Privacy Notice

Who this notice is from

ScholarDeck provides school management software to private schools. This notice explains how we handle personal data.

An important distinction runs through everything below. For the records a school enters, pupils, guardians, staff, results, fees, the school is the data controller and ScholarDeck is its data processor. We act on the school's instructions and do not decide how those records are used. For our own business records, such as an enquiry you send us, we are the controller.

What we hold

On behalf of a school, the platform stores:

• Pupil records: name, date of birth, class and enrolment history, guardians, and where the school records them, health or safeguarding notes.
• Guardian and staff records: name, phone number, and email address where one exists. Email is optional throughout, because many Nigerian parents are reachable only by phone.
• Academic records: scores, comments, attendance, and published results.
• Financial records: fee items, invoices and payment references. Card and bank details are handled by our payment provider and never reach our systems.
• Technical records: sign-in times and audit entries for security purposes.

Children's data

Most of the personal data on the platform concerns children. It is entered by the school under its own legal basis and its relationship with parents and guardians. We do not use children's data for advertising, we do not sell it, and we do not use it to train machine-learning models.

Where data is stored

Data is held in managed PostgreSQL databases operated by our infrastructure providers. Some of those servers are outside Nigeria, so operating the service involves a cross-border transfer. We rely on contractual protections with each provider for those transfers, as the Nigeria Data Protection Act 2023 requires.

Each school's records are isolated at the database level, so a signed-in user of one school cannot read another school's rows even if a bug in the application layer tried to let them.

How long we keep it

While a school is a customer, its records are kept for as long as it needs them, academic records are expected to be retrievable years later, which is the point of keeping them. After a school leaves, we retain its data for 90 days so it can be exported, then delete it. Backups age out on their own retention cycle within 12 months.

Your rights

Under the Nigeria Data Protection Act 2023 you may ask for access to your personal data, correction of anything inaccurate, deletion in certain circumstances, and a copy in a portable format. You may also object to particular uses.

If the data concerns a pupil, staff member or guardian at a school, please contact the school first: it is the controller and it holds the decision. Where we need to act, write to us through our contact page and we will respond within 30 days.

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.

Security

Access is restricted by role, enforced in the database rather than only in the application. Data is encrypted in transit and at rest. We keep nightly backups and rehearse restoring from them, because a backup nobody has tested is not a backup.

Changes

We will update this notice as the service changes, and will tell schools directly about any change that materially affects them.