Privacy Policy

1. Introduction

MySchoolOps ("we", "our", or "us") is a school management software-as-a-service platform operated in the Federal Republic of Nigeria. We are committed to protecting the personal data of schools, administrators, teachers, students, and parents who use our platform. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights available to you under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023.

By accessing or using MySchoolOps, you acknowledge that you have read and understood this Privacy Policy. If you are a school administrator accepting these terms on behalf of an institution, you represent that you have the authority to do so.

2. Data We Collect

We collect only the data necessary to operate the platform and provide the services your institution has subscribed to. This includes:

• Institution information: School name, address, registration number, logo, state and local government area, and contact details.
• Administrator account data: Full name, work email address, phone number, and role within the institution.
• Teacher data: Name, staff ID, subject assignments, class assignments, and login credentials.
• Student records: Full name, student ID, class, date of birth, gender, guardian contact information, and academic history.
• Attendance records: Daily and period-level attendance logs linked to individual students and classes.
• Academic and assessment data: Continuous assessment scores, examination scores, grades, and term report card data.
• Fee and billing data: Fee schedules, payment records, outstanding balances, and payment reference numbers. We do not store full card numbers.
• Usage data: Log data including IP addresses, browser type, pages visited, and actions taken within the platform, used solely for security and platform improvement.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Providing, operating, and maintaining the MySchoolOps platform and all its features.
• Processing fee payments and generating financial records for your institution.
• Generating academic reports, result sheets, and term report cards.
• Sending transactional notifications such as fee reminders, term result alerts, and account security emails.
• Diagnosing technical issues and improving platform reliability and performance.
• Complying with applicable Nigerian law, regulatory requirements, and lawful government orders.

We do not use student data for advertising, profiling, or any purpose unrelated to the educational services your institution has contracted us to provide.

4. Data Sharing

We do not sell, rent, or trade your personal data or your institution's data to any third party. We will never monetise student records.

We may share data in the following limited circumstances:

• Payment processors: We share transaction reference data with licensed payment processors (such as Paystack or Flutterwave) to facilitate fee collection. These processors are bound by their own data protection obligations.
• Infrastructure providers: We use cloud hosting providers to store and process data on our behalf under strict data processing agreements.
• Legal obligation: We may disclose data if required to do so by a Nigerian court order, the National Information Technology Development Agency (NITDA), or another competent regulatory authority.

5. Data Security

We implement technical and organisational measures appropriate to the sensitivity of the data we process. These include:

• Encryption of all data in transit using TLS 1.2 or higher.
• Encryption of sensitive data fields at rest in our database.
• Role-based access controls ensuring staff can only access data relevant to their role.
• Multi-factor authentication available for all administrator accounts.
• Regular security audits and vulnerability assessments.
• Strict access logging for any administrative access to production data.

No system is completely immune to security threats. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected institutions within 72 hours of becoming aware of the incident, as required by the NDPA.

6. Data Retention

We retain institution and student data for as long as your subscription remains active. If your subscription lapses or is cancelled, you will have a 30-day window to export all your data using the built-in export tools in your dashboard. After this 30-day period, your data will be permanently deleted from our production systems.

Anonymised, aggregated usage statistics that cannot be linked to any individual or institution may be retained indefinitely for platform improvement purposes. Financial transaction records may be retained for up to 7 years to comply with Nigerian tax and financial regulations.

7. Your Rights Under the NDPR and NDPA

Under Nigerian data protection law, you have the following rights in respect of your personal data:

• Right of access: You may request a copy of the personal data we hold about you or your institution.
• Right to correction: You may request that we correct any inaccurate or incomplete data.
• Right to deletion: You may request that we delete your personal data, subject to our legal retention obligations.
• Right to object: You may object to certain processing activities where we rely on legitimate interests as our legal basis.
• Right to data portability: You may request your data in a structured, machine-readable format so that it can be transferred to another service provider.

To exercise any of these rights, email us at privacy@myschoolops.com.ng. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the National Information Technology Development Agency (NITDA).

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify school administrators via email and display a prominent notice in the platform dashboard at least 14 days before the changes take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

9. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact our Data Protection Officer at: