Privacy Policy

Effective date: July 17th, 2026 Last updated: July 17th, 2026

This Privacy Policy explains how Cosmos Educational Press Limited (”Cosmos”, “we”, “us”, “our”) handles personal data in connection with Zuwaa, our school booklist and supplies service (the “Service”). Zuwaa is built on the FeePrime ERP platform, which provides and maintains much of the underlying infrastructure and security.

1. Two roles — please read this first

We handle personal data in two distinct capacities, and this Policy covers both:

1. As a controller — for the personal data of people who use Zuwaa directly: parents and guardians who place orders, and school staff who administer their school’s account. This includes contact details, order history, and payment-related information. This Policy governs that data.

2. As a processor — where a school provides personal data about its own pupils so that orders can be prepared and fulfilled, the school is the controller of that pupil data and decides why and how it is processed; we handle it on the school’s behalf and on its instructions. If your child’s data is in Zuwaa because their school placed it there, that school’s privacy notice governs its use, and you should contact the school to exercise rights over it. We assist schools in responding to such requests.

The sections below concern personal data for which we are the controller, unless stated otherwise.

2. Personal data we collect (as controller)

• Account and contact data — name, email, phone number, and the school or class an order relates to.
• Order data — the booklists and items ordered, delivery or collection details, and order history.
• Payment-related data — enough to process and reconcile a payment. We do not store your full payment-card numbers or mobile-money PINs. Payment credentials handled by the platform are encrypted.
• Authentication data — information used to sign you in securely (for example, one-time codes or single sign-on identifiers). Passwords, where used, are stored only as one-way hashes and are never recoverable.
• Usage and technical data — log data, device and browser information, IP address, and interactions with the Service, used to operate, secure, and improve it.
• Communications — messages you send us (for example, support requests).

3. Why we use it, and our legal bases

We use personal data (as controller) to:

• provide and administer the Service, process your orders, and manage your account — to perform our contract with you;
• take and reconcile payments — to perform our contract and comply with legal and accounting obligations;
• secure the Service and prevent fraud and abuse — for our legitimate interests and legal obligations;
• communicate with you about your orders and important service notices — to perform our contract and for our legitimate interests;
• improve the Service — for our legitimate interests, using data in a limited and, where appropriate, aggregated way; and
• comply with law and respond to lawful requests.

Where we rely on consent (for example, certain marketing), you may withdraw it at any time.

4. Sharing and recipients

We do not sell personal data. We share it only with:

• Our technology and service providers, by category: the FeePrime ERP platform and its EU-based hosting provider, our licensed payment aggregator, and providers of authentication, security, email delivery, and delivery/logistics as needed to fulfil your order.
• Schools, where an order relates to a pupil at that school and sharing is necessary to prepare or deliver it.
• Professional advisers (such as auditors and lawyers) where necessary and bound by confidentiality.
• Authorities, where required by law or to protect rights, safety, or the integrity of the Service.

5. International data transfers

The Service is hosted on infrastructure located in the European Union (Germany). If you use Zuwaa from Cameroon or elsewhere, your personal data will be transferred to and stored in the EU. Where personal data is transferred across borders, we rely on appropriate safeguards recognised under applicable data-protection law and take reasonable steps to keep it protected to the standard described here.

6. Retention

We keep personal data for as long as needed to provide the Service and your account and to fulfil your orders, and afterwards only as long as necessary to meet legal, accounting, and security obligations, or to resolve disputes. Backups are retained on a rolling cycle and then overwritten. When data is no longer needed, we delete or anonymise it.

7. Security

We protect personal data with appropriate technical and organisational measures, including encryption in transit, encryption of the most sensitive data at rest, strict role-based access controls, an immutable audit trail, and encrypted backups. A plain-language summary is on our security page. No system is perfectly secure, but we work continually to protect your data.

8. Children and pupil data

Zuwaa exists to serve schools and families, and necessarily involves information about pupils. We handle pupil data only to prepare and fulfil orders, protect it with the measures above, and never sell it. Where a school provides pupil data, that school is the controller and is responsible for the lawful basis for it (see Section 1). Where a parent or guardian provides their own child’s details to place an order, we use those details only for that order.

9. Your rights

Subject to applicable law, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to certain processing, to receive it in a portable format, and to withdraw consent where processing is based on it. You may also complain to a competent data-protection authority.

To exercise these rights over data for which we are the controller, contact us using the details below. If the data concerns a pupil and was provided by a school, please contact that school (see Section 1).

10. Cookies

Our websites use essential cookies needed to sign you in and keep the Service secure, and may use analytics cookies to understand and improve usage. Where required, we ask for your consent to non-essential cookies. You can also control cookies through your browser settings; disabling essential cookies may affect how the Service works.

11. Changes to this Policy

We may update this Policy from time to time. Where changes are material, we will give reasonable notice before they take effect. The “Last updated” date above shows the current version.

12. Contact

For privacy questions or to exercise your rights (as controller): info@cosmospublishers.org Cosmos Educational Press Limited.