Data Processing Addendum

Roles

The school is the data controller for the personal data it enters. ScholarDeck is its processor and acts only on the school's documented instructions. This addendum forms part of the Terms of Service.

Scope of processing

Subject matter: provision of school management software. Duration: for as long as the school's account is active, plus the 90-day export window. Categories of data subject: pupils, guardians, teaching and administrative staff. Categories of data: as set out in the Privacy Notice.

Our obligations

We will:

• Process personal data only as needed to provide the service, and not for our own purposes.
• Keep appropriate technical and organisational measures in place, including per-school isolation enforced in the database and role-based access control.
• Bind our staff and our sub-processors to confidentiality.
• Assist the school in responding to data-subject requests and to the Nigeria Data Protection Commission.
• Notify the school without undue delay on becoming aware of a personal data breach affecting its data, with the detail it needs to meet its own notification duties.
• Delete or return the data at the end of the agreement, subject to backup retention cycles.

Sub-processors

We use third parties for hosting, database management, payment processing, transactional email and messaging, and error monitoring. We remain responsible for their acts and omissions. We will give the school notice before adding a new sub-processor that processes its data, and the school may object on reasonable data-protection grounds.

Audit

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will provide the information a school reasonably needs to satisfy itself that we are meeting this addendum.