Disclosure
We may disclose personal data if required to do so by applicable Ugandan law, court order, or competent governmental authority. We will notify affected data subjects where legally permitted.
6. Data Retention
| Data Category | Retention Period | Rationale |
|---|---|---|
| Credential records (issued credentials) | Duration of institution contract + 7 years | Legal retention requirement for academic records; provides permanent credential validity |
| Revoked credential records | Indefinite (revocation record) | Revocation status must be permanently accessible for verification purposes |
| Institution contact data | Duration of contract + 2 years | Contract and relationship management |
| Platform access logs | 90 days (then anonymised) | Security and fraud detection; anonymised logs retained for analytics |
| Audit logs | 7 years | Compliance, legal, and dispute resolution requirements |
7. Data Subject Rights
Under the Uganda Data Protection and Privacy Act 2019, data subjects have the following rights. To exercise any right, contact us at admin@educreds.xyz with sufficient information to identify your request. We will respond within 21 days.
- Right of access: Request a copy of personal data we hold about you
- Right to correction: Request correction of inaccurate or incomplete data
- Right to deletion: Request erasure of personal data where we have no legal obligation to retain it (note: credential records issued on behalf of institutions may be subject to retention obligations)
- Right to object: Object to processing of your personal data where we rely on legitimate interest as the legal basis
- Right to data portability: Request your credential data in a machine-readable format (W3C VC format is inherently portable)
- Right to restrict processing: Request restriction of processing in certain circumstances
- Right to lodge a complaint: Lodge a complaint with the Uganda Personal Data Protection Office (PDPO) if you believe your rights have been violated
Note regarding student credentials: Credentials are issued on behalf of institutions (Data Controllers). For requests relating to the content of academic credentials, data subjects should first contact the issuing institution directly. EduCreds, as Data Processor, will act on documented instructions from the Data Controller.
8. Security Measures
- Encryption in transit: All data transmitted between users, institutions, and EduCreds servers uses TLS 1.2 or higher
- Encryption at rest: All personal data stored in Azure databases is encrypted at rest using AES-256
- Access control: Role-based access control (RBAC); staff access is limited to data required for their role; MFA required for all administrative access
- Cryptographic signing: All credentials are cryptographically signed with ES256 keys stored in Azure Key Vault; private keys are never accessible to staff
- Audit logging: All access to personal data is logged in append-only audit logs with 7-year retention
- No PII in logs: Development and operational policy prohibits writing personal data to application logs
- Regular security review: EduCreds conducts annual security reviews; penetration testing is conducted prior to production launch
9. Cookies
The EduCreds Platform uses the following cookies:
- Session cookies (strictly necessary): Required for platform authentication and session management. Cannot be disabled.
- Security cookies (strictly necessary): CSRF protection tokens. Cannot be disabled.
- Analytics cookies (optional): Used to understand platform usage patterns using anonymised data. Can be declined at the cookie consent banner.
EduCreds does not use advertising cookies or third-party tracking cookies. Cookies are not used to build profiles for marketing purposes.
10. Contact & Data Protection Officer
For all data protection enquiries, requests, or complaints:
EduCreds Labs
Email: admin@educreds.xyz
Tel: +256757282316
Kampala, Uganda
EduCreds is in the process of designating a Data Protection Officer (DPO) as required under the PDPA 2019. The DPO contact will be updated at admin@educreds.xyz upon appointment.
11. Governing Law & Updates
This Privacy Policy is governed by and construed in accordance with the laws of Uganda, including the Uganda Data Protection and Privacy Act 2019.
We may update this Privacy Policy from time to time. Material changes will be notified to institutions via email with 30 days' notice before taking effect. The current version of this Policy is always available at educreds.xyz/privacy.
Effective date: This Policy is effective as of the date published and replaces all prior privacy notices.