Privacy Policy

WAEC IRIS (Irregularity Reporting & Investigation System) is a secure digital platform that enables the transparent management of examination irregularity and malpractice cases conducted by the West African Examinations Council in Ghana. The App replaces paper-based processes with a centralized, real-time system for reporting, tracking, and resolving examination misconduct cases.

Core functions of the App include:

• Allowing candidates to check the real-time status of their examination malpractice case using their index number and date of birth
• Allowing schools to log in and review malpractice case statuses for all their enrolled candidates
• Providing advanced search and filtering of irregularity records for authorized school personnel
• Delivering real-time dashboards and analytics to support evidence-based decision-making by WAEC officials and schools
• Maintaining a complete and auditable record of all irregularity and malpractice proceedings

WAEC IRIS serves two distinct categories of authorized users. Each has a different login method and a different level of data access:

We collect only the data necessary to provide the App's services. The table below details all data collected, mapped to Google Play's Data Safety categories:

We do not collect biometric data, financial account information, precise geolocation, health data, or social media profiles.

All data collected is used strictly for the purposes below. We apply the principle of purpose limitation — your data will not be processed for any purpose incompatible with why it was originally collected.

• To authenticate and authorize candidates and school users and grant appropriate access to case information
• To display examination irregularity case statuses accurately and in real time to the authorized party
• To enable schools to monitor malpractice cases affecting their registered candidates
• To maintain an auditable access log for security and accountability purposes
• To detect and prevent unauthorized access, fraud, and abuse of the case management system
• To generate aggregate, anonymized statistics for WAEC-GH administration and policy decisions
• To improve App performance through anonymized crash and usage analysis
• To comply with legal and regulatory obligations applicable to WAEC as a statutory examination body in Ghana

We do not use your personal data for advertising, commercial profiling, or any purpose unrelated to examination irregularity management. We do not sell your data.

Our processing of personal data is grounded in the following lawful bases under Ghana's Data Protection Act, 2012 (Act 843):

• Consent: Candidates and school users consent to data processing by voluntarily logging into the App to access case information
• Contractual necessity: Processing is necessary to deliver the service requested — access to irregularity case records
• Public task & statutory function: WAEC-GH is established by statute to regulate public examinations in Ghana, which includes managing irregularity and malpractice proceedings
• Legitimate interests: To protect the integrity of the examination system, secure accounts, and prevent unauthorized access to sensitive case records
• Legal obligation: To comply with orders from courts, law enforcement, the Data Protection Commission of Ghana, or other competent regulatory bodies

We do not share personal data with third parties except in the following limited and necessary circumstances:

• Registered Schools: Schools may access malpractice case information for candidates registered under their school code — a core and disclosed function of the App
• WAEC Regional & National Offices: Authorized WAEC officials may access case records for administrative and investigative purposes under WAEC's statutory mandate
• Legal & Regulatory Authorities: Data may be disclosed to law enforcement, courts, or Ghana's Data Protection Commission where required by law or court order
• IT & Infrastructure Providers: Trusted technical partners who host and maintain the App under strict data processing agreements, bound by confidentiality obligations

Data is retained only as long as necessary to fulfil the purposes described in this policy and to meet WAEC-GH's legal and statutory obligations.

Examination malpractice records cannot be deleted upon request, as they form part of the permanent official record maintained by WAEC-GH under its statutory mandate. All other personal data may be subject to deletion requests as described in Section 9.

Given the sensitivity of examination irregularity data, we apply robust technical and organizational security measures:

• TLS/SSL encryption for all data in transit between the App and our servers
• AES-256 encryption for sensitive data stored at rest
• Hashed and salted passwords — school passwords are never stored in plaintext
• Multi-factor authentication inputs: Candidates must supply index number, date of birth, and exam year; schools use verified email credentials
• Role-based access control (RBAC) ensuring each user can only access data relevant to their role
• Automated session expiry to protect unattended accounts
• Access logging and anomaly detection to identify and flag suspicious login activity
• Regular security audits and vulnerability assessments of the App and backend infrastructure

Under Ghana's Data Protection Act, 2012 (Act 843), you have the following rights with respect to your personal data:

To exercise any of these rights, contact the WAEC-GH Data Protection Officer (Section 13). We will respond within 21 days. Note that examination malpractice records cannot be deleted as they are statutory records.

Data Protection Commission of Ghana: www.dataprotection.org.gh

WAEC IRIS is designed for use by examination candidates who may be under 18 years of age, as WAEC examinations (including the BECE and WASSCE) are taken by students who may be minors.

• We collect only the minimum data necessary for a minor candidate to check their case status (index number, date of birth, exam year)
• Minors' case data is never used for advertising, profiling, or any purpose beyond displaying their case status
• We do not knowingly collect personal data from children under 13 years of age beyond the core examination case-checking function
• Schools using the App on behalf of minor candidates are responsible for ensuring appropriate parental or guardian consent per their institutional policies
• We do not subject minor users to behavioral advertising or commercial data monetization of any kind

WAEC IRIS may use the following categories of third-party services, each governed by its own privacy terms:

All third-party processors are required to handle data in accordance with Act 843 and our data processing agreements. We do not use third-party advertising SDKs, and we do not permit third parties to collect data for their own commercial purposes through this App.

We may update this Privacy Policy periodically to reflect changes in the App's functionality, applicable laws, or our data practices. When material changes are made:

• The "Last Updated" date at the top of this policy will be revised
• A notice will be displayed within the App informing users of the update
• Where required by law, we will seek renewed consent before changes take effect

We encourage periodic review of this policy. Continued use of WAEC IRIS after the effective date of any changes constitutes acceptance of the updated policy.

WAEC-GH is the Data Controller for all personal data processed through WAEC IRIS. For questions, requests, or concerns about this policy or your personal data, please contact: