Privacy policy

This Privacy Policy explains how Eduule LTD ("Eduule", "we", "us" or "our") handles personal data when providing the Eduule school-management platform to schools in Nigeria. It applies to our website, platform, support services, school-admin tools, staff and student accounts, and related communications.

We aim to process personal data fairly, lawfully, securely and transparently in line with the Nigeria Data Protection Act 2023, the Nigeria Data Protection Act General Application and Implementation Directive 2025, and other applicable Nigerian laws. This policy does not replace a school's own privacy notice to its students, parents, guardians, staff and other community members.

Schools using Eduule generally decide why and how student, parent/guardian, staff, attendance, academic and school-finance records are used. In those cases, the school is the data controller and Eduule acts as its data processor, handling data only to provide and secure the service under the school's instructions.

Eduule acts as an independent data controller for its own business and platform operations, including organisation-administrator accounts, subscription administration, security, fraud prevention, support, service reliability, and legal compliance. A school remains responsible for ensuring it has an appropriate lawful basis and gives required notices for the data it enters into Eduule.

The information processed depends on the Eduule features a school chooses to use. It may include:

• School information: school name, code, branding, address, contact details, sessions, terms, settings and official documents.
• Student and guardian information: names, admission or Student IDs, date of birth, gender, class, photographs, guardian details, clubs, enrolment, promotion, withdrawal and graduation information.
• Academic information: subjects, assignments, assessment scores, CBT activity, grades, report cards, comments, behavioural or trait ratings, class positions and timetables.
• Attendance information: student attendance and staff clock-in/clock-out records, including QR or terminal activity where enabled by the school.
• Staff information: names, Staff IDs, roles, assigned classes and subjects, work contact details, photos, permissions, attendance, employment-profile information and activity records.
• Finance information: fees, invoices, payments, receipts, discounts, waivers, credits, approval records, balances, payment references and authorised proof-of-payment uploads.
• Account and technical information: email address, login identifiers, session and device information, IP address, browser information, authentication and security events, audit logs, support communications, cookies and local-storage preferences.

We use personal data to operate the platform, authenticate users, apply role-based access, maintain school records, create reports and documents, process school-approved financial records, provide notifications, support users, protect accounts, prevent misuse, improve reliability, and meet legal obligations.

Eduule does not sell personal data. We do not use school records or children's data for behavioural advertising. We do not use school data for any purpose incompatible with the school's instructions or this policy.

Depending on the context, Eduule and schools may rely on one or more lawful bases recognised by Nigerian law, including performance of a contract, compliance with legal obligations, legitimate interests balanced against individuals' rights, consent, protection of vital interests, public interest, or authority properly exercised by a school. Schools are responsible for selecting and documenting the appropriate basis for school-controlled records.

Where consent is relied on, it may be withdrawn, although withdrawal will not affect processing already carried out lawfully. Some information may still need to be retained where a legal obligation or another valid basis applies.

Many Eduule users are children. We expect schools to provide age-appropriate privacy information and obtain any permissions or authorisations required for their students and guardians. Eduule applies access controls, role-based permissions and audit logging to reduce unnecessary access to student records.

Student data is made available only to the school and authorised users according to their assigned role and class scope. Parents or guardians should contact the relevant school first about school-managed records; Eduule will assist the school where appropriate under our processor obligations.

Users are responsible for protecting their login details and devices. Eduule uses authentication, role-based access controls, session controls, activity logging and other reasonable technical and organisational safeguards. Sensitive access and important administrative actions may be logged for security and accountability.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we work to prevent unauthorised access, loss, misuse, alteration and disclosure of personal data.

We may share personal data only where necessary to provide the service, comply with law, protect rights and security, or follow a school's lawful instruction. Recipients may include the relevant school and its authorised users; infrastructure, hosting, storage, email, authentication, communications, payment, support and security providers; professional advisers; regulators; and law-enforcement or public authorities where legally required.

Our current subprocessor and hosting details will be maintained in our applicable service documentation or subprocessor register. We require service providers to protect personal data and process it only for authorised purposes.

Eduule currently serves Nigerian schools. Some approved service providers may process data outside Nigeria where this is necessary to operate the platform. Where a transfer occurs, we will use safeguards and transfer mechanisms required by applicable Nigerian data-protection law, taking account of the destination, the nature of the data and the protection provided.

Schools control the retention of their active school records. Eduule retains school-controlled data while the school maintains an active account and then follows the school's lawful instructions and our contract. After account termination, we normally provide a 90-day period to export data, delete live school data within 30 days after that period, and remove it from backups within 180 days, unless retention is required for security, dispute resolution or law.

Financial records, invoices, receipts and approval records may be retained for six years from creation where required for accounting, tax, audit or legal purposes. Security and audit logs are normally retained for up to 24 months, and ordinary technical logs for up to 12 months, unless a longer period is reasonably necessary for an incident, legal claim or regulatory requirement.

Subject to applicable law, an individual may request access, correction, deletion, restriction, objection, portability where applicable, withdrawal of consent, or information about how their data is used. Individuals may also raise concerns about certain automated decisions where applicable.

For school-controlled records, students, parents/guardians and staff should normally contact their school first. Eduule will assist the school as required. For Eduule-controlled data or general privacy questions, email [email protected] or call 08085954233. We may need to verify identity and authority before acting on a request.

If we become aware of a personal-data breach, we will investigate, contain the issue, assess the risk, preserve relevant evidence and notify affected schools or authorities where required. Schools remain responsible for their own notifications to individuals where they are the controller, with Eduule providing reasonable assistance under the applicable agreement and law.

Eduule uses necessary cookies and local-storage technologies for authentication, security, sessions, device management and user preferences. Where optional analytics or similar technologies are introduced, we will provide an appropriate notice and choice mechanism. See our Cookie Policy for further information.

We may update this policy to reflect legal, technical or service changes. We will publish the updated version and revise the "Last updated" date. Where a change is material, we will provide additional notice where required.

Privacy questions, requests and concerns should be sent to [email protected] or 08085954233.

• Legal entity: Eduule LTD
• Registered office: [Insert Eduule LTD registered office address]
• Phone: 08085954233
• Data Protection Officer or privacy lead: [Insert DPO or privacy contact]

If you are not satisfied with our response, you may have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).