Privacy Notice: Nebula AMS

Issued under the Personal Data Protection Act, 2022 (Cap. 44)

1. Who is responsible

Data controller: the Halmashauri (Local Government Authority) that operates this system for its schools.
Data processor: Nebula Intel Ltd, Mhandisi Street, Kigamboni, Dar es Salaam, P.O. Box 8622 (https://nebula.co.tz), which provides and maintains the system on the controller's instructions.

2. What personal data is processed

• Staff details: name, check number, gender, designation, school, phone number, and the user ID on the biometric device.
• Attendance: the date and time of each sign-in, daily status (present, late, absent, leave), leave and permission records, and corrections with their reasons.
• System users: username, role, sign-in history (time, IP address, browser) and actions recorded in the audit trail.

Biometric data: fingerprint and face templates stay on the biometric device at the school. Nebula AMS does not receive, store or transmit fingerprint or face templates. It only receives the time and the device user ID of each sign-in.

3. Purpose and lawful basis

The data is used only to record and manage the attendance and punctuality of public-school staff, to produce reports for the Head Teacher, the Mkurugenzi and Mkuu wa Wilaya, and to support public-service management. It is not used for any other purpose, and it is not sold or shared for marketing.

4. Who can see the data

• Teacher: their own record only.
• Head Teacher: the staff of their own school.
• Mkurugenzi and Afisa Elimu: the schools in their Halmashauri.
• Mkuu wa Wilaya: summaries and forwarded reports for their Wilaya.
• Nebula Support: technical information (devices, system health) only. Support staff have no access to individual attendance records.

5. How long data is kept

• Raw sign-in records from devices: 730 days. After that they are deleted automatically, and only the daily summaries are kept.
• Daily attendance summaries and monthly reports: as required by public records and audit rules.
• Sign-in logs: 365 days. SMS logs: 365 days.

6. Where data is stored and how it is protected

Data is stored on servers located in the United Republic of Tanzania. It is protected by encrypted connections (HTTPS), two-factor sign-in for senior roles, account lockout, strong-password rules, automatic sign-out, access restricted by role, a full audit trail and regular backups.

7. Your rights

You may ask to see the personal data held about you, ask for wrong data to be corrected, and object to processing that is not lawful. Contact your Head Teacher. If you are not satisfied, you may complain to the Personal Data Protection Commission (PDPC).

8. Changes

This notice may be updated. The current version is always available on the sign-in page.

← Back to sign in