Terms of use and privacy

A record-keeping system for the BA Media Management programme. It holds class registers, assessment marks, course evaluations, staff attendance and leave, equipment and studio bookings, and a shared library of departmental resources.

It is an internal tool for the department. It is not a public service, and no part of it is offered to anybody outside the university.

Staff of the department, with an account created by Management. Students of the programme, through the separate student area, using a sign-in link sent to their university address.

Accounts are personal. Do not share your password or your sign-in link with anybody, including colleagues — the record of who marked a register or changed a grade is only meaningful if it names the person who actually did it.

• Staff sign in with an email address and a password. A new account must change its password the first time it is used.
• Students do not have a password. They request a sign-in link, which works for 48 hours and only for the address it was sent to. A student session lasts 30 days.
• Repeated failed sign-ins lock an account for a short period. This is deliberate and is not a fault.
• Changing your password signs out every other device immediately.
• If you think somebody else has used your account, tell Management at once and change your password.

• Your name, work email, position, department and staff code.
• Attendance at work, including clock-in and clock-out times where your role records them, and which of the 6 leave categories you have requested.
• Teaching load, and the course evaluation scores your classes receive.
• The date and time you last signed in, and an audit entry for actions that change records — marking a register, editing a grade, creating an account, removing a resource.
• Anything you type into your own calendar. Colleagues see only that you are busy unless you tick the box that shares the detail.

• Name in Khmer and Latin script, student ID, sex, date of birth, and contact details.
• Enrolment, attendance at every session, assessment marks and final grades.
• Advising notes, disciplinary records and scholarship flags, where staff have added them.
• Absence requests and equipment or studio bookings the student has made.

Students see their own information and their lecturers’ availability. They cannot see other students’ records, and the staff calendar is redacted for them — a lecturer’s leave appears only as “Unavailable”, never as the reason for it.

If you are a member of staff, then:

• Look at a student’s record because your work requires it, not because you are curious. Access is logged.
• Do not export marks or personal details to a personal device, a personal email account, or any service the department has not approved.
• Do not put student records or unreleased exam papers in the Resources area. Anything uploaded there can be opened by anybody holding the link.
• Disciplinary notes are visible to DMC Staff and above. Write them as you would if the student were reading them, because one day they may.

Access follows your role. A lecturer sees their own classes and the students on their registers. DMC Staff see the programme. HR and Finance see staff attendance and leave but nothing academic. Only Management sees the full audit log, because it carries grade changes and student record edits.

• Academic records — registers, marks, grades — are kept for as long as the department needs them, which is the life of the programme record.
• Audit entries are kept indefinitely and cannot be edited or removed by anybody.
• The database is backed up twice a day to private storage. A backup may hold a copy of something for a period after it was deleted from the system itself.
• Sign-in links, password reset links and sessions expire on their own and are not kept afterwards.

The system runs on free hosting tiers. It may be briefly slow after a period of inactivity while it starts up, and it may be unavailable for maintenance. It is not guaranteed to be available at any particular moment, so do not rely on it as the only copy of anything you cannot recreate.

If you find a vulnerability, please report it before telling anybody else, and give us a reasonable time to fix it. We will not pursue anybody who reports in good faith.

Email kimlongro5664@gmail.com. The same address is published at /.well-known/security.txt.

Please do not test against real student records. Ask and we will make you an account with test data.

This page is updated when the system changes. It describes what the system actually does; where it and the system ever disagree, the system is the fact and this page is the bug — please report it.