Your Data, Protected

Overview

Schoolics processes school operational data on behalf of subscribing institutions. Each school controls its own student, staff, and parent records. Schoolics acts as a data processor; the school remains the data controller. This policy explains how we handle data to protect privacy and comply with applicable regulations.

Data We Collect

We collect and process data necessary to deliver school management services. This includes:

• • School profile and branding: School name, logo, colors, letterhead, contact details, and domain configuration.
• • Student records: Personal information, academic records, attendance, fees, health records, and parent/guardian details entered by the school.
• • Staff records: Employment details, payroll information, attendance, and performance records.
• • Operational data: Academic transactions, attendance records, financial transactions, and communication logs.
• • Security data: Authentication logs, access logs, and audit trails for security and compliance purposes.
• • Contact inquiries: Information submitted through our contact forms by prospective schools.

How We Use Data

Data is used solely to deliver school management features and improve our services. We do not sell, rent, or share personal data with third parties for marketing purposes. Specific uses include:

• • Providing access to school management features (fees, results, attendance, communication, reporting)
• • Processing payments through certified payment gateways
• • Sending SMS and email notifications as configured by the school
• • Generating reports, certificates, and official documents
• • Maintaining security through authentication and audit logging
• • Improving our services through aggregated, anonymized analytics

Data Security

We implement industry-standard security measures to protect your data:

• • Encryption: All data is transmitted over encrypted connections (SSL/TLS). Data at rest is encrypted in secure cloud infrastructure.
• • Tenant isolation: Each school's data is logically separated. Schools can only access their own data.
• • Access controls: Role-based permissions ensure users only access data relevant to their role.
• • Audit logging: All data access and modifications are logged for security and compliance.
• • Payment security: Card details are processed by certified payment gateways (Paystack, Flutterwave) and are never stored on our servers.
• • Backups: Regular automated backups with disaster recovery procedures.

NDPR Compliance

Our architecture supports Nigeria Data Protection Regulation (NDPR) requirements:

• • Lawful basis: Data processing is based on school enrolment and contractual agreements with subscribing institutions.
• • Data minimisation: We collect only data necessary for service delivery.
• • Access controls: Schools control who can access their data through role-based permissions.
• • Data rights: Schools can export, correct, or request deletion of their data through the school administrator.
• • Breach notification: We have procedures to notify affected parties in case of data breaches.

Third-Party Processors

Schoolics uses vetted third-party services to deliver certain features:

• • Cloud infrastructure: Secure cloud providers for data hosting and processing.
• • Payment gateways: Paystack and Flutterwave for processing online payments.
• • SMS providers: Approved messaging providers for SMS notifications when enabled by schools.

A detailed sub-processor schedule is available to authorized parties — school proprietors, governing boards, and regulators — on written request via Schoolics support.

Data Retention

We retain data for as long as necessary to provide our services and comply with legal obligations. Schools may export or delete their data at any time subject to subscription terms. Upon subscription termination, schools can export their data before it is securely deleted according to our data retention policy.

Your Rights

Schools have the following rights regarding their data:

• • Access: Request access to data held about your school.
• • Correction: Request correction of inaccurate data.
• • Deletion: Request deletion of data subject to subscription terms and legal obligations.
• • Export: Export data in a portable format.

To exercise these rights, contact your school administrator or Schoolics support.

Contact

For privacy enquiries, data subject requests, or to report a privacy concern, contact your school administrator or reach Schoolics support. We will respond to privacy-related inquiries within 30 days.