1. Introduction
LBS Online Platform (Pvt) Ltd (“Upskul”, “we”, “us” or “our”) operates the Upskul educational platform.
We respect the privacy of learners, parents and guardians, teachers, schools, institutions, instructors, publishers and other users.
This Privacy Policy explains what personal information we collect, why we use it, how it may be shared, how we protect it, and the choices and rights available to individuals.
We process personal information in accordance with applicable law, including the Cyber and Data Protection Act [Chapter 12:07] and applicable regulations and guidance. Zimbabwe’s Data Protection Authority is POTRAZ.
2. Who We Are
LBS Online Platform (Pvt) Ltd
Website: Upskul
Privacy contact: [email protected]
For privacy matters, you may contact us using the address above.
3. Different Privacy Roles
We may act in different privacy roles depending on the service.
Upskul as a platform operator
We may determine why and how certain information is processed for:
- account management;
- platform security;
- authentication;
- customer support;
- billing;
- platform administration;
- service improvement;
- legal compliance; and
- other legitimate platform operations.
Upskul acting for a school
Where a school uses Upskul to manage school-controlled information, the school may determine the purposes for which learner, teacher or school information is processed.
In those circumstances, we may process information on behalf of the school under the school’s instructions and applicable agreements.
A separate School Data Processing Agreement may govern these arrangements.
4. Personal Information We Collect
Depending on how you use Upskul, we may collect:
Account information
- name;
- email address;
- telephone number;
- country;
- account role;
- school;
- class or academic information;
- platform identifier;
- referral information; and
- other account information you provide.
Academic information
Depending on the service:
- subjects;
- classes;
- assessments;
- examination attempts;
- answers;
- marks;
- feedback;
- progress;
- learning activity;
- assignments; and
- educational content.
Payment information
We may process:
- payment references;
- proof-of-payment documents;
- payment status;
- subscription information;
- financial records;
- instructor or publisher payout information; and
- bank or mobile-money details where users provide them for authorised payouts.
5. Security and Device Information
To protect accounts and the platform, we may process:
- IP addresses;
- browser information;
- device information;
- session information;
- trusted-device information;
- failed login attempts;
- security events;
- anti-bot verification information; and
- hashed device identifiers.
For example, library activity may include a hashed device identifier and IP address, while certain assessment systems may record browser and IP information.
We use this information for purposes including:
- authentication;
- fraud prevention;
- account protection;
- examination integrity;
- security monitoring;
- troubleshooting; and
- platform administration.
6. Examination Monitoring
Some examinations may use security features that record events such as:
- browser-tab changes;
- leaving full-screen mode;
- copy/paste activity; and
- other examination-security events.
These records may be accessible to authorised teachers, instructors or examination administrators.
7. Virtual Classroom Information
When you participate in a virtual classroom, we may process:
- your name;
- email address;
- organisation;
- participation information;
- camera input;
- microphone input;
- connection information; and
- other information necessary to operate the classroom.
Where classroom recording is enabled, a recording may be created and stored for the purposes communicated for that classroom.
8. Information About Children
Upskul serves learners who may be under 18.
Children have specific privacy protections under Zimbabwean law and current data-protection guidance. POTRAZ’s children’s-information guideline states that persons below 18 are children and addresses the role of legal guardians in exercising children’s privacy rights and providing consent where required.
Where a child uses Upskul through a school, the school is responsible for ensuring that it has the appropriate authority and permissions to provide the child’s information to us.
Where a parent or legal guardian directly enrols a child, the parent or legal guardian is responsible for providing the required authorisation.
We may take reasonable measures to verify parental or guardian authority where required.
We seek to apply privacy protections appropriate to children’s information and avoid collecting information that is unnecessary for the educational service.
9. How We Use Personal Information
We may use personal information to:
- create and manage accounts;
- provide educational services;
- deliver courses and learning content;
- administer examinations;
- record academic progress;
- provide AI-assisted educational services;
- operate virtual classrooms;
- process payments;
- manage subscriptions;
- communicate with users;
- provide support;
- protect accounts;
- detect fraud and abuse;
- maintain platform security;
- investigate incidents;
- comply with legal obligations;
- maintain records;
- administer schools and institutions;
- provide certificates;
- manage instructors and publishers; and
- operate and improve Upskul.
10. Legal Grounds for Processing
Depending on the circumstances and applicable law, personal information may be processed where:
- the individual has provided valid consent;
- processing is necessary to provide a requested service;
- processing is required by law;
- processing is necessary to protect rights or security;
- processing is necessary for legitimate platform or institutional purposes where permitted; or
- another lawful basis applies.
Consent may be withdrawn where consent is the basis for processing, although withdrawal does not necessarily affect processing that was lawful before withdrawal.
Zimbabwe’s data-protection framework establishes requirements concerning lawful processing, consent and data-subject rights.
11. Artificial Intelligence
Upskul uses or may use commercial AI services to provide educational functionality.
Depending on the service and configuration, information may be sent to AI providers such as:
- Google Gemini;
- OpenAI;
- Anthropic; and/or
- DeepSeek.
The particular provider used depends on the feature and the configuration active at the relevant time.
Examples of AI processing include:
- answering learner questions;
- analysing written answers;
- reading handwritten scripts through OCR;
- generating explanations;
- generating questions;
- generating flashcards;
- assisting with grading; and
- summarising educational content.
We aim to minimise unnecessary personal information sent to AI services.
For example, an AI request may contain the learner’s question, answer, subject and topic rather than unnecessary identifying information.
AI providers process submitted information under their applicable service arrangements and terms.
We do not use AI-generated educational output as an automatic substitute for required human academic judgment.
12. Third-Party Service Providers
We may use third-party providers to operate our services.
Depending on the feature, these may include providers supporting:
- cloud infrastructure;
- file storage;
- content delivery and security;
- email;
- AI processing;
- virtual classrooms;
- payment-related services where actually enabled; and
- other technical operations.
Third-party providers may process personal information only as necessary for the services they provide to us or as otherwise permitted by applicable arrangements.
13. International Data Transfers
Some of our infrastructure or service providers may process information outside Zimbabwe.
For example, cloud or AI services may operate from other countries.
Where personal information is transferred across borders, we will apply safeguards required by applicable law and relevant contractual or technical arrangements.
Zimbabwe’s current cross-border-transfer guidance specifically addresses conditions applicable to transferring personal information outside Zimbabwe.
15. Communications
We may contact users through:
- email;
- platform notifications;
- WhatsApp where applicable;
- SMS or other supported communication channels; and
- other communication methods provided through the platform.
Communications may concern:
- account activity;
- security;
- payments;
- courses;
- examinations;
- school activities;
- support;
- service updates; and
- other relevant platform operations.
17. School Data
Where we provide services to a school, the school may control information relating to its learners, teachers, classes, academic records and school operations.
Schools may have rights and responsibilities concerning this information.
We may provide school data export and account-closure mechanisms allowing eligible school information to be exported before closure.
School data will not automatically be treated as our own intellectual property merely because it is stored on Upskul.
18. Data Retention
We retain personal information for as long as reasonably necessary for the purposes for which it is processed, including:
- providing services;
- maintaining academic records;
- account administration;
- security;
- dispute resolution;
- financial/accounting purposes;
- legal compliance; and
- legitimate operational requirements.
Different categories of information may therefore have different retention periods.
Where applicable, legal, accounting, regulatory or contractual requirements may require information to be retained for a specified period.
19. Account Deletion
Where an account is eligible for deletion, we may apply a deletion process that includes a 90-day deletion grace period.
During this period, the account may be recoverable where applicable.
After the applicable deletion process is completed, information may be deleted or anonymised, subject to information that we are legally required or otherwise lawfully entitled to retain.
School closure and individual account deletion are separate processes.
20. Data Security
We use technical and organisational measures intended to protect personal information against:
- unauthorised access;
- loss;
- misuse;
- alteration;
- disclosure; and
- destruction.
Security measures may include:
- authentication controls;
- access controls;
- session security;
- trusted-device mechanisms;
- rate limiting;
- anti-bot protection;
- monitoring;
- backups;
- encrypted connections;
- infrastructure security; and
- other appropriate controls.
We do not claim that any internet-based system can be completely secure.
21. Personal Data Breaches
If we become aware of a personal-data security incident, we will assess and respond to it in accordance with applicable law and our incident-response procedures.
Where notification is legally required, we will notify the relevant authority and/or affected individuals within the applicable requirements.
Zimbabwe’s data-protection framework includes specific provisions concerning security breaches and notification.
22. Your Privacy Rights
Subject to applicable law and relevant limitations, individuals may have rights including:
- access to personal information;
- correction of inaccurate information;
- deletion where applicable;
- restriction of processing where applicable;
- objection to certain processing;
- withdrawal of consent where consent is the legal basis;
- information about processing; and
- portability where applicable.
Requests involving children may need to be made by the child’s parent, guardian or other legally authorised representative.
23. Making a Privacy Request
Privacy requests should be sent to: [email protected]
Please provide enough information for us to understand the request and, where necessary, verify your identity or authority to make the request.
We may request additional information where reasonably necessary to protect personal information against unauthorised disclosure.
24. Parents and Guardians
Parents and guardians may contact us regarding information relating to a child for whom they have lawful parental or guardianship authority.
We may request reasonable evidence of identity and authority before disclosing or changing information.
For children using Upskul through a school, some requests may need to be coordinated with the relevant school.
25. Data Protection Agreements With Schools
Where we process personal information on behalf of a school, the parties may enter into a separate data-processing agreement.
That agreement may specify:
- the categories of information;
- processing purposes;
- instructions;
- security requirements;
- confidentiality;
- sub-processors;
- retention;
- deletion;
- school data exports;
- incident handling; and
- other applicable responsibilities.
26. Third-Party Websites
Upskul may contain links to websites or services operated by third parties.
We are not responsible for the privacy practices of third-party websites.
Users should review the privacy policies applicable to those websites.
27. Changes to This Privacy Policy
We may update this Privacy Policy when our services, technology, legal obligations or data-processing practices change.
Each published version will have a version number and effective date.
Where appropriate, significant changes may be communicated to users or require renewed acknowledgement.
28. Contact
For privacy questions, requests or concerns:
LBS Online Platform (Pvt) Ltd
Privacy contact: [email protected]
LBS Online Platform (Pvt) Ltd · Privacy Policy version 1.0, effective 1 October 2026.