Skip to content
SchooWare
Book a demo

Legal

Data processing statement

For schools: how SchooWare processes your data as your processor.

Last updated 17 September 2026 · Effective 17 September 2026

The short version

  • Your school is the controller; SchooWare is the processor, on your instructions.
  • Isolated database per school, encrypted secrets, role-based access and an append-only audit trail.
  • Subprocessors are used by category only; some may process data outside Nigeria with safeguards.
  • We report breaches without undue delay and return or delete data at the end.
On this page
  1. Controller and processor
  2. Processing on documented instructions
  3. Confidentiality of staff
  4. Security measures
  5. Subprocessors
  6. Assistance with rights requests
  7. Breach notification
  8. Return or deletion at the end
  9. Audits

Controller and processor

For the data a school and its users put into the platform, the school is the data controller and SchooWare IT Solutions Limited (“SchooWare”) is the data processor. We process personal data only to provide the platform to the school, under the Nigeria Data Protection Act 2023 (NDPA) and the Federal Republic of Nigeria.

Processing on documented instructions

We process school data on the school’s documented instructions — the school’s agreement with us, the settings the school chooses, and the actions its authorised users take. We do not use school data for our own purposes.

Confidentiality of staff

The people who process school data for us are bound to keep it confidential, and access is limited to those who need it to run and support the platform.

Security measures

  • Each school has its own isolated database.
  • Access is controlled by roles and permissions, per section.
  • Secrets are stored encrypted, and data is encrypted in transit (HTTPS).
  • The audit trail is append-only — it records who changed what, when and from where.
  • Daily database backups are kept for 7 days.

Subprocessors

We use subprocessors, by category, to run the platform:

  • cloud hosting and storage providers
  • payment gateways
  • email delivery providers
  • SMS providers (for sign-in codes)
  • push notification services
  • AI model providers
  • website analytics (only with your consent)

Some subprocessors may process data outside Nigeria, with safeguards as required by the Nigeria Data Protection Act 2023 (NDPA).

Assistance with rights requests

We help the school meet the data-subject rights under the Nigeria Data Protection Act 2023 (NDPA) — access, rectification, erasure, restriction, portability, objection and withdrawal of consent — by giving the school the tools and support to respond to requests from its students, guardians and staff.

Breach notification

If we become aware of a personal data breach affecting a school’s data, we notify the school without undue delay, with the information the school needs to meet its own obligations.

Return or deletion at the end

When a school stops using SchooWare, its data is returned or deleted on the school’s instruction, apart from what the law requires us to keep. Backups roll off after 7 days.

Audits

Audits are available to the school as set out in the school’s agreement with SchooWare IT Solutions Limited.

Questions or requests

For anything about this policy or your data, contact SchooWare IT Solutions Limited:

You can also complain to the Nigeria Data Protection Commission (NDPC).