Privacy & data protection
How SchoolOS handles student, staff, and parent records.
Who owns the data
SchoolOS owns every student, staff, admissions, and results record entered into this system. SchoolOS, the platform this site runs on, processes that data only on the school’s behalf. It is never sold, shared with other schools, or used to train any external service.
What is collected
Student records (name, class, department, parent/guardian contact details, academic results, attendance, and fee status), staff records (name, role, contact details, and employment status), and admissions enquiries submitted through the public admissions form. Result-checker access is by PIN card, not a student login, so no separate student account credentials are stored.
Legal basis for processing, and children’s data
SchoolOS is the data controller for every record in this system, as defined under the Nigeria Data Protection Act, 2023 (NDPA); SchoolOS is the data processor, handling that data only on the school’s instructions. Almost every student record in this system belongs to a minor. Where a student is under 18, SchoolOS processes their data on the basis of the consent given by a parent or legal guardian at admission, and, for the ordinary business of educating that student, on the basis that the processing is necessary for the provision of education. Both are recognised bases under the NDPA. Staff and admissions-enquiry data is processed on the basis of SchoolOS’s legitimate interest in running the school and the contractual relationship of employment.
How it is protected
Staff logins are hashed, never stored in plain text, and can be protected with two-factor authentication. Every result approval, report card publish, and record deletion is recorded in an audit log showing who did what and when. Each school’s records are isolated from every other school on the platform.
Data breaches
If a breach occurs that is likely to pose a risk to the rights of anyone in this system, SchoolOS and SchoolOS will notify the Nigeria Data Protection Commission (NDPC) and any affected individuals within the timelines set out in the NDPA, and will keep a record of the breach, its cause, and how it was addressed.
Retention and export
Records are kept for as long as the school’s account is active. A school’s administrator can request a full export of that school’s data at any time, and again at the end of the school’s engagement with SchoolOS. Ownership of the data does not depend on the school continuing to use the platform.
Your rights
Under the NDPA, a parent or guardian (on behalf of a student), or a staff member, may request access to the personal data SchoolOS holds about them, ask for it to be corrected if it is inaccurate, or request its erasure where the NDPA permits. SchoolOS will respond to any such request within the time required by the NDPA.
Questions
Parents, staff, or guardians with questions about their records, or wishing to exercise any of the rights above, should contact SchoolOS directly through the Contact page.