Data Processing Agreement

1. Parties and Relationship to Main Agreement

This Data Processing Agreement (“DPA”) is entered into by:

Controller (School): [full legal name, address and contact details] (“School” or “Controller”); and

Processor: SentinelCore Technologies, trading as SCEdu, [address and contact details] (“SCEdu” or “Processor”).

This DPA takes effect on [date] and forms part of the parties' [SCEdu Terms of Service / subscription agreement dated date] (“Main Agreement”).

This DPA applies where and to the extent SCEdu processes personal data on behalf of the School. It does not automatically apply to processing for which SCEdu independently determines the purposes and means; each party remains responsible for that processing under applicable law.

If this DPA conflicts with the Main Agreement regarding the processing of personal data, this DPA prevails for that subject matter.

2. Definitions

In this DPA:

• Data Protection Law means the Nigeria Data Protection Act 2023 and applicable regulations, directives, codes and binding requirements issued by the Nigeria Data Protection Commission, as amended or replaced.
• Personal Data means information relating to an identified or identifiable natural person, as defined by applicable law.
• Processing has the meaning given under applicable Data Protection Law.
• Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
• Subprocessor means a third party engaged by SCEdu to process personal data on behalf of the School.
• Data Subject means the individual to whom personal data relates.

Other terms have the meanings given under applicable Data Protection Law.

3. Roles of the Parties

3.1 School as Controller

The School determines the purposes and essential means of processing School Data for its educational and administrative activities, except where the parties document a different role for a particular processing activity.

The School is responsible for identifying and documenting an appropriate lawful basis, providing required privacy notices, handling Controller responsibilities and ensuring its instructions to SCEdu are lawful.

3.2 SCEdu as Processor

SCEdu will process personal data on the School's behalf only in accordance with the School's documented instructions, this DPA and applicable Data Protection Law, unless processing is required by law. Where legally permitted, SCEdu will inform the School of such legal requirement before processing.

SCEdu will not determine new, unrelated purposes for School personal data. If SCEdu believes an instruction infringes applicable Data Protection Law, it will inform the School without undue delay and may suspend the affected processing while the parties clarify a lawful approach.

3.3 Independent Controller Activities

Each party acts as an independent controller for personal data it processes for its own purposes, such as its own business contacts, account administration, billing, security and legal compliance, where it independently determines the purpose and means of that processing. Each party must comply with its own controller obligations for those activities.

4. Details and Instructions for Processing

The subject matter, duration, nature and purposes of processing, categories of data subjects, types of personal data and relevant processing operations are described in Schedule 1.

The School's documented instructions include:

• Providing the SCEdu services configured for the School.
• Hosting, organising, displaying, retrieving and transmitting School Data as necessary to provide those services.
• Supporting account administration, security, troubleshooting and service continuity.
• Processing payment status and financial records where the relevant features are enabled.
• Performing other documented instructions agreed in writing by the parties.

General instructions may be updated through the School's authorised account settings, support requests or written communications, provided the instruction is lawful and within the agreed Service.

5. Confidentiality and Personnel

SCEdu will ensure that persons authorised to process School personal data are subject to appropriate confidentiality obligations or a statutory duty of confidentiality.

Access will be limited to personnel who need it for authorised service, support, security or compliance purposes. SCEdu will take reasonable steps to ensure that relevant personnel receive appropriate data-protection and security guidance.

6. Security Measures

SCEdu will implement and maintain technical and organisational measures appropriate to the risks of processing, taking account of the nature of the data, the context, the purposes and the potential impact on individuals.

Measures may include, as appropriate:

• Access controls, role-based permissions and authentication safeguards.
• Logical separation of School Data between schools and tenants.
• Encryption in transit and appropriate protection of stored data.
• Secure credential management and restricted administrative access.
• Audit logging and monitoring of relevant actions.
• Backup, recovery and continuity measures.
• Vulnerability management, software updates and security testing.
• Procedures for reporting and managing security incidents.
• Supplier assessment and confidentiality requirements.
• Secure deletion or disposal when data is no longer required.

The parties recognise that security measures must be reviewed over time and that no system can guarantee absolute security. SCEdu will not materially reduce the overall level of protection required by this DPA without an appropriate replacement measure.

7. Subprocessors

The School gives [general authorisation / specific authorisation] for SCEdu to engage subprocessors necessary to provide the Service.

SCEdu will maintain an appropriate list of material subprocessors, including their functions and relevant processing locations, and make it available to the School through [URL or contact method].

Where general authorisation applies, SCEdu will give the School [30] days' prior notice of an intended addition or replacement of a material subprocessor, where practicable, so the School has a reasonable opportunity to raise a documented data-protection objection.

SCEdu will impose written data-protection obligations on subprocessors that are materially equivalent to the relevant obligations in this DPA. SCEdu remains responsible to the School for a subprocessor's performance of its data-protection obligations to the extent required by applicable law and this DPA.

If the parties cannot resolve a reasonable objection to a subprocessor, they will work in good faith on an appropriate alternative. Any termination right relating to the affected Service should be documented in the Main Agreement.

8. Assistance with Data Subject Rights

Taking account of the nature of processing, SCEdu will provide reasonable technical and organisational assistance to help the School respond to requests to exercise rights under applicable Data Protection Law.

If SCEdu receives a request directly concerning School-controlled personal data, SCEdu will, where legally permitted, promptly refer the request to the School and will not respond substantively except on the School's documented instructions or where required by law.

The School remains responsible for verifying the requester's identity and authority, determining whether the request is legally valid, and communicating its decision to the Data Subject. The parties will cooperate to avoid unnecessary disclosure of additional personal data during verification.

Any assistance beyond ordinary platform functionality may be subject to reasonable charges agreed in advance, where permitted by law.

9. Assistance with Compliance and Risk Assessments

Taking account of the nature of processing and information available to SCEdu, SCEdu will provide reasonable assistance to the School with:

• Data protection impact assessments where required.
• Prior consultation with the NDPC where required.
• Security assessments relating to the Service.
• Demonstrating compliance with the obligations applicable to the Processor.
• Responding to relevant regulatory enquiries concerning the processing performed by SCEdu.

The School remains responsible for determining whether an assessment or consultation is legally required and for submitting it where applicable.

10. Personal Data Breaches

SCEdu will notify the School without undue delay after becoming aware of a Personal Data Breach affecting School personal data. The initial notice will be provided as soon as reasonably practicable and will include information reasonably available at that time, such as:

• The nature of the incident and, where known, the categories and approximate number of affected individuals and records.
• The likely consequences, where reasonably assessable.
• Measures taken or proposed to contain, investigate and mitigate the incident.
• A contact point for follow-up information.

SCEdu may provide information in stages where all details are not initially available and will provide material updates as the investigation progresses.

The School, as Controller where applicable, is responsible for determining and making regulatory or Data Subject notifications within the statutory time limits. The parties will cooperate in good faith, preserve relevant evidence and take reasonable steps to mitigate harm. Neither party will make statements on behalf of the other without authorisation, except where required by law.

11. International Transfers

SCEdu will not transfer School personal data to a country outside Nigeria, or permit access from such a country, except as authorised in Schedule 1 or subsequently documented by the parties and where the transfer complies with applicable Data Protection Law.

Where a transfer is authorised, the parties will identify the relevant transfer mechanism, assess any required safeguards and implement the measures required by law. The School will be given information reasonably necessary to understand material transfer arrangements.

The parties will not assume that a hosting provider's location alone resolves all requirements concerning international transfers or onward access.

12. Retention, Return and Deletion

SCEdu will retain School personal data for the period necessary to provide the Service and as otherwise instructed in accordance with the Main Agreement and applicable law.

On termination or expiry of the Service, at the School's choice and subject to technical feasibility and legal requirements, SCEdu will [return/export] available School personal data and then delete or anonymise remaining copies within [number] days, except to the extent retention is required or permitted by law.

Where data remains in routine backups, it may be removed through the ordinary backup rotation cycle, provided it remains protected and is not restored for ordinary use except for disaster recovery or other legitimate operational necessity. If restored, deletion obligations will be reapplied as appropriate.

SCEdu may retain limited records necessary for billing, security, legal compliance or dispute resolution, acting under an appropriate lawful basis and subject to applicable retention requirements. Such retained data will not be used for unrelated purposes.

The School is responsible for exporting the data it needs within the agreed export period and maintaining any records it is legally required to retain.

13. Audit and Compliance Information

On reasonable written request, SCEdu will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security and the rights of other customers.

Where such information is insufficient to address a reasonable, specific compliance concern, the parties may agree to an audit by the School or an independent auditor bound by confidentiality. Audits must:

• Be limited to the processing relevant to the School.
• Be conducted on reasonable prior notice during normal business hours.
• Avoid unreasonable disruption and protect other customers' information.
• Follow SCEdu's reasonable security requirements.
• Avoid access to source code, unrelated systems or confidential data not necessary to verify compliance.

The parties will agree in advance on the scope, timing, safeguards and allocation of reasonable audit costs. This clause does not limit any non-waivable regulatory powers or rights under applicable law.

14. School Obligations

The School will:

• Ensure it has a lawful basis for processing and providing personal data to SCEdu.
• Give Data Subjects the required privacy information.
• Obtain valid consent or parental/guardian authorisation where required by law.
• Provide accurate, relevant and proportionate instructions.
• Configure roles and access permissions appropriately.
• Ensure its authorised users follow security and confidentiality requirements.
• Promptly notify SCEdu of suspected compromise, unlawful access or material errors.
• Respond to Data Subject requests and regulatory matters for which it is responsible.
• Avoid uploading personal data that is unnecessary for the agreed purposes.
• Maintain appropriate policies for retention, student safeguarding and authorised disclosure.

15. Sensitive Data and Children's Data

The parties recognise that School Data may include children's personal data and, in some cases, sensitive personal data such as health information.

The School must identify the relevant categories, purpose and lawful basis and provide any notices or authorisations required by law. SCEdu will apply appropriate safeguards and process such information only as instructed and necessary for the agreed Service.

The parties will not assume that a general consent or school subscription alone satisfies every legal requirement for processing children's or sensitive personal data. Additional measures may be necessary depending on the processing and applicable law.

16. Data Accuracy and Automated Outputs

The School is responsible for the accuracy and lawful collection of information it provides and for reviewing information entered or verified by its personnel.

SCEdu will provide available tools to correct or update School Data in accordance with the Service. SCEdu is not responsible for inaccuracies introduced by the School or its users, except to the extent caused by SCEdu's own breach of this DPA or applicable law.

Where automated features are available, the School must review their outputs before making significant decisions about students, parents or staff, unless the relevant feature and decision process have been separately assessed and documented as legally appropriate.

17. Confidentiality and Disclosure Required by Law

SCEdu will not disclose School personal data except as instructed by the School, as necessary to provide the Service under this DPA, to an authorised subprocessor, or as required or permitted by applicable law.

Where legally permitted, SCEdu will notify the School of a legally compelled disclosure before making it and will reasonably cooperate with lawful efforts to limit the disclosure.

18. Liability

Each party's liability under this DPA is subject to the liability provisions of the Main Agreement, except where applicable law imposes a different or non-waivable rule.

Nothing in this DPA limits a Data Subject's statutory rights, the NDPC's lawful powers or liability that cannot lawfully be excluded or limited.

The parties should expressly negotiate any special liability allocation for data protection incidents, regulatory costs, indemnities and third-party claims in the Main Agreement or a signed addendum.

19. Term and Termination

This DPA remains effective for as long as SCEdu processes personal data on behalf of the School.

A material breach of this DPA will be handled under the Main Agreement's breach and termination provisions, without limiting any rights available under applicable law.

Sections concerning confidentiality, return and deletion, audit records and liability survive to the extent necessary to give them effect after termination.

20. Governing Law and Disputes

This DPA is governed by the laws of the Federal Republic of Nigeria. Disputes will be handled under the dispute-resolution clause in the Main Agreement, unless the parties agree otherwise in writing. Nothing prevents either party from seeking urgent relief or exercising a statutory right.

21. Notices and Contacts

School privacy contact / Data Protection Officer where appointed

Name/title: [insert]

Email: [insert]

Address: [insert]

SCEdu privacy contact

Entity: SentinelCore Technologies

Email: Info@scedu.ng

Address: [registered address to be confirmed]

Website: https://www.scedu.ng

Schedule 1 — Processing Details

A. Subject Matter and Duration

Subject matter: Provision of the SCEdu school management software and related hosting, support, security, account administration and enabled educational or financial features.

Duration: For the term of the Main Agreement and any additional period required for authorised export, deletion, backup rotation or lawful retention.

B. Nature and Purpose of Processing

Processing may include collecting, recording, organising, hosting, storing, structuring, retrieving, displaying, updating, transmitting, restricting, exporting and deleting personal data as necessary to provide the Service.

Purposes may include school administration, student academic management, parent communications, attendance and assessment, learning materials, financial records, account access, support, security, audit and service continuity.

C. Categories of Data Subjects

As applicable:

• Students, including children.
• Parents and legal guardians.
• Teachers and school staff.
• School administrators and proprietors.
• Emergency contacts and other individuals whose information the School lawfully supplies.

D. Categories of Personal Data

As applicable:

• Names, dates of birth, student identifiers, class and enrolment details.
• Contact details and parent/guardian relationships.
• Attendance, assessments, examination results and academic records.
• Staff roles, account details and school administrative records.
• Fee schedules, invoices, transaction references, payment status and offline-payment evidence.
• User credentials in appropriately protected form, access logs, audit records and technical identifiers.
• Communications, support requests and uploaded learning or administrative content.

E. Sensitive or Special-Category Data

Expected categories, if enabled: [health, disability, safeguarding or other sensitive data — specify; otherwise write “not intended to be processed”].

Purpose and safeguards: [specify necessity, lawful basis, access restrictions and additional safeguards].

F. Processing Locations and International Transfers

Primary hosting/database location: [insert provider and region].

File and backup storage locations: [insert provider and region].

Support/administrative access locations: [insert countries or regions, as applicable].

International transfer mechanism and safeguards: [document applicable mechanism and safeguards, or state “not authorised unless separately documented”].

G. Subprocessors

List each material subprocessor, service, processing location and data category. Update this list when material providers change.

H. Security Measures

Describe the actual safeguards used by the parties, including access control, tenant isolation, encryption, logging, backups, vulnerability management, incident response and supplier controls. Do not mark a measure as implemented unless it is in place.

School-specific requirements or instructions: [insert].

I. Return and Deletion

Export period after termination: [number] days.

Deletion period after export/termination: [number] days, subject to backup rotation and lawful retention.

Required retention exceptions: [describe].

Schedule 2 — Signatures

For the School (Controller)

Legal name: __________________________

Authorised representative: ______________

Title: _________________________________

Signature: ____________________________

Date: _________________________________

For SCEdu (Processor)

Legal entity: __________________________

Authorised representative: ______________

Title: _________________________________

Signature: ____________________________

Date: _________________________________