Privacy Policy

Privacy Policy for sch.ng.cyou

Effective Date: October 24, 2025

Last Updated: October 24, 2025

This Privacy Policy describes how e-school Nigeria (referred to as "Company," "we," "us," or "our") processes the information we collect and receive in connection with the use of our web-based school management and educational platform, sch.ng.cyou (the "Service").

We are deeply committed to the privacy of all users, especially students. We adhere to industry best practices and legal principles regarding the collection and use of educational data.

1. Our Role: Data Processor

For the data processed through the Service, the relationship is typically defined as follows:

|

| Role | Entity | Responsibility |

| Data Controller | The Educational Institution (School/District) | Determines the purposes and means of processing Personal Information. |

| Data Processor | sch.ng.cyou / e-school Nigeria | Processes Personal Information only on the documented instructions of the Data Controller (the Institution). |

If you are a student, parent, or staff member of an Institution that uses the Service, please contact your Institution directly with any privacy-related questions regarding your specific data.

2. Information We Collect

We collect and receive information in two primary ways:

A. Information Provided by the Educational Institution (Controller)

The Institution uploads or syncs data necessary for the provision of the Service. This is the core "Customer Data" processed by sch.ng.cyou. This data may include, but is not limited to:

| Category | Examples of Data Elements | Relevant User Roles |

| Student Personal Information | Full Name, Student ID, Email Address, Date of Birth (for age-appropriate features), Academic Performance Data (grades, assignments, attendance), Enrollment Status, Guardian/Parent Contact Information. | Students, Parents/Guardians |

| Staff/Teacher Personal Information | Full Name, Email Address, Phone Number, Job Title, Department, Employment Status. | Teachers, Administrators |

| Institutional Data | Course schedules, Class rosters, School codes, Calendar events. | All Users |

| Account Credentials | Username, User ID, and encrypted Passwords (we do not store or see unencrypted passwords). | All Users |

B. Information Collected Automatically Through Use of the Service

When users interact with the Service, we automatically collect certain technical and usage data to ensure functionality, security, and to improve the Service.

  • Usage Data: Information on how the Service is accessed and used, such as pages viewed, time spent on pages, features accessed, and the date/time of access.

  • Device Data: Information about the device used to access the Service, including IP address, browser type, operating system, unique device identifiers, and mobile network information.

  • Cookies and Tracking: We use essential cookies and similar technologies (like session tokens) that are strictly necessary for the operation, security, and authentication of the Service. We do not use advertising or behavioral tracking cookies on student accounts.

3. How We Use the Information (Purpose Limitation)

We use the Personal Information collected only for purposes explicitly authorized by the Educational Institution and as necessary to provide the contracted Service.

Our primary legal basis for processing this data is the performance of the contract with the Institution.

Specific Permitted Uses:

  1. To Provide the Service: To authenticate users, manage student enrollment and class rosters, track grades and attendance, facilitate communication between staff, students, and parents, and provide administrative functions.

  2. For Security and Operations: To monitor the integrity, security, and stability of the platform, and to troubleshoot technical issues.

  3. To Improve and Develop the Service (De-Identified Data): We may use aggregated, anonymous, or de-identified data for internal research, analytics, and product development to improve the features, performance, and functionality of the Service. This data cannot be linked back to individual users.

  4. Customer Support: To respond to support requests from the Institution’s administrators and staff.

STRICT PROHIBITION ON DATA USE:

sch.ng.cyou does not sell, rent, or lease any Personal Information, especially Student Personal Information, to third parties. We do not use Student Personal Information to engage in targeted advertising to students or their parents/guardians.

4. Data Sharing and Disclosure

We only share Personal Information with third parties under the following limited circumstances:

A. Sub-Processors (Service Providers)

We use third-party companies (Sub-Processors) to perform essential tasks for the Service, such as hosting, database management, and email delivery. We enter into formal agreements with all Sub-Processors requiring them to:

  1. Process data only for the purpose of providing the service we have contracted them for.

  2. Maintain rigorous security standards and confidentiality.

  3. Comply with all applicable data protection laws.

A current list of our core Sub-Processors is available upon request by the Institution.

B. With the Educational Institution

We share data with the Institution's authorized staff members (e.g., teachers, administrators) as directed by the Institution for educational purposes.

C. Legal Requirements

We may disclose Personal Information if required to do so by law or in the good faith belief that such action is necessary to: (i) comply with a legal obligation, (ii) protect and defend the rights or property of e-school Nigeria, (iii) prevent or investigate possible wrongdoing in connection with the Service, or (iv) protect the personal safety of users of the Service or the public.

5. Data Security

We implement and maintain reasonable and appropriate administrative, physical, and technical safeguards to protect the Personal Information we process against unauthorized access, disclosure, alteration, and destruction. These measures include:

  • Encryption: Data is encrypted both in transit (using TLS/SSL) and at rest.

  • Access Control: Access to Customer Data is strictly limited to authorized personnel who require access to perform their job functions.

  • Audits and Testing: We regularly review our security practices and conduct vulnerability assessments.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

6. Data Retention and Deletion

A. Retention Period

We retain Personal Information as long as the Educational Institution’s account remains active and as required to provide the Service under our contract. We do not own the Customer Data; the Institution is the owner and determines the retention period.

B. Deletion Upon Termination

Upon the termination or expiration of our contract with an Educational Institution, or upon a specific deletion request from the Institution, we will delete or anonymize all associated Personal Information within a commercially reasonable timeframe, typically

$$NUMBER$$

days, unless legally required to retain certain records (e.g., for audit or tax purposes).

7. Children's Privacy (Adherence to EdTech Principles)

The Service is intended for use by Educational Institutions and is not directed at children under the age of 13 outside of the school context.

  • Student Data Protection: We rely on the Educational Institution to provide consent or authorization for the collection of student data, consistent with applicable laws, such as the principles of the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA).

  • School Consent: By contracting with us, the Institution confirms that it has the necessary authority (e.g., parental consent or the "school official" exception) to disclose student data to us for the purpose of the Service.

8. User Rights (Data Subject Rights)

As the Data Processor, sch.ng.cyou must refer all individual requests to exercise data rights to the Data Controller (the Educational Institution).

If you are a student, parent, or staff member and wish to:

  • Access your Personal Information.

  • Correct or Update inaccuracies in your Personal Information.

  • Request Deletion of your Personal Information.

  • Object to the processing of your Personal Information.

You must contact your school or educational administrator. We will assist the Institution in fulfilling all valid data rights requests as required by law.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify the Educational Institution of any significant changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. We will provide prominent notice to the Institution via email or through the Service administrative console prior to the change becoming effective.

10. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

By Email:

sch@ng.cyou

By Mail:

e-school Nigeria

Attn: Privacy Officer