● PRIVACY • NDPR COMPLIANT

Privacy Policy

How we protect school, student, parent, and visitor data. NDPR 2019 & NDPA 2023 compliant. Bank-grade SSL, isolated databases, daily backups.

  • Last Updated: May 13, 2026 • Effective: May 13, 2026 • Version 2.1

1. Introduction & Who We Are

School Prime is a cloud-based school operating system developed and operated by Ingenuity Digital Technology, Lagos, Nigeria (“We”, “Us”, “Company”). We are committed to protecting the privacy and security of personal data of schools, students, parents, teachers, and visitors in compliance with the Nigeria Data Protection Regulation (NDPR) 2019, NDPA 2023, and GDPR where applicable.

Data Controller: Ingenuity Digital Technology • Email: privacy@ingenuitydigital.tech • Address: Lagos, Nigeria • DPO: dpo@ingenuitydigital.tech

2. Data We Collect

2.1 School Data: School name, address, CAC documents, logo, branch info, fee structures, academic calendars.

2.2 Student Data (Sensitive – We act as Data Processor): Name, DOB, gender, class, roll number, photo, admission number, guardian details, emergency contact, medical notes (allergies, blood group – only if provided by school), academic records, attendance, fees. We collect this ONLY on behalf of the school (school is Data Controller for student data).

2.3 Parent/Guardian Data: Name, phone, email, relationship, billing address, payment records.

2.4 Staff Data: Teacher/admin name, email, phone, qualification, payroll info (if provided).

2.5 Website Visitor Data: IP address, browser, device, pages visited, demo request info (name, email, phone, school name, students count) via cookies and forms.

2.6 Payment Data: We DO NOT store card numbers. Payments processed via Paystack, Flutterwave, Stripe – they handle card data. We store transaction reference, amount, status, date.

3. How We Use Your Data (Lawful Basis)

  • Provide Service: To operate School Prime – create school accounts, manage admissions, timetables, attendance, fees, results, portals (Contractual necessity).
  • Fee Collection: To process Parents Pay Tech Fee (₦600-₦1,000/student/term) and issue receipts (Contract).
  • Communication: To send SMS/email alerts (attendance, fee reminders, exam notices) – only to parents who opted in via school (Legitimate interest + Consent).
  • Support & Training: To provide onboarding, training, support (Contract).
  • Analytics & Improvement: Anonymized usage stats to improve platform performance (Legitimate interest).
  • Marketing (Website Visitors Only): To send product updates, blog, demo follow-ups – only if you consented (Consent, opt-out anytime).
  • Legal Compliance: To comply with NDPR, tax, court orders (Legal obligation).
  •  

4. Children's Privacy & School as Controller

School Prime does not directly collect data from children under 18 without school’s consent. Schools are Data Controllers for student data. Schools warrant they have obtained parental consent for processing student data per NDPR. We act strictly as Data Processor under school’s instructions. Parents can contact their school to access, correct, or delete student data. We will assist schools in responding to such requests within 14 days. We do not use student data for marketing.

If you believe a school has uploaded child data without consent, email us at privacy@ingenuitydigital.tech and we will investigate within 48 hours.

5. Data Sharing & Third Parties

We do NOT sell your data. We share only with:

  • Payment Gateways: Paystack, Flutterwave, Stripe – to process Tech Fees (they have their own privacy policies).
  • Communication Providers: Termii, Twilio, SendGrid – to send SMS/email alerts on behalf of schools.
  • Cloud Infrastructure: AWS / Google Cloud (EU/US regions) – encrypted hosting, 99.9% uptime. Data encrypted at rest and in transit (SSL/TLS).
  • Analytics: Google Analytics (anonymized IP) for website improvement.
  • Legal: If required by Nigerian law, court order, or to prevent fraud.

All processors sign Data Processing Agreements (DPAs) with us per NDPR Art. 2.5.

6. Data Security

    • Bank-grade SSL encryption (HTTPS everywhere).
    • Passwords hashed with bcrypt, never stored in plain text.
    • Isolated databases per school – no cross-school data leakage.
    • Daily encrypted backups in separate region.
    • Role-based access: Super Admin, Principal, Teacher, Student, Parent, Accountant, Librarian – each sees only authorized data.
    • 2FA optional for Super Admin.
    • Regular vulnerability scans and penetration testing.
    • Staff access logged and audited.
    Despite best efforts, no system is 100% secure. In case of breach, we will notify affected schools within 72 hours per NDPR.

    • 7. Data Retention

    • Active School Data: Retained for duration of subscription + 3 years for legal/tax, unless school requests deletion.
    • Student Records: Retained as long as school account is active. Upon school termination, we keep encrypted backup for 30 days then permanently delete, unless school requests earlier deletion or longer retention for academic history.
    • Demo/Lead Data: 12 months from last contact, then anonymized.
    • Payment Transaction Logs: 6 years per CBN financial regulations.

    8. Your Rights (Per NDPR)

    You have right to:

    • Access: Request copy of your personal data we hold.
    • Correction: Request correction of inaccurate data.
    • Deletion: Request deletion (right to be forgotten) – subject to legal retention.
    • Objection: Object to processing for marketing.
    • Portability: Request data in Excel/CSV.
    • Withdraw Consent: Where processing based on consent.
    • Lodge Complaint: With Nigeria Data Protection Commission (NDPC) or our DPO at dpo@ingenuitydigital.tech.

    For student data, parents should first contact school (Data Controller). We will assist school within 14 days. Response time: 30 days.

    9. Cookies & Tracking

    Website uses cookies: Essential (login, session), Analytics (Google Analytics – anonymized), Marketing (only if consented). You can disable cookies in browser, but some features may not work. School Prime app itself uses only essential cookies for login – no tracking cookies inside student/parent portals.

    10. International Data Transfers

    Primary data stored in AWS Africa (Cape Town) / EU (Ireland) regions. If transfer outside Nigeria is needed (e.g., US for Stripe), we ensure adequate safeguards per NDPR Art. 2.12 via Standard Contractual Clauses.

    11. Changes & Contact

    We may update this policy with 14-day notice via email/dashboard. Continued use after notice = acceptance.