Privacy and Data
Protection Policy

1. Introduction

APTTECH DIGITAL HUB LIMITED (“AptTech”, “we”, “us” or “our”) operates AptTech SchoolReport, a digital school administration, student assessment, reporting and school-finance management platform.

AptTech recognises the importance of protecting the personal data entrusted to SchoolReport, particularly because the platform processes information relating to students, including children.

This Privacy and Data Protection Policy explains how personal data is collected, used, stored, accessed, disclosed, protected, retained and deleted in connection with AptTech SchoolReport and its associated services.

AptTech processes personal data in accordance with the Nigeria Data Protection Act 2023 (NDP Act), applicable directives and guidance issued by the Nigeria Data Protection Commission (NDPC), including the General Application and Implementation Directive (GAID), and other applicable Nigerian laws. The NDP Act applies to organisations operating in Nigeria and establishes rights for data subjects and obligations for controllers and processors.

2. Scope of this Policy

This Policy applies to personal data processed through or in connection with:

• AptTech SchoolReport;
• SchoolReport administrative portals;
• teacher portals;
• student-management functions;
• academic assessment and result processing;
• report-card generation and delivery;
• psychomotor and behavioural assessment functions;
• school finance and billing functions;
• ParentHub where it interfaces with SchoolReport;
• SchoolReport authentication systems;
• customer support and related SchoolReport services.

This Policy applies to school administrators, teachers, students, parents or guardians, finance personnel and other authorised users.

3. Our Role and the School's Role

The respective roles of AptTech and participating schools depend on the processing activity.

3.1 Participating School as Data Controller

For most student and school records, the participating school ordinarily determines:

• which students are registered;
• what student information is collected;
• why the information is required;
• which teachers and staff may access it;
• the assessments recorded;
• how academic results are used;
• which parent or guardian is associated with a student;
• school fees and financial obligations;
• when and to whom reports are released.

For these activities, the school generally acts as the Data Controller.

3.2 AptTech as Data Processor

Where AptTech processes such information on the documented instructions of a participating school, AptTech generally acts as the Data Processor.

3.3 AptTech as Data Controller

APTTECH DIGITAL HUB LIMITED may independently act as Data Controller for information required for:

• SchoolReport account administration;
• customer and subscription management;
• platform security;
• authentication administration;
• fraud and misuse prevention;
• customer support;
• billing;
• regulatory compliance;
• AptTech's own corporate administration.

The distinction matters because the NDP Act places responsibilities on both controllers and processors according to their respective roles.

4. Categories of Data Subjects

SchoolReport may process information relating to:

• students;
• parents and guardians;
• teachers;
• school administrators;
• finance officers;
• school proprietors or authorised representatives;
• other authorised school personnel.

Because many students are children, AptTech applies additional consideration to the protection of student information.

5. Personal Data We Process

The information processed depends on the functions a participating school uses.

5.1 Student Information

This may include:

• student identification number;
• full name;
• gender;
• date of birth;
• class;
• school house;
• other school-approved student profile information.

5.2 Academic Information

This may include:

• subjects;
• continuous assessment scores;
• examination scores;
• totals;
• grades;
• remarks;
• academic performance information;
• attendance information;
• report-card information.

5.3 Psychomotor and Behavioural Information

Where enabled by the school, SchoolReport may process:

• behavioural assessments;
• psychomotor assessments;
• weekly trait assessments;
• averages or summaries derived from those assessments.

5.4 Parent and Guardian Information

This may include:

• parent or guardian name;
• email address;
• telephone number;
• relationship or association with the student;
• ParentHub account information where applicable.

5.5 Teacher and School Personnel Information

This may include:

• teacher or staff identification number;
• name;
• email address;
• assigned subjects;
• assigned classes;
• role;
• authentication information.

5.6 School Finance Information

Where the SchoolReport Finance Dashboard is enabled, information may include:

• applicable school fees;
• textbook charges;
• other billable items;
• amounts due;
• amounts paid where recorded;
• outstanding balances;
• payment or clearance status;
• related student finance records.

5.7 Technical and Security Information

Depending on the technology used to provide the service, AptTech may process:

• account identifiers;
• authentication identifiers;
• login information;
• timestamps;
• security events;
• device/browser information;
• IP information where generated by underlying infrastructure;
• application and diagnostic logs.

6. Purposes of Processing

Personal data may be processed to:

• register and administer participating schools;
• create and manage authorised user accounts;
• authenticate administrators, teachers and parents;
• maintain student records;
• organise classes and subjects;
• assign teachers;
• record student assessments;
• calculate scores, totals and grades;
• generate student report cards;
• maintain attendance information where enabled;
• maintain psychomotor and behavioural assessments;
• administer school fees and other billable items;
• determine fee-clearance status according to school instructions;
• facilitate authorised report release;
• provide parents or guardians with authorised access to student information;
• deliver reports and school communications;
• provide customer and technical support;
• maintain platform security;
• detect and prevent unauthorised access;
• maintain backups and service continuity;
• administer subscriptions and billing;
• comply with legal and regulatory obligations.

AptTech shall not intentionally process personal data for purposes materially incompatible with the purposes for which it was collected unless permitted by applicable law.

7. Lawful Basis for Processing

Depending on the processing activity, an appropriate lawful basis may include:

• performance of a contract;
• steps taken in connection with entering into a contract;
• compliance with a legal obligation;
• consent where consent is appropriate or legally required;
• legitimate interests where permitted and appropriately balanced;
• protection of vital interests where applicable;
• another lawful basis recognised under applicable Nigerian law.

Where a participating school acts as Data Controller, the school is responsible for establishing the lawful basis for the personal data it instructs AptTech to process.

AptTech does not treat consent as the only possible lawful basis for all processing.

8. Protection of Children's Personal Data

SchoolReport processes information relating to school-age children and therefore treats student information as requiring heightened protection.

AptTech shall seek to apply measures including:

• collecting only information reasonably required for the service;
• restricting access to authorised users;
• separating school data;
• controlling teacher access;
• validating parent/student access relationships;
• protecting report-card delivery;
• implementing appropriate retention and deletion measures;
• maintaining appropriate technical and organisational safeguards.

Participating schools are responsible for ensuring that children's information supplied to SchoolReport has been collected and disclosed lawfully and that any required parental or guardian authorisation is obtained.

AptTech does not sell children's personal data and shall not use SchoolReport student records for unrelated behavioural advertising.

9. Data Minimisation

AptTech seeks to collect and process only information reasonably necessary for SchoolReport's legitimate functions.

Schools and authorised users should not upload unrelated or unnecessary personal information into SchoolReport.

Where a field is not reasonably necessary for a school's use of the service, AptTech may make the field optional or avoid collecting it.

10. How SchoolReport Stores and Processes Data

SchoolReport uses cloud-based technology to provide its services.

Depending on the deployed functionality, infrastructure may include:

• Firebase Authentication;
• Cloud Firestore;
• Firebase Storage;
• Google Cloud services;
• AptTech report-generation infrastructure;
• approved email-delivery services such as Resend;
• approved payment providers where payment functionality is enabled.

AptTech maintains a register of relevant service providers and reviews its data-processing arrangements as part of its data-protection governance.

11. Access to School Data

SchoolReport uses role-based and organisational access controls.

Depending on a user's role:

School administrators may access information belonging to their school according to their permissions.

Teachers should have access only to classes, subjects and student information necessary for their authorised responsibilities.

Finance personnel should have access only to financial information necessary for their authorised duties.

Parents or guardians should have access only to information concerning students to whom they have been validly linked.

AptTech personnel should access production information only where reasonably necessary for authorised support, security, maintenance or compliance purposes.

AptTech shall seek to prevent one participating school from accessing another school's data.

12. ParentHub and Parent Access

Where ParentHub is used with SchoolReport, personal information may be processed to authenticate parents or guardians and provide authorised access to student information.

Reasonable measures should be used to validate the association between a parent/guardian and the relevant student.

A parent or guardian should not be able to arbitrarily associate an account with an unrelated student merely by knowing a student's identifier.

Schools remain responsible for confirming authorised parent or guardian relationships.

13. Student Finance Information

Where a participating school uses the Finance Dashboard, AptTech processes finance information on the school's instructions.

The school determines:

• fees payable;
• textbook charges;
• other billable items;
• balances;
• payment or clearance status;
• rules concerning release of reports based on financial status.

AptTech does not independently determine a student's financial liability to a school.

Where an external payment provider is introduced, additional information concerning that provider and its processing will be provided where appropriate.

14. Report-Card Generation and Delivery

SchoolReport may generate electronic student report cards containing personal and academic information.

Reports may be:

• viewed by authorised users;
• downloaded by authorised school personnel;
• made available to authorised parents or guardians;
• delivered through approved electronic means.

AptTech seeks to apply appropriate safeguards to report storage and delivery.

Where report links are used, AptTech may implement authenticated, restricted, non-predictable or time-limited access as appropriate to reduce unauthorised disclosure.

Schools are responsible for maintaining accurate parent/guardian recipient information.

15. Sharing of Personal Data

AptTech may disclose personal data only where reasonably necessary to:

• the participating school responsible for the information;
• authorised school administrators;
• authorised teachers;
• authorised finance personnel;
• authorised parents or guardians;
• authorised AptTech personnel;
• technology providers acting on AptTech's behalf;
• professional advisers where legitimately required;
• regulators, courts or law-enforcement authorities where legally required.

AptTech does not sell student, parent, teacher or school personal data.

16. Service Providers and Sub-Processors

AptTech may engage reputable third parties necessary to provide SchoolReport.

These may include providers of:

• cloud hosting;
• databases;
• authentication;
• file storage;
• email delivery;
• report infrastructure;
• backup and recovery;
• payment processing.

AptTech shall take reasonable steps to assess relevant providers and maintain appropriate contractual, privacy and security safeguards.

17. International Data Processing and Transfers

Some cloud and technology providers used by AptTech may operate infrastructure or process information outside Nigeria.

Where personal data is transferred internationally, AptTech shall seek to ensure that the transfer is made in accordance with applicable Nigerian data-protection requirements and appropriate safeguards.

18. Security Measures

AptTech applies technical and organisational safeguards appropriate to the risks presented by SchoolReport.

Measures may include:

• user authentication;
• role-based access controls;
• Firebase security rules;
• school-level data isolation;
• restricted administrative privileges;
• encrypted communications;
• encryption provided by approved cloud infrastructure;
• data minimisation;
• security logging where implemented;
• backup and recovery controls;
• account revocation;
• incident-response procedures;
• secure development practices;
• periodic security and privacy review.

No electronic platform can guarantee absolute security. AptTech therefore reviews its safeguards as technology, risks and services evolve.

19. Data Retention and Deletion

AptTech shall not retain personal data indefinitely merely because storage is technically available.

Retention periods will take account of:

• the purpose of processing;
• participating school requirements;
• contractual obligations;
• educational record requirements;
• accounting obligations;
• security requirements;
• applicable law.

When a school's use of SchoolReport ends, relevant information may, subject to contractual and legal requirements, be:

• exported;
• returned;
• deleted;
• anonymised.

Residual copies may remain temporarily in protected backups until the relevant backup cycle expires.

20. Data Subject Rights

Subject to applicable law, individuals may have rights including:

• the right to be informed;
• the right of access;
• the right to correction/rectification;
• the right to object to certain processing;
• the right to restrict processing;
• the right to data portability where applicable;
• the right to deletion/erasure where applicable;
• rights concerning certain automated decision-making;
• the right to lodge a complaint with the appropriate supervisory authority.

NDPC currently identifies these among the rights available to data subjects under the NDP Act.

21. Exercising Data Protection Rights

Where a request concerns an official student record controlled by a participating school, the request may need to be submitted to or determined by that school.

AptTech will reasonably assist participating schools with applicable data-subject requests where AptTech acts as Processor.

Where AptTech acts as Controller, requests may be submitted directly to AptTech.

AptTech may take reasonable steps to verify the identity and authority of a requester before disclosing, correcting or deleting personal information.

22. Automated Decision-Making

SchoolReport may automate routine calculations such as:

• score totals;
• averages;
• grades based on school-defined rules;
• other administrative calculations.

AptTech shall assess new functionality before introducing automated processing that could make or materially influence significant decisions concerning students.

Where future artificial intelligence, predictive analytics, student-risk classification or similar functionality is introduced, AptTech shall undertake appropriate privacy and data-protection assessment before deployment.

The NDPC identifies protection in relation to automated decision-making among data-subject rights under the NDP Act.

23. Personal Data Breaches

AptTech maintains a process for identifying, containing, investigating and responding to personal-data incidents.

Where a confirmed breach affects information processed on behalf of a participating school, AptTech shall notify the school where required and provide relevant available information to support appropriate response.

Where legally required, AptTech and/or the responsible Data Controller shall make appropriate notifications to the Nigeria Data Protection Commission and affected data subjects.

24. Cookies and Similar Technologies

SchoolReport websites and applications may use technologies necessary for:

• authentication;
• session management;
• security;
• user preferences;
• essential application functionality.

Where AptTech introduces non-essential analytics, advertising or similar technologies requiring additional notice or choice, appropriate controls will be provided where required.

25. Data Protection by Design and Default

AptTech incorporates data-protection considerations into the design and development of SchoolReport.

This includes consideration of:

• whether information is necessary;
• who should have access;
• Firebase/Firestore permissions;
• school isolation;
• parent/student linking;
• report security;
• retention;
• deletion;
• third-party integrations;
• security risks.

The GAID specifically addresses privacy by design/default and requires relevant data-processing software to provide privacy information within the software.

26. Data Protection Impact Assessment

AptTech maintains data-protection risk assessments for SchoolReport and related processing activities and will review them when material changes occur.

A further or updated assessment may be undertaken before introducing significant new processing, particularly where functionality involves:

• new categories of children's data;
• large-scale processing;
• sensitive/high-risk information;
• artificial intelligence;
• profiling;
• automated decision-making;
• new data-sharing arrangements;
• major infrastructure changes.

27. Complaints and Grievance Redress

Privacy concerns should first be directed to AptTech or, where appropriate, to the participating school responsible for the relevant records.

AptTech will maintain an appropriate channel for receiving and addressing privacy enquiries.

Individuals also retain the right to complain to the Nigeria Data Protection Commission in accordance with applicable law. NDPC provides mechanisms for reporting privacy violations and identifies recourse to the supervisory authority as a data-subject right.

28. Data Protection Contact

For privacy enquiries concerning AptTech SchoolReport:

Where the enquiry concerns a student's official school record, AptTech may refer the matter to the relevant participating school.

29. Changes to this Policy

AptTech may update this Policy to reflect:

• changes to SchoolReport;
• new functionality;
• changes in technology;
• regulatory requirements;
• changes to service providers;
• changes to data-processing practices.

The effective or last-updated date at the top of this Policy shall be revised when appropriate.

Material changes will be communicated through appropriate channels where required.

30. Policy Governance

This Policy forms part of the broader data-protection governance framework of APTTECH DIGITAL HUB LIMITED and should be read together, where applicable, with:

• SchoolReport Terms of Service;
• School Data Processing Agreement;
• Data Retention and Deletion Policy;
• Data Breach Response Procedure;
• Data Subject Request Procedure;
• AptTech Record of Processing Activities;
• applicable Data Protection Impact Assessments.

Internal governance documents such as the complete ROPA, detailed DPIA and security procedures are not necessarily published publicly because they may contain confidential operational or security information.