A plain account of the data behind a school wallet: what the app collects, who else sees it, how long it stays, and the one thing that never leaves the till.
Effective 9 September 2026Last updated 9 September 2026
Who we are
SEndiPay is owned and operated by WR Concepts, a company registered in Uganda at registered address. In this notice, “we” means that company and “you” means whoever is reading it: most often a parent or guardian, sometimes a member of canteen or school staff.
For the purposes of the Data Protection and Privacy Act, 2019, we are the data controller for the personal data described below. Our data protection contact is data protection contact, and we are registered with the Personal Data Protection Office under PDPO registration number.
One sentence, if you read nothing else: fingerprints never leave the till phone they were captured on, and we never see one.
What we collect, and why
We collect what the service needs to work and stop there. There is no advertising on SEndiPay, no profiling, and nothing here is collected in order to be sold.
Parent account
Name, phone number, email address and password. Needed to create an account, to sign you in, and to send the one-time codes that verify each of those channels.
Child record
The child's name, their school, and the student number the school uses, or one SEndiPay issues if the school has none. Needed to attach a wallet to the right pupil and to recognise them at any counter in that school.
Biometric template
A mathematical template derived from a fingerprint, in the ANSI/INCITS 378 format. Needed to verify a pupil at the till. Covered in full in the biometric policy, and never held by us.
Wallet and transactions
Balances, top-ups, daily caps, and each purchase with its items, amount, counter and time. Needed to run the wallet, to enforce the cap, and to give you an activity feed you can check a receipt against.
Mobile money details
The MTN MoMo or Airtel Money number a top-up came from and the reference the network returns. Needed to move the money and to trace a payment that goes wrong.
Canteen and school staff
Name, phone number, role and the permissions attached to it: who may take a sale, who may re-enrol a pupil, who may withdraw a settlement.
Device and diagnostic data
App version, device model, operating system version, and crash and error reports. Needed to keep the app working on the hardware people actually have.
We do not collect location data, we do not read your contacts, and the app asks for camera access only for the QR wristband fallback and only at the moment you use it.
Children's data
Almost every pupil on SEndiPay is a child, and their data is the most sensitive thing on the platform. Children do not hold SEndiPay accounts. A child record exists only because a parent or guardian created it, or because a school enrolled the pupil with the parent's authorisation.
No direct sign-up. There is no route for a child to register themselves, and nothing in the app is marketed to them.
Parental control. The parent who added a child can see everything held about that child, change the daily cap, and ask for the record to be deleted.
Minimum footprint. A child record carries a name, a school, a student number and a wallet. It does not carry a date of birth, a photograph, an address or a contact number unless a school has a specific reason to supply one.
Where a school rather than a parent enrols a pupil, the school is responsible for having a lawful basis to do so, and we act on its instructions under a written agreement. confirm school agreement wording
Why we are allowed to hold it
Under the Data Protection and Privacy Act, 2019, we rely on the following:
Performance of a contract. Running the wallet, taking a payment, enforcing a cap, settling a canteen's takings.
Consent. Enrolling a fingerprint. Consent is given by the parent or guardian before a pupil is enrolled, it is recorded, and it can be withdrawn at any time without losing access to the wallet, because the QR wristband does the same job.
Legal obligation. Keeping transaction records for as long as Ugandan financial and tax law requires.
Legitimate interests. Fraud prevention, security monitoring, and fixing the app, balanced each time against the interests of the person whose data it is.
Who else sees it
Only where the service cannot work otherwise:
The school and its canteen
The pupil's name, student number, wallet balance and purchases at that school's counters. A canteen sees what it needs to serve a pupil and take a sale, and nothing about any other school.
MTN MoMo and Airtel Money
The phone number and amount for a top-up or a settlement withdrawal. They are separate controllers for what they do with it under their own terms.
Infrastructure and support providers
Hosting, error reporting and messaging, under contract and only to run the service. list processors and their locations
Authorities
Where we are legally required to, and no further than the requirement goes.
We do not sell personal data, and we do not share it for anyone else's marketing.
Where it is held, and for how long
Account, wallet and transaction data is held on servers in hosting region. Where data leaves Uganda, we do so on the terms the Act permits and under contractual protections with the provider.
Biometric templates. On the till device, for as long as the pupil is enrolled at that school. Deleted on withdrawal of consent, on request, or when the pupil leaves.
Transaction records. Kept for retention period: confirm against Ugandan tax and financial record rules, because we are required to be able to produce them.
Account and child records. Deleted within 30 days of a deletion request, except where a transaction record has to be kept, in which case what remains is the transaction, not the profile.
Diagnostic data.diagnostic retention period.
How it is protected
Fingerprints stay on the device. The reader produces a template and discards the image. Matching happens on the till phone, and only the verdict and a confidence figure travel with the sale.
Encryption. Everything in transit is encrypted. confirm at-rest encryption and key management
Permissions, not trust. A cashier can take a sale. Re-enrolling a fingerprint needs the student's PIN, and withdrawing a settlement needs a separate permission, so no single person at a counter can do all three.
Server-side re-checks. A daily cap and a settlement withdrawal are both re-validated on the server, so a compromised till cannot exceed either.
If a breach happens that is likely to harm anyone, we will notify the Personal Data Protection Office and the people affected as the Act requires. confirm internal breach process and timelines
Your rights
You can ask us to do any of the following, for yourself or for a child whose record you created:
See it. A copy of what we hold.
Correct it. A wrong name, a wrong school, a wrong student number.
Delete it. Including a biometric template, which we will confirm has been removed from the till.
Withdraw consent. For fingerprint enrolment specifically, at any time, without losing the wallet.
Object or restrict. Where we are relying on legitimate interests.
Complain. To us first, and to the Personal Data Protection Office if we have not put it right.
Write to info@sendipay.net. We answer within response window and we do not charge for it.
Changes to this notice
When this notice changes we update the date at the top of the page. If a change materially affects how a pupil's data is handled, biometrics above all, we tell affected parents in the app before it takes effect, rather than relying on them to re-read the page.
Questions about this document
Write to info@sendipay.net. That is the address for all of it - a parent's question about a wallet, and a school's about a counter or a settlement.
