Privacy policy

• Schools are in charge of school records. They decide what is recorded about students, parents/guardians and staff; Eduule handles it on their behalf (section 2).
• We do not sell personal data, and we do not use children's data for advertising (section 6).
• What we hold: school, student, academic, attendance (including clock-in photos), staff, finance and account information (section 3).
• Who sees it: the school's authorised users and trusted service providers that help us run Eduule (section 10).
• AI: some optional features use AI. Student names and contact details are never sent to AI providers (section 5).
• Your rights: you can ask to access, correct or delete your data. Contact your school first about school records, or email us (section 13).

This Privacy Policy explains how Eduule LTD ("Eduule", "we", "us" or "our") handles personal data when providing the Eduule school-management platform to schools in Nigeria. It applies to our website, web platform and mobile app, support services, school-admin tools, staff and student accounts, and related communications.

We aim to process personal data fairly, lawfully, securely and transparently in line with the Nigeria Data Protection Act 2023, the Nigeria Data Protection Act General Application and Implementation Directive 2025, and other applicable Nigerian laws. This policy does not replace a school's own privacy notice to its students, parents, guardians, staff and other community members.

Schools using Eduule generally decide why and how student, parent/guardian, staff, attendance, academic and school-finance records are used. In those cases, the school is the data controller and Eduule acts as its data processor, handling data only to provide and secure the service under the school's instructions.

Eduule acts as an independent data controller for its own business and platform operations, including organisation-administrator accounts, subscription administration, demo and contact enquiries, security, fraud prevention, support, service reliability, and legal compliance. A school remains responsible for ensuring it has an appropriate lawful basis and gives required notices for the data it enters into Eduule.

The information processed depends on the Eduule features a school chooses to use. It may include:

• School information: school name, code, branding, address, contact details, sessions, terms, settings and official documents.
• Student and guardian information: names, admission or Student IDs, date of birth, gender, class, photographs, guardian details, clubs, enrolment, promotion, withdrawal and graduation information.
• Academic information: subjects, assignments, assessment scores, CBT activity, grades, report cards, comments, behavioural or trait ratings, class positions and timetables.
• Attendance information: student attendance and staff clock-in/clock-out records, including QR or terminal activity where enabled by the school.
• Clock-in photos: where a school uses the staff clock-in kiosk, a photo of the staff member is taken with the device's front camera at clock-in and clock-out. It lets the school confirm who clocked in and is not used for facial recognition.
• Report card signatures: where a school uses the report card stamp, the person named to sign its report cards (for example the principal) signs once on screen. We keep only a picture of that signature, not how it was drawn, and place it on the school's report cards with the date they are published. It is added only with that person's agreement, and only the school's owner or principal can change or remove it.
• Staff information: names, Staff IDs, roles, assigned classes and subjects, work contact details, photos, permissions, attendance, employment-profile information and activity records.
• Finance information: fees, invoices, payments, receipts, discounts, waivers, credits, approval records, balances, payment references and authorised proof-of-payment uploads.
• Communications: messages, notices and reminders sent through Eduule by email or SMS, with their recipients and delivery status.
• Enquiry information: name, school, email address, phone number and message when you book a demo or contact us.
• Account and technical information: email address, login identifiers, session information, device type and operating system, app version, IP address, browser information, authentication and security events, audit logs, support communications, cookies and local-storage preferences. On devices, camera access is used only for QR scanning and clock-in photos.

We receive most personal data from the school, either entered by its administrators and staff or imported from its existing records. Some data comes directly from users (for example when a staff member clocks in or a student takes a CBT test), from devices the school approves, and from people who contact us or book a demo. We do not buy personal data from data brokers or marketing lists.

Some optional Eduule features use artificial-intelligence services to help staff:

• Report-card comments: AI drafts class-teacher and principal comments from a student's recorded results. The student's name is replaced with a placeholder before anything is sent, and the AI receives no names, IDs or contact details. Every draft is checked against the recorded results, and staff can edit or reject it.
• Exam-question import: when a teacher uploads a question document, AI may be used to read and format the questions.
• Message review: before a school sends a broadcast, the message text (never the recipient list) may be checked by AI against our messaging guidelines.

Where a school chooses an AI-assisted feature, we may use third-party AI service providers to process the limited information needed for that feature. We do not send student names, IDs or contact details to those providers. AI outputs are suggestions; staff remain responsible for what is published or sent.

We use personal data to operate the platform, authenticate users, apply role-based access, maintain school records, create reports and documents, process school-approved financial records, provide notifications, respond to enquiries, support users, protect accounts, prevent misuse, improve reliability, and meet legal obligations.

Eduule does not sell personal data. We do not use school records or children's data for behavioural advertising. We do not use school data for any purpose incompatible with the school's instructions or this policy.

Depending on the context, Eduule and schools may rely on one or more lawful bases recognised by Nigerian law, including performance of a contract, compliance with legal obligations, legitimate interests balanced against individuals' rights, consent, protection of vital interests, public interest, or authority properly exercised by a school. Schools are responsible for selecting and documenting the appropriate basis for school-controlled records.

Where consent is relied on, it may be withdrawn, although withdrawal will not affect processing already carried out lawfully. Some information may still need to be retained where a legal obligation or another valid basis applies.

Many Eduule users are children. We expect schools to provide age-appropriate privacy information and obtain any permissions or authorisations required for their students and guardians. Eduule applies access controls, role-based permissions and audit logging to reduce unnecessary access to student records.

Student data is made available only to the school and authorised users according to their assigned role and class scope. Parents or guardians should contact the relevant school first about school-managed records; Eduule will assist the school where appropriate under our processor obligations.

Users are responsible for protecting their login details and devices. Eduule uses authentication, role-based access controls, session controls, activity logging and other reasonable technical and organisational safeguards. Sensitive access and important administrative actions may be logged for security and accountability.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we work to prevent unauthorised access, loss, misuse, alteration and disclosure of personal data.

We may share personal data only where necessary to provide the service, comply with law, protect rights and security, or follow a school's lawful instruction. Recipients may include the relevant school and its authorised users; trusted service providers; professional advisers; regulators; and law-enforcement or public authorities where legally required.

We use carefully selected third-party service providers to help us operate, secure and support Eduule. These providers may provide cloud hosting, database and file-storage services, email and SMS delivery, security and error monitoring, and optional AI-assisted features. They may process personal information only where necessary to provide their services to us and subject to appropriate contractual and security safeguards.

We may change service providers when reasonably necessary to operate or improve Eduule. We require them to protect personal data and process it only for authorised purposes.

Business transfers: if Eduule is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. It will remain protected by this policy and by our agreements with schools.

Eduule currently serves Nigerian schools. Some of the service providers listed in section 10 store or process data outside Nigeria, including in the European Union and the United States, where this is necessary to operate the platform. Where a transfer occurs, we will use safeguards and transfer mechanisms required by applicable Nigerian data-protection law, taking account of the destination, the nature of the data and the protection provided.

Schools control the retention of their active school records. Eduule retains school-controlled data while the school maintains an active account and then follows the school's lawful instructions and our contract. After account termination, we normally provide a 90-day period to export data, delete live school data within 30 days after that period, and remove it from backups within 180 days, unless retention is required for security, dispute resolution or law.

Clock-in photos are deleted automatically four calendar months after they are taken. A report card signature is kept while the school uses it. When it is removed or replaced, it is no longer added to new report cards; report cards already published keep it as part of the school's records. Financial records, invoices, receipts and approval records may be retained for six years from creation where required for accounting, tax, audit or legal purposes. Security and audit logs are normally retained for up to 24 months, and ordinary technical logs for up to 12 months, unless a longer period is reasonably necessary for an incident, legal claim or regulatory requirement.

Subject to applicable law, an individual may request access, correction, deletion, restriction, objection, portability where applicable, withdrawal of consent, or information about how their data is used. Individuals may also raise concerns about certain automated decisions where applicable.

Signed-in users can delete their own account from My account, under Danger zone. Some records may be kept where section 12 or the law requires it.

You can unsubscribe from marketing emails at any time using the link in the email. We will still send messages you need to use the service, such as security alerts and school notices.

For school-controlled records, students, parents/guardians and staff should normally contact their school first. Eduule will assist the school as required. For Eduule-controlled data or general privacy questions, email our Data Protection Officer at [email protected] or call 08085954233. We may need to verify identity and authority before acting on a request.

If we become aware of a personal-data breach, we will investigate, contain the issue, assess the risk, preserve relevant evidence and notify affected schools or authorities where required.

Where Eduule acts for a school, we will notify the school without undue delay after becoming aware of a breach affecting its data. Schools remain responsible for their own notifications to individuals where they are the controller, with Eduule providing reasonable assistance. Where Eduule is the controller, we will notify the Nigeria Data Protection Commission within 72 hours where the law requires it, and inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Eduule uses necessary cookies and local-storage technologies for authentication, security, sessions, device management and user preferences. If you choose to play the product video on our homepage, it loads from YouTube in privacy-enhanced mode, and YouTube may set its own cookies; nothing from YouTube loads until you press play. Where optional analytics or similar technologies are introduced, we will provide an appropriate notice and choice mechanism. See our Cookie Policy for further information.

We may update this policy to reflect legal, technical or service changes. We will publish the updated version and revise the "Last updated" date. Where a change is material, we will provide additional notice where required.

Privacy questions, requests and concerns should be sent to our Data Protection Officer at [email protected], or to [email protected] or 08085954233.

• Legal entity: Eduule LTD
• Registered office: 139 Idewu Street, Olodi-Apapa, Lagos, Nigeria
• Phone: 08085954233
• Data Protection Officer: Yusuf Umar, [email protected]

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng or [email protected].