1. What this agreement is
This Data Processing Agreement ("DPA") is between the school that uses SchoolKit ("the School") and SchoolKit ("we"). It forms part of our Terms of Service and applies whenever we process personal data on the School's behalf. The School accepts it when it creates its SchoolKit account. Where this DPA and the Terms differ on personal data, this DPA prevails.
The School is the data controller: it decides what personal data about its students, parents and staff is collected and why. We are its data processor, as those terms are used in the Nigeria Data Protection Act 2023 ("NDPA").
2. The processing
- Purpose: providing SchoolKit — records, attendance, results, fees, communication, health and sickbay records, admissions, the school's web page and the other features the School uses.
- People: students, applicants, parents and guardians, staff, and visitors to the School's web page.
- Data: the categories listed in our Privacy Policy, including sensitive data (health information, and BVN where the School uses payroll).
- Duration: for as long as the School uses SchoolKit, then as set out in section 9.
3. The School's responsibilities
The School is responsible for:
- having a lawful basis for the data it puts into SchoolKit, including the consent of a parent or guardian for each child, as section 31 of the NDPA requires, and explicit consent before recording health information;
- telling parents and staff that it uses SchoolKit, what it records and how to contact the School about it — we provide a ready-made letter for this in Settings → Data protection;
- giving staff only the access their role needs, and removing access promptly when someone leaves;
- answering requests from parents, students and staff to see, correct or delete their data, with our help;
- keeping photos of pupils off its public web page, as SchoolKit requires.
4. Our commitments
We will:
- process the School's personal data only on its documented instructions — this DPA, the Terms, and what the School does in SchoolKit — unless the law requires otherwise, in which case we will tell the School first unless the law forbids it;
- never sell it, use it for advertising, or use it for our own purposes beyond running, securing and improving SchoolKit;
- make sure everyone at SchoolKit who can reach it is bound by confidentiality;
- keep each school's data separate from every other school's, and apply the security measures in section 6;
- help the School answer requests from individuals, carry out data protection impact assessments, and deal with the Nigeria Data Protection Commission;
- give the School the information it reasonably needs to show it is complying, and answer reasonable written questions about our processing.
5. Other providers we use
The School authorises us to use the categories of provider listed in our Privacy Policy (hosting, storage, email, SMS, notifications, payments, error reports, product measurement and AI drafting). The School can ask us for the current list, naming each provider, at any time.
We bind each one by contract to protect the data at least as well as this DPA requires, and we remain responsible to the School for them. We will tell the School at least 30 days before adding a provider that will handle student data, and the School may object on reasonable data-protection grounds; if we cannot resolve the objection, the School may cancel and receive a refund of any prepaid fee for the unused period.
6. Security
- Encryption in transit and at rest; BVN encrypted in the database
- Each school's data separated at the database level, so one school's staff cannot reach another's
- Role-based access inside each school, and an activity log of sensitive actions
- Passwords stored as one-way hashes; two-step sign-in available to every member of staff
- Backups, with restore tests
- Access to live systems limited to the fewest SchoolKit people necessary
7. Personal data breaches
If we become aware of a breach affecting the School's personal data, we will tell the School without undue delay, and in any case within 48 hours, with what we know: what happened, the data and people affected, the likely consequences and what we are doing. We will notify the Nigeria Data Protection Commission within 72 hours where the NDPA requires, and help the School tell the people affected.
8. Transfers outside Nigeria
Some processing happens outside Nigeria, as our Privacy Policy describes. We make such transfers only on a basis the NDPA allows, including contractual safeguards with each provider. A school that needs its data kept in a particular country should talk to us before it starts.
9. When the School leaves
The School can ask us at any time for a copy of its data in common formats (such as CSV and PDF). When its account closes, the data stays available to export for 90 days, then we delete it or make it irreversibly anonymous, except what the law requires us to keep (such as financial records, for at least 6 years). Copies in backups are overwritten within a further 90 days. On request, we will confirm the deletion in writing.
10. General
This DPA is governed by the laws of the Federal Republic of Nigeria, as the Terms are. We may update it as the law or SchoolKit changes; we will tell schools at least 30 days before a change that reduces their protection. A school that needs a signed copy for its records can ask at [email protected].