Privacy Policy

Effective Date: 29 October 2026 | Last Updated: 29 October 2026

1. Introduction

SCEdu (“SCEdu”, “we”, “our” or “us”) is a school management software platform designed to help secondary schools in Nigeria manage their academic, administrative, communication and financial activities digitally.

We are committed to protecting the privacy, personal information and digital safety of students, parents, guardians, teachers, school administrators, school proprietors and other individuals who use or interact with our platform.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you visit our website, register a school, use an SCEdu account, access a school dashboard or interact with services provided through SCEdu.

We aim to process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA), applicable directives and regulations issued by the Nigeria Data Protection Commission (NDPC), and other applicable Nigerian laws.

By using SCEdu, you acknowledge that you have been given access to this Privacy Policy. Where consent is the applicable lawful basis, we will seek valid consent before carrying out the relevant processing.

2. Who Is Responsible for Your Personal Data?

Responsibility for personal data depends on the purpose and circumstances of the processing.

2.1 SCEdu as a technology service provider

SCEdu generally processes school, student, parent and staff information on behalf of the school that subscribes to and uses our platform. In these circumstances, the school will ordinarily determine why the information is collected and how it should be used, while SCEdu processes that information to provide and maintain its services under the school's instructions and our service arrangements.

2.2 SCEdu as a data controller

SCEdu may act as a data controller for information it processes for its own purposes, including website enquiries, school subscription management, platform account administration, service security, billing, technical support and compliance with applicable legal obligations.

The applicable role depends on the specific processing activity. This Policy does not remove or transfer any responsibility imposed on SCEdu or a school by law.

3. Personal Data We Collect

The categories of information we collect depend on the features enabled by the school and how you use SCEdu.

3.1 Student information

This may include:

• Full name, date of birth, student identification number and class.
• School admission, enrolment and academic records.
• Attendance, examination results, grades, assessments and promotion records.
• Parent or guardian contact details and authorised emergency contacts.
• Disciplinary, behavioural and school activity records where required for legitimate educational purposes.
• Photographs, profile images and identification details where enabled and appropriately authorised.
• Health, disability, dietary or other sensitive information only where necessary, lawful and appropriately protected.
• Learning materials, assignments, submissions and educational progress records.

3.2 Parent and guardian information

This may include names, telephone numbers, email addresses, residential addresses where necessary, relationships to students, account credentials, communication preferences and information required to access authorised student records.

3.3 Teacher and school staff information

This may include names, contact information, staff identification numbers, employment-related records supplied by the school, roles, permissions, attendance, assigned classes and information necessary to manage school operations.

3.4 School and administrator information

This may include the school's name, address, contact information, registration or identification details where applicable, subscription information, administrator accounts, school settings and records of administrative actions.

3.5 Payment and financial information

Depending on the services used, SCEdu may process:

• School fee schedules, invoices, balances and payment histories.
• Records of online payments and payment verification.
• Offline payment submissions, including receipt details, transaction references and uploaded evidence.
• Refund, reconciliation and financial reporting records.
• Withdrawal requests and associated transaction references where those features are enabled.

Payments may be handled by third-party payment providers. SCEdu may receive transaction references, payment status, amounts and other information necessary to reconcile transactions.

We do not intend to collect or store complete payment card details, banking passwords, PINs or payment authentication secrets unless a specifically documented and appropriately secured payment integration requires otherwise. Such information should ordinarily be entered directly into the relevant payment provider's secure interface.

3.6 Technical and usage information

When you use SCEdu, we may collect technical information such as IP address, browser type, device information, operating system, access timestamps, session information, security logs, error reports and records of interactions with platform features.

We may also use essential cookies or similar technologies needed to maintain sessions, secure accounts and support platform functionality. Any non-essential analytics or advertising technologies will be handled in accordance with applicable legal requirements and relevant user choices.

3.7 Information provided through communications

We may process information contained in support requests, feedback, enquiries, complaints, emails and other communications sent to us.

4. How We Collect Personal Data

Personal data may be obtained:

• Directly from users when they register, submit forms or communicate with us.
• From schools and authorised school administrators who create or manage accounts.
• From parents or guardians who supply information necessary for school administration.
• From teachers and other authorised school personnel.
• Through the use of SCEdu's dashboards, forms, logs and platform features.
• From payment service providers when they report transactions or payment outcomes.
• From other lawful sources where necessary for a defined and legitimate purpose.

Schools are responsible for ensuring that information they upload or submit to SCEdu is collected lawfully and that they have the necessary authority, notices, permissions or other lawful basis to provide it.

5. Why We Process Personal Data

We process personal data only for specified, explicit and legitimate purposes, including:

1. Creating and managing school, student, parent, guardian and staff accounts.

2. Supporting admissions, enrolment, attendance, examinations and academic reporting.

3. Providing school dashboards, learning materials, assignments and educational services.

4. Managing school fees, invoices, payment verification and financial records.

5. Enabling authorised communication between schools, parents, guardians, students and staff.

6. Supporting school administration, reporting and operational planning.

7. Verifying accounts, controlling access and preventing unauthorised activity.

8. Providing technical support, troubleshooting errors and maintaining platform performance.

9. Maintaining audit trails and investigating suspected fraud, misuse or security incidents.

10. Managing subscriptions, customer support and service-related communications.

11. Complying with applicable legal obligations and responding to lawful requests.

12. Protecting the rights, safety and vital interests of individuals where legally justified.

13. Improving the reliability, usability and security of SCEdu through appropriately controlled analysis.

We will not use student information for unrelated commercial purposes simply because it is available to us.

6. Lawful Basis for Processing

Under the NDPA, personal data must be processed on an applicable lawful basis.

Depending on the circumstances, SCEdu and the relevant school may rely on:

• Consent: Where an individual has freely given valid consent for a specified purpose.
• Contract: Where processing is necessary to enter into or perform a contract with the relevant individual or organisation, as legally applicable.
• Legal obligation: Where processing is necessary to comply with an obligation imposed by law.
• Vital interests: Where processing is necessary to protect someone's life or other vital interests in circumstances recognised by law.
• Public interest or official authority: Where the applicable legal requirements for this basis are satisfied.
• Legitimate interests: Where a legitimate interest provides a lawful basis, the processing is necessary and the individual's rights and freedoms do not override that interest.

We will assess the appropriate lawful basis for each processing activity. Consent will not be treated as the universal basis for all school administration, and consent will not be used to justify processing where another basis is required or more appropriate.

Where we rely on consent, the individual may withdraw it, subject to the lawfulness of processing carried out before withdrawal and any other applicable lawful basis for continued processing.

7. Children's Privacy and Protection

SCEdu recognises that secondary school students may be children and that their information requires particular care.

We apply the following principles:

• Collect only the student information reasonably necessary for the relevant educational or operational purpose.
• Provide privacy information in clear, age-appropriate language where appropriate.
• Apply appropriate safeguards when processing children's personal data.
• Obtain and verify parental or legal guardian consent when required by applicable law.
• Respect a child's rights and best interests when processing their information.
• Restrict access to student records to authorised persons with a legitimate need.
• Avoid unnecessary disclosure of student names, photographs, results, contact information or other identifiable information.
• Use additional safeguards for health records and other sensitive information.
• Avoid using children's personal information for targeted advertising or unrelated profiling.

The NDPA contains specific provisions concerning children and persons lacking legal capacity. The requirement for parental or guardian consent depends on the applicable statutory conditions and exceptions; it is not appropriate to assume that one consent rule applies to every form of educational processing.

Where SCEdu processes information on behalf of a school, the school must ensure that the collection and use of student information complies with applicable requirements. SCEdu will provide reasonable technical and contractual support for this purpose.

8. Who Can Access Student and School Data?

Access is restricted according to account permissions, school responsibilities and the purpose of the processing.

Depending on the features enabled and permissions assigned:

• School administrators may access records necessary to manage their school.
• Teachers may access information relevant to their assigned teaching and administrative duties.
• Students may access their own permitted academic information and learning materials.
• Parents and guardians may access student information for which they are appropriately authorised.
• Platform administrators may access limited information necessary to provide technical support, maintain the platform, investigate security issues or perform other authorised platform duties.
• Payment providers may process information necessary to initiate, verify or reconcile transactions.
• Other authorised service providers may process information necessary to provide hosting, infrastructure, communications, security or related services.

Users must not access, download, disclose or use information beyond their authorised responsibilities.

SCEdu does not authorise one school to access another school's private records merely because both schools use the platform. Appropriate technical and organisational safeguards must be maintained to support separation between schools.

9. Sharing Personal Data with Third Parties

We may share personal data only where necessary, lawful and consistent with the relevant purpose.

Recipients may include:

• Cloud hosting, database and infrastructure providers.
• Payment processors and banking or transaction service providers.
• Email, SMS and notification providers.
• Security, monitoring and technical support providers.
• Professional advisers and auditors where necessary.
• Public authorities, regulators or law enforcement bodies where disclosure is legally required or otherwise lawful.
• Other recipients authorised by the relevant individual or required to provide a requested service.

Service providers should receive only the information necessary for their assigned function and should be subject to appropriate contractual, confidentiality and security requirements.

We do not sell students' personal data to advertisers or data brokers as a business model.

Where a school instructs us to share information for a purpose outside our ordinary service provision, the school must ensure that the instruction is lawful and that any required notice, consent or other legal requirement has been satisfied.

10. International Data Transfers

Some technology providers used by SCEdu may store or process information outside Nigeria.

Where personal data is transferred internationally, SCEdu will take the measures required by applicable Nigerian data protection law, including assessing the relevant transfer conditions and implementing appropriate safeguards where required.

We will not treat the use of an overseas cloud provider as automatically authorising unrestricted international access to personal data.

Schools should be informed of relevant processing arrangements through applicable service documentation, and additional information about material transfers may be requested through our privacy contact.

11. Data Security

We implement and maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, destruction and other unlawful processing.

Depending on the system and processing activity, safeguards may include:

• Authentication and role-based access controls.
• School-level data separation and permission checks.
• Encryption in transit and appropriate protection of stored information.
• Secure handling of passwords and authentication credentials.
• Audit logs and monitoring of relevant administrative activities.
• Security updates, backups and recovery procedures.
• Access restrictions for personnel and service providers.
• Testing, incident management and procedures for responding to security weaknesses.

No internet-based system can guarantee absolute security. We will continue to assess and improve our safeguards in proportion to the risks associated with the information we process.

Users must protect their login credentials, avoid sharing accounts and report suspected unauthorised access promptly.

12. Personal Data Breaches

If SCEdu becomes aware of a personal data breach affecting information for which it has responsibilities, we will assess the incident, take reasonable steps to contain and investigate it, preserve relevant evidence and implement appropriate corrective measures.

Where SCEdu acts as a processor for a school, we will notify the relevant school without undue delay in accordance with applicable legal requirements and our service arrangements.

Where SCEdu acts as a controller, we will notify the NDPC and affected individuals where required by the NDPA and applicable directives, within the applicable time limits.

Schools remain responsible for their own notification obligations when acting as controllers. We will reasonably cooperate with affected schools and relevant authorities as appropriate.

13. How Long We Retain Personal Data

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, meet applicable legal obligations, resolve disputes, maintain appropriate financial records and protect legitimate interests recognised by law.

Retention periods may depend on:

• The type of information and its purpose.
• The school's instructions and contractual arrangements.
• Applicable educational, accounting and other legal requirements.
• Security, fraud-prevention and audit needs.
• Whether a dispute, investigation or legal obligation requires preservation.

When personal data is no longer required, we will take appropriate steps to delete it, anonymise it or otherwise dispose of it securely, subject to lawful retention requirements.

Closing a school account or deleting a user account may not result in immediate deletion of every associated record. Certain records may need to be retained for legal, financial, security or dispute-resolution purposes.

Schools are responsible for establishing appropriate retention schedules for the records they control. SCEdu will support retention and deletion in accordance with its service capabilities and applicable arrangements.

14. Your Data Protection Rights

Subject to the NDPA and applicable exceptions, individuals whose personal data we process may have the right to:

• Be informed: Receive information about how their personal data is processed.
• Access: Request confirmation of processing and access to their personal data.
• Rectification: Request correction of inaccurate or incomplete information.
• Erasure: Request deletion where the legal conditions for erasure are satisfied.
• Restriction: Request restriction of processing in circumstances provided by law.
• Object: Object to certain processing, including processing based on legitimate interests where applicable.
• Data portability: Request qualifying personal data in a portable format where the statutory conditions are met.
• Withdraw consent: Withdraw consent where processing relies on consent.
• Challenge certain automated decisions: Exercise rights relating to decisions based solely on automated processing where applicable.
• Seek redress: Lodge a complaint with the Nigeria Data Protection Commission or pursue other remedies available under applicable law.

These rights are subject to applicable legal conditions and exceptions. A request may not always result in immediate deletion or cessation of processing where another lawful basis or legal obligation requires continued processing.

Exercising rights on behalf of a student

A parent or legal guardian may submit a request on behalf of a child where legally authorised. We may take reasonable steps to verify the requester's identity, authority and relationship to the student while avoiding unnecessary collection of additional personal data.

Requests concerning school-controlled records may need to be directed to the relevant school. SCEdu will assist or redirect the request as appropriate to its role and responsibilities.

15. How to Make a Privacy Request or Complaint

To make a privacy enquiry, request access to personal data, report a suspected privacy issue or exercise a data protection right, contact:

Organisation: SCEdu

Website: https://www.scedu.ng

Email: Info@scedu.ng

Subject line: Data Protection Request

Please describe the request and identify the relevant account or school where necessary. Do not send passwords, bank PINs or other authentication secrets.

We may request proportionate information to verify your identity or authority before disclosing personal data or making changes.

We will assess and respond to requests within the time required by applicable law. If we cannot fulfil a request, we will explain the reason where legally required.

You may also contact the Nigeria Data Protection Commission through its official website at https://www.ndpc.gov.ng if you believe your data protection rights have been infringed.

16. Cookies and Similar Technologies

SCEdu may use essential cookies or similar technologies to maintain login sessions, protect accounts, remember relevant preferences and support website functionality.

Where analytics, advertising or other non-essential technologies are introduced, we will provide appropriate information and obtain consent where required by law.

You may be able to control cookies through your browser settings. Disabling essential cookies may affect the availability or security of certain platform features.

17. Third-Party Websites and Services

SCEdu may contain links to third-party websites or integrate services operated by other organisations.

Those organisations may have their own privacy policies, terms and data-processing practices. SCEdu is not responsible for the privacy practices of independent third parties, except to the extent that applicable law imposes responsibility on us.

Users should review the relevant third-party privacy information before providing personal data directly to those services.

18. Marketing and Communications

We may send service-related communications concerning account security, school subscriptions, system updates, payment status, support requests and other necessary platform activities.

Where we send promotional communications, we will comply with applicable law and provide appropriate choices or opt-out mechanisms where required.

Student information will not be used to send unrelated marketing communications merely because a student has an account on SCEdu.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our platform, processing activities, legal obligations or security practices.

When changes are material, we will take reasonable steps to communicate them through the website, platform notifications, email or other appropriate channels.

The updated policy will state its effective or last-updated date. Where a change requires renewed consent or another legal step, we will take that step before relying on the changed arrangement.

20. Contact Information

For questions about this Privacy Policy, SCEdu's handling of personal data, or your data protection rights, contact:

SCEdu Privacy Enquiries

Website: https://www.scedu.ng

Email: Info@scedu.ng

Please include “Privacy Policy” or “Data Protection Request” in your email subject line.

---

Important notice: This Privacy Policy is intended to explain SCEdu's proposed data protection practices. It should be reviewed against SCEdu's actual technical configuration, service-provider arrangements, retention practices and contractual responsibilities before publication. It does not replace any separate privacy notice, data-processing agreement or school-specific notice required by law.