Privacy Policy

1. Introduction

Skoolly ("we," "our," or "us") is deeply committed to protecting the privacy and security of the personal data processed through our School Management System. This Privacy Policy details our data processing practices, clarifying our role as a Data Administrator/Processor working on behalf of schools (the Data Controllers).

This Privacy Policy is constructed in strict adherence to the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR), and standard African data protection frameworks. By using the Platform, you explicitly consent to the data practices described herein.

2. Information Collection Framework

We collect and process the following categories of data explicitly for the operation of the Platform:

• School Entity Data: Registration numbers, institutional names, addresses, banking details for payment processing, and branding assets.
• Staff Information: Full names, roles, employee IDs, contact details, system access logs, and attendance records.
• Student Data (Minors): Full names, dates of birth, gender, class assignments, continuous assessment scores, examination grades, attendance records, and behavioral logs. Note: Collection of this data relies entirely on the consent acquired by the School from the parent/guardian.
• Parent/Guardian Data: Full names, email addresses, phone numbers, and relational links to students.
• Technical & Telemetry Data: IP addresses, browser types, device identifiers, and system interaction logs required for cybersecurity and platform optimization.

3. Purpose & Legal Basis of Processing

Under NDPR guidelines, our processing of data is based on the necessity to fulfill our SaaS contract with the School, and legitimate interests in maintaining platform security. We process data strictly to:

• Facilitate the core functionality of the school management system (grading, timetable management, attendance tracking).
• Enable reliable communication bridging between school administrators, staff, and parents.
• Process subscription billing securely.
• Generate aggregated, non-personally identifiable analytical reports for school management.
• Detect, prevent, and address technical issues, fraud, or security threats.

4. Data Security & Storage Protocols

Your data is housed in world-class data centers featuring enterprise-grade physical and network security. We implement robust defense-in-depth security pipelines, including:

• Encryption: Real-time TLS 1.3 encryption for data in transit, and AES-256 encryption for data at rest.
• Access Architecture: Strict Role-Based Access Control (RBAC) and Row-Level Security (RLS) ensuring users can only access data explicitly permitted by their role and school affiliation.
• Audit Trails: Comprehensive logging of authentication events and data mutations to prevent and investigate unauthorized actions.

5. Third-Party Data Sharing

We absolutely do not sell, rent, or lease personal data to any third party under any circumstances. We employ sub-processors strictly limited to the technical delivery of our service:

• Cloud Infrastructure Providers (for database housing and application hosting).
• Telecommunications Gateways (for delivering SMS/Email notifications).
• Payment Processors (for securely handling subscription payments without storing credit card details on our servers).

All third-party sub-processors are legally bound by Data Processing Agreements (DPAs) that mandate compliance with NDPR stringencies.

6. Data Subject Rights (NDPR/NDPA Compliance)

In accordance with the NDPA, users retain full control over their personal data. Because Skoolly acts as the Data Processor, data access requests should generally be directed to the respective School (the Data Controller). However, we technically support the following rights:

• Right to Access & Portability: Schools can export their database archives at any time.
• Right to Rectification: Users can update their profiles or request the school to correct inaccurate academic records.
• Right to Erasure (Right to be Forgotten): Schools may delete student or staff records. A complete account deletion completely wipes the school's isolated data tenant from our systems.

7. Child Privacy Protocol

The Platform processes data of minors exclusively under the directive and consent structure of the registered educational institution. The School (Data Controller) assumes full legal responsibility for securing documented parental/guardian consent before entering a minor's information into the Platform. We do not use child data for profiling, marketing, or any purpose outside of delivering school management functionalities.

8. Changes to This Policy

We may periodically update this Privacy Policy to reflect technological advancements or evolving regulatory frameworks in Nigeria or Africa. Significant modifications will trigger a mandatory notification to all registered School Administrators thirty (30) days prior to enforcement.

9. Data Protection Officer (DPO) Contact

For disputes regarding data handling, or to exercise your NDPR rights, please contact our designated Data Protection Officer at:dpo@Skoolly.ng.