Privacy policy

Last updated 11 Oct 2026. Version 2026-10-11.

This policy explains how EduGlobally (SMC-Pvt) Ltd ("we", "us") handles information in ERP, Educational Regulator Program, available at erp.edu-globally.com. It is written to be read by institute leaders, staff, parents and students.

1. Who is responsible for the information

Each institute that uses ERP decides what information about its students, parents, guardians and staff is entered and why. The institute is responsible for that information and for having a lawful reason and any required consent to hold it. We look after the information on the institute's behalf and use it only to provide the service to that institute.

We are responsible for the information we collect about the people who register and manage institute accounts, and for information about how the service is used.

2. Information we hold

• Institute account details: institute name, type, city, contact phone and email, address, logo, campuses and subscription records.
• User accounts: names, email addresses, usernames, mobile numbers, roles and the campuses each person may use. Passwords are stored only in a scrambled form that cannot be turned back into the password.
• Records entered by institutes: for example student details, guardian contact details, classes, attendance, marks, results, fees and staff records.
• Security and usage records: sign in times, the internet address and device type used, and a log of important changes showing who made them and when.
• Payments: amounts, dates and references of subscription payments. Card details are entered on the payment provider's own secure page; we never see or store full card numbers.

3. How we use information

• To provide, secure and support the service for each institute.
• To create and manage accounts, send sign in links, reminders and receipts.
• To manage free trials, subscriptions and payments.
• To detect and prevent misuse, fraud and security attacks.
• To meet legal obligations, such as keeping financial records.

We do not sell personal information, use it for advertising, or use institute records for any purpose of our own.

4. Children's information

Institutes enter information about students, many of whom are children. Only people the institute authorises can see it, and parents see only their own children. Institutes should collect only what they need and keep guardians informed about what is recorded.

5. The law we follow

We handle information in line with Article 14 of the Constitution of Pakistan, the Prevention of Electronic Crimes Act 2016 as amended, the Electronic Transactions Ordinance 2002 and the Contract Act 1872. Pakistan's Personal Data Protection Bill has not yet become law; we have written this policy to the standard it proposes and will update it when a data protection law comes into force.

6. Where information is stored

ERP runs on Cloudflare's global network. Databases and files are stored in Cloudflare data centres outside Pakistan, with the Asia Pacific region preferred. Information is encrypted while travelling over the internet. By using the service, institutes agree to their information being stored and processed in this way.

7. Who else handles information

• Cloudflare, Inc.: hosting, database, file storage and protection against automated attacks.
• Email delivery provider: to send sign in links, reminders and receipts.
• Payment provider: to take subscription payments, once card payments are available.
• Authorities: only when Pakistani law requires it, and we will tell the institute unless the law forbids us.

8. How we protect information

• Each institute's records are kept apart, and every request is checked so that one institute can never see another's records.
• Access inside an institute follows the roles and campuses the institute assigns.
• Repeated wrong passwords lock an account for a short time, and sessions end after a period of inactivity.
• Important changes are logged with who made them and when.
• Our own support access to an institute's account is recorded.

9. How long information is kept

• Institute records are kept while the institute has an account.
• After a subscription is cancelled, records are kept for 30 days so the institute can download them or change its mind, and are then permanently deleted. Deleted records disappear from our backups within a further 30 days.
• Security and sign in logs are kept for up to 12 months.
• Payment records are kept as long as Pakistani tax law requires.

10. Your choices and requests

Students, parents and staff should first contact their institute to see, correct or remove their information, because the institute controls those records. Institute administrators can update most information themselves and can download their institute's data at any time. You can also contact us; we reply within 30 days.

11. If something goes wrong

If we learn of a security incident affecting an institute's information, we will tell that institute without undue delay, and within 72 hours where possible, with what we know and what we are doing about it.

12. Cookies

We use only the small cookies the service needs to work: one to keep you signed in, one to protect forms from misuse, one to remember your institute code on your device, and one to show a message after a page changes. We do not use advertising or tracking cookies.

13. Changes to this policy

We will give institutes at least 30 days' notice of any important change, by email and on this page.

14. Contact

For privacy questions or requests, email info@edu-globally.com. Please include your institute code if you have one.