Privacy Policy

1. Who this policy covers, and who is responsible

This policy explains how Tocademy (we, us) handles personal information on the Tocademy platform, in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).

• Account information — the details of the person who registers a school, of the school's administrators, and of the school's billing — we are the data controller: we decide why and how it is used.
• School records — pupils, guardians, staff, attendance, results, fee records and messages a school keeps on the platform — the school is the data controller and we are its data processor: we act on the school's instructions. Questions about how a particular school uses your information should go to that school first; section 8 says how we help.

2. What we collect

From the school and its administrators

• the school's name, type, state and local government area, address, logo and branding;
• the registering person's name, email address and phone number, and the same for each administrator and staff member given an account;
• subscription, invoice and payment records — the plan, amounts, dates and the payment reference returned by the payment processor; we do not receive or store card numbers.

Entered by the school about the people in its care

• pupils' names, dates of birth, sex, admission details, class, photograph, attendance, assessments, results and report cards, health or special-needs notes where the school records them;
• guardians' names, relationship to the pupil, phone numbers, email addresses and fee records;
• staff members' names, roles, contact details, qualifications and signatures where the school records them.

Automatically

• sign-in records (time, IP address, device type), the pages used, and error logs — kept to keep accounts secure and the platform working;
• a session cookie that keeps you signed in, a cookie that remembers your school's address, and — for staff of a school with more than one campus — a cookie that remembers which campus you last worked in, kept for a year. We use no advertising or cross-site tracking cookies.

3. How we use it

• to provide the platform to the school and to the people it gives accounts to;
• to identify the school and sign people in, including sending one-time codes by email or SMS;
• to invoice the school and process its payments through a licensed payment processor;
• to send the messages a school asks us to send on its behalf — fee notices, results, announcements;
• to send the school service messages about its account: verification, sign-in details, invoices, renewals, changes to the service or these terms;
• to keep the platform secure, to detect and stop abuse, and to fix faults;
• to meet our legal obligations, including keeping accounting records.

We do not use school records for marketing, profiling or advertising, and we do not sell personal information to anyone.

4. Our lawful bases

For account information we rely on the contract with the school (to provide and bill the service), our legitimate interests (keeping the platform secure and improving it) and our legal obligations (accounting and tax records). For school records we act on the school's documented instructions; the school is responsible for its own lawful basis, including any consent required from a pupil's parent or guardian.

5. Who we share it with

We share personal information only with the providers we need to run the service, each under a contract that limits what they may do with it:

• cloud hosting — Microsoft Azure, where the platform and its database run and backups are kept;
• email and SMS delivery — the providers that deliver verification codes, notices and messages;
• payment processing — licensed Nigerian payment processors (such as Paystack) that take payment from the school or from parents paying fees; they receive the amount, a reference and the payer's contact details, and handle card details themselves.

We also disclose information where the law requires it — to a court, a regulator or a law enforcement agency with lawful authority — and, if Tocademy is ever sold or merged, to the new owner under the same commitments. Within the platform, a school's information is visible only to that school's own users; no other school can see it.

6. Where it is kept and for how long

The platform is hosted in cloud data centres operated by Microsoft Azure. Where data is stored or processed outside Nigeria we ensure the transfer is covered by safeguards the NDPA recognises, such as the provider's contractual commitments.

We keep a school's records for as long as its subscription is active. When a school cancels, its users can no longer sign in, and its records are kept rather than deleted — so that a school that returns finds them intact, and so that the invoice, payment and audit records we must keep under Nigerian accounting and tax law remain for the period that law requires. A school that wants a copy of its records asks for it before cancelling, using the reports and downloads on the platform, or afterwards by writing to us. A school that wants its records erased writes to us: we carry out the erasure as an explicit, recorded action and keep only what the law requires. A school that registered but never finished setting up may have its account and records removed after a reasonable period. Sign-in and error logs are kept for a limited period for security and then discarded.

7. How we protect it

Every connection to the platform is encrypted. Passwords are stored only as salted hashes; one-time codes expire within minutes and are locked after repeated wrong attempts. Each school's records are isolated from every other school's at the database level. Access to production systems is limited to the staff who need it, and changes to financial and audit records are guarded so they cannot be altered silently. Pupil photographs, staff signatures and admission documents are served only to signed-in users of the school that owns them; the images a school places on its own public website — its logo and the pictures on its pages and posts — are public because the school published them.

If we become aware of a breach affecting personal information we will notify the Nigeria Data Protection Commission and the schools affected within the time the NDPA requires, and help them tell the people concerned.

8. Your rights

Under the NDPA you may ask:

• to see the personal information held about you, and to receive a copy;
• to have inaccurate information corrected;
• to have your information deleted, or its use restricted, where there is no longer a good reason to keep it;
• to object to a particular use, and to withdraw a consent you gave earlier;
• to receive information you provided in a form you can take elsewhere.

For your school account, write to us at the address in section 12 and we will respond within the time the NDPA allows. For records a school keeps about you or your child, ask the school: it is the controller. The school corrects records on the platform itself; a request to erase a person's records goes from the school to us, and we carry it out as an explicit, recorded action on the school's instruction, keeping only what the law requires the school or us to retain. You may also complain to the Nigeria Data Protection Commission.

9. Children

Most of the people whose information schools keep on the platform are children, and pupils use the platform themselves: sitting computer-based tests and seeing their results. What a pupil enters during a test — answers, the submission, and the test's own record of when the pupil left the screen — is collected directly from them, as part of their school's records and with the school as controller. We rely on each school to obtain whatever consent from parents or guardians the law requires, and we design the platform so that a child's information is seen only by their own school and their own guardians. We never advertise to children.

10. Cookies

We use cookies only to keep you signed in, to remember your school's address between visits, and — for staff of a school with more than one campus — to remember which campus you last worked in, a preference kept for a year. They carry no advertising identifiers and are not shared with anyone. Blocking them will stop you signing in.

11. Changes to this policy

We may update this policy as the service or the law changes. The date at the top says when it last changed; where a change is material we will tell schools by email and through the dashboard before it takes effect.

12. Contact

Privacy questions, requests and complaints: contact@schoolms.ng.