Data Policy
Version 1.0 (draft). In force from [to be confirmed].
This policy explains what personal data Techscholar holds, why, who can see it, how we protect it, how long we keep it, and what rights people have. It is written in plain language. Where something is not built or decided yet, we say so instead of promising it.
1. The short version
- A school's records belong to the school. We look after them for the school and use them only to run the school's results, attendance and messages.
- Students are children. We keep only what the school needs, we show a child's record only to the school and the child's own family, and we never use children's data for advertising.
- We do not sell personal data. We do not run advertising or tracking tools.
- Teachers and school admins sign in with a second step. Passwords are never stored in plain text.
- One school cannot see another school's records.
- To ask about, correct or remove someone's data, start with the school. You can also write to us at [to be confirmed].
2. Who we are and the two roles we play
Techscholar, [to be confirmed], ("Techscholar", "we", "us") provides the Techscholar school platform.
We play two different roles, and the law treats them differently.
- We are the processor for school records. When a school puts its students, parents, teachers, marks, attendance and messages into Techscholar, the school decides why and how that data is used. The school is the data controller. We act on the school's instructions and under our agreement with the school.
- We are the controller for our own data. This covers school and principal account details, billing, support requests, demo requests, security logs and the website.
This policy follows the Nigeria Data Protection Act 2023 and the guidance of the Nigeria Data Protection Commission (NDPC). Registration status with the NDPC: [to be confirmed].
3. What data we hold, and why
3.1 School records (we are the processor)
- Students: name, admission number, class and arm, the school's own marks and grades, attendance, report card remarks, skill and behaviour ratings the school chooses to record, and notes or messages sent to the student by their teachers.
- Parents and guardians: name, phone number, email address, which students they are linked to, and their notification choices (for example, WhatsApp alerts on or off).
- Teachers and school admins: name, email, phone, the classes and subjects they are assigned, and their sign-in security details.
- Free text: excuse reasons, remarks, notes and messages. These can contain sensitive information such as health details. Schools should write only what is needed (see section 9).
Purpose: to run score entry, review and approval, report cards, attendance, announcements, messages between parents and the school, and the school's own administration.
3.2 Sign-in and security data (we are the controller for the platform, the processor for the school)
- Passwords and student PINs, stored only as one-way hashes.
- Two-step sign-in secrets for staff, stored encrypted, and recovery codes, stored only as hashes.
- Session records, failed sign-in records (the attempted username and the network address) used to block guessing attacks, and an audit record of sensitive actions such as publishing results, printing login slips, signing a bill, or sending a note.
Purpose: to keep accounts safe and to show who did what.
3.2a Classwork (learning hub)
Teachers' class announcements, notes and uploaded files; students' hand-ins (typed answers, uploaded files, quiz answers, and an optional short note to the teacher); marks and feedback; and points and badges earned from classwork. Uploaded files are stored privately and are served only to people who are allowed to see that class. Files are limited to documents, images and audio, and are checked before they are stored. Where a teacher uploads a scanned paper or a photo of a page, the text in it is read by software running on our own servers (nothing is sent to an outside service) so it can be searched and turned into questions; a student's own hand-in is never read this way. From the notes and files a teacher shares with a class, the platform automatically makes practice quizzes, puzzles and riddles for the students in that class. This is done by software on our own servers using only the lesson content, not any student's data; students' answers to these are practice only and are not marks and do not shape their skills profile. Teachers may also keep lesson content (notes, slides, links, videos) in a private content library and choose to share it with other teachers at their school; students and parents only see what a teacher places in a classroom. Classwork belongs to the school; it is exported and erased with the student's other records.
3.3a Safeguarding alerts
When software flags words in a student's own work or in a parent's message that may mean a child is at risk, a short excerpt of the surrounding words is kept as an alert, readable only by the school's safeguarding lead. It is kept for as long as the concern records of that school are, and is removed if the school or the family's full erasure request removes the child's records.
3.3 Messages and notifications
In-app notifications, messages between parents and the school, notes from teachers or the school admin to a student, and support messages between a school and us. If a parent switches WhatsApp alerts on, the alert text and the parent's phone number are passed to our WhatsApp provider to deliver it.
3.4 Billing and payments (we are the controller)
A school's plan and price, its bills, payments recorded by us, and payment references. If a school pays online, the payment provider (Paystack or OPay) collects the payment details. We never see or store card numbers or bank logins. We keep the provider's reference, the amount and the date.
3.5 Website and demo requests (we are the controller)
When someone asks for a demo we keep the name, school, role, phone number, email address and message they type. We use it only to reply and to follow up the request.
3.6 School branding
A school's name, logo and colours.
3.7 Technical data and cookies
- Our servers keep standard logs (time, page, network address, errors) for security and to fix faults. We aim to keep these for no longer than 90 days.
- Error reports, if switched on, are sent without personal details.
- Cookies: a session cookie that keeps you signed in and a security cookie that protects forms. Both are essential. Your device also remembers your light or dark appearance choice.
- We do not use advertising cookies, analytics trackers or social media pixels.
3.8 What we do not collect
We do not collect photographs of children, health records, religion, ethnicity, precise location, biometric data, or government ID numbers as a feature of the platform. If a school chooses to type such things into a free-text field, they are stored as typed (see section 9).
3.9 Features that are not released yet
Brain gym and the psychometric analysis are planned for Stage 2. When they are released we will update this policy first. The commitments we have already made for them are: results are shown only to the student, the student's parents or guardians, and the form teacher or counsellor; they are used to help teaching and are never used on their own to decide discipline, exclusion or admission; and no human is replaced by a score.
4. Why we are allowed to use the data (lawful bases)
- School records: the school decides the lawful basis, normally its duty to educate and keep records, its legitimate interest in running the school, and, where the school asks for it, the consent of parents. We process on the school's instructions.
- Our own data: to perform our contract with the school, to follow the law, for our legitimate interest in keeping the service safe, and, for demo requests, because the person asked us to contact them.
We never use school records for our own marketing.
5. Who can see what
| Who | What they can see |
|---|---|
| A student | Only their own results and attendance, and notes sent to them |
| A parent or guardian | Only the students linked to them: results the school has published, attendance, and messages they exchange with the school |
| A teacher | The classes and subjects they are assigned. A form teacher also sees the students of their own class and those students' parents' contact details |
| A school admin (principal) | Everything in their own school |
| Techscholar team | School-level figures (such as student counts and setup progress) and the support messages a school sends us. Our engineers can technically reach the database to run the service, so access is limited to named people with two-step sign-in, only when needed for support or maintenance |
| Another school | Nothing. Every record belongs to one school and is checked against that school on every request, and automated tests try to break this on every change |
Results appear to parents and students only after the school publishes them, and a school can hold back any single result.
6. Children's data
Most students are under 18. So we:
- collect only what is needed to run results, attendance and school messages;
- never let students message anyone, and never let them see other students' records;
- never use children's data for advertising, profiling for sale, or marketing to children;
- rely on the school and parents as the people who speak for the child, and treat a parent's or school's request to correct or remove a child's data seriously;
- apply the extra care described in our Safeguarding Policy.
7. Where data is kept and who else handles it
Data is held on servers in [to be confirmed], with [to be confirmed]. We use a small number of other companies ("sub-processors") only for what each is needed for:
- Hosting and storage: [to be confirmed]. Holds the database, files and backups.
- Cloudflare: passes web traffic to our servers and filters attacks. It handles traffic details, not the contents of the database.
- Email delivery: [to be confirmed]. Sees the recipient's address and the email text (for example set-up links).
- WhatsApp delivery (only if switched on, only for parents who opted in): Twilio. Sees the parent's phone number and the alert text.
- Online payment (only when a school pays online): Paystack and OPay. See the paying admin's name and email, the amount and the reference.
- Phone reminders (only for students who turn them on): the browser makers' push services (Google, Mozilla, Apple, Microsoft). They receive the reminder text and a device token, never marks or profiles.
- Error reporting (only if switched on): Sentry, without personal details.
If personal data is sent outside Nigeria we make sure the receiving company is bound to protect it to the standard the NDPA requires. A current list of sub-processors is available on request from [to be confirmed], and we tell schools before adding one that handles school records.
8. How we protect data
- All connections are encrypted (HTTPS), and browsers are told to always use HTTPS.
- Teachers, school admins and our own team sign in with a second step from a phone app.
- Passwords need at least ten characters and are stored only as one-way hashes. Student PINs are hashed too, and a PIN is shown once on a printed slip. No password is ever sent by email: new people get a one-time link that works once.
- Repeated wrong guesses lock the sign-in. Sessions end automatically: after eight hours for staff, after a week for families.
- Every request is checked against the signed-in person's role and school.
- Sensitive actions are written to an audit record that the school admin can read.
- We take backups regularly, keep them securely and practise restoring them. Backups are kept for 30 days.
- Security scans and automated tests run on every change we make. We plan an independent security test before launch (not done yet).
- We require disk encryption from our hosting provider and keep passwords and keys outside the code.
No system is perfectly safe. If something goes wrong, we deal with it as set out in section 12.
9. What schools must do
Because the school is the controller, it must:
- have a lawful reason to hold each record and tell parents what is held and why;
- keep records accurate, and correct them when asked;
- give accounts only to the people who need them, and switch off or remove leavers;
- keep student PIN slips safe and hand them to the right student;
- keep free-text fields (remarks, excuse reasons, notes, messages) to what is needed. Do not type medical diagnoses, details of abuse, or other sensitive information into them. Raise safeguarding and health matters through the school's proper channels (see the Safeguarding Policy);
- tell us promptly about any suspected breach, lost device or misuse.
10. How long we keep data
- While a school is with us: school records are kept for as long as the school uses Techscholar, so that past report cards and transcripts stay available.
- When a school leaves: the school can ask for an export of its records. We then delete the school's data from live systems within 90 days of the end of the agreement, and it leaves our backups as they expire (within 30 days).
- Our own records: billing records for as long as tax and accounting law requires. Support messages for 3 years. Demo requests that do not become a customer for 12 months. Failed sign-in records for 90 days. The audit record of sensitive actions for 3 years.
- Pupils' own work: what a pupil typed or attached to a piece of work (answers, notes, written answers, teacher comments and files) is removed 3 years after the work was last changed. The marks stay, so report cards and transcripts are not affected. Class announcements are removed after the same period.
- Pupil activity: exam-practice sittings, flashcard progress and brain gym workouts are removed after 2 years. Read notifications are removed after four months. Safeguarding alerts that the school's lead read and found to be no concern are removed after one year.
- Safeguarding records are kept longer, securely, as set out in the Safeguarding Policy.
What exists today. A school admin can download a ZIP of the school's records and can download any one student's data. A parent or student can download their own. A school admin can remove a student's personal details (keeping the marks as anonymous records) or delete a student and all their records. When a school leaves, our team closes the account and removes its personal data. A daily clean-up job deletes failed sign-in records, audit events, support messages and old demo requests once they pass the periods above. Safeguarding records and billing records are not part of these tools, because they have their own rules.
11. Your rights
Under the Nigeria Data Protection Act, a person (or a parent or guardian for a child) can ask to:
- know what we hold about them and get a copy;
- have wrong data corrected;
- have data erased, or its use restricted, where the law allows;
- object to certain uses, and withdraw consent that was given;
- receive their data in a usable format;
- complain to the Nigeria Data Protection Commission.
How to ask. For school records, ask the school first, because it decides. The school can give you a download of the data and can remove it. You can also write to [to be confirmed] and we will pass the request to the right school and help it respond. We may need to confirm who you are. It is free. We aim to reply within 14 days and always within the time the law sets.
Some records must be kept, for example results the school has already published or records needed for safeguarding or legal duties. We will explain when that applies.
12. If something goes wrong (data breaches)
If we find that personal data was lost, stolen, changed or seen by someone who should not have seen it, we:
- act at once to stop it and protect accounts;
- work out what was affected and how many people;
- tell the affected school or schools without undue delay, and aim to do so within one working day of confirming it;
- help the school tell parents and others affected, and report to the NDPC within 72 hours where the law requires it;
- record what happened and fix the cause.
13. Requests from authorities
We share personal data with the police, a court or a regulator only when the law requires it and the request is valid. We share the minimum, and we tell the school unless the law forbids it.
14. Changes to this policy
We update this policy when the product or the law changes, and we change the version above. For material changes we tell school admins before they take effect. Earlier versions are available on request.
15. Contact
Data protection contact: [to be confirmed], [to be confirmed]. Postal address: [to be confirmed].