Privacy Policy for KanteenPay

Effective Date: September 1, 2026
Last Updated: September 2026

Welcome to KanteenPay. We respect your privacy and are committed to protecting the personal and transaction data of our users, including students, parents, schools, and canteen operators.

1. Information We Collect

When you use KanteenPay, we collect information necessary to facilitate cashless canteen transactions, account management, and balance tracking:

Student & Parent Information: Student name, grade/section, student ID number, parent/guardian contact details (email and mobile number).
RFID Card Identification: Encrypted identifiers associated with the physical RFID student ID card. Note: Sensitive card identifiers are hashed using cryptographic hashing algorithms prior to storage.
Transaction History: Purchase records, timestamps, itemized canteen orders, payment amounts, and account balance changes.
Device & Usage Data: IP addresses, browser/device types, log files, and timestamps when accessing the KanteenPay web or mobile portals.

2. How We Use Your Information

We use the collected information solely for legitimate operational and educational service purposes:

Processing Transactions: Enabling swift, tap-to-pay purchases at participating school canteens.
Account Balance & History Management: Allowing parents and students to monitor transaction history and maintain account balances.
School Canteen Operations: Assisting canteen staff and school administrators in tracking daily sales, reconciling inventory, and generating transaction summaries.
Security & Fraud Prevention: Detecting unauthorized card usage, protecting system integrity, and maintaining audit logs.

3. Data Protection & Security Architecture

We enforce high-standard technical and organizational security measures:

Encrypted Card Storage: All RFID card identifiers are hashed using one-way cryptographic hashing before being saved in the database.
Data Encryption in Transit: All communications between client applications, RFID tap terminals, and our servers use TLS/HTTPS encryption.
Role-Based Access Control: Access to administrative dashboards is strictly segmented between system administrators, canteen operators, and parents.
Clean Architecture Principles: Separation of business logic from infrastructure ensures robust data validation and security audits.

We do not sell, rent, or trade your personal information to third parties.

Information is only shared under the following conditions:

With Your School / Educational Institution: Relevant transaction records and student balances are accessible to the designated school administrators and authorized canteen staff.
Legal Requirements: If required by law, subpoena, or government authority in compliance with applicable data privacy laws.

5. Parent & Student Rights

Under applicable privacy regulations (such as the Data Privacy Act), you have the right to:

Access and review the personal information and transaction logs associated with your account.
Request corrections to inaccurate student or contact details through your school administration.
Request deactivation or unlinking of lost/stolen RFID cards immediately to prevent unauthorized transactions.

6. Retention of Data

We retain student transaction history for the duration of the student's active enrollment at the participating institution or as required by the institution's financial audit policies. Upon graduation or account closure, data is securely archived or anonymized.

7. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to KanteenPay or changes in regulatory requirements. When updates occur, the "Last Updated" date at the top of this document will be revised.

8. Contact Us

If you have questions or concerns regarding this Privacy Policy or your data, please reach out to us:

Email: privacy@kanteenpay.com
Project Support: support@kanteenpay.com
Developer: Errold Jay Batay-an