Privacy Policy

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to names, contact details, student records, academic performance data, and digital identifiers.
• Processing: Shall bear the meaning accorded under applicable Nigerian data protection legislation, including the Nigeria Data Protection Regulation (NDPR) issued by the National Information Technology Development Agency (NITDA), and other applicable national data protection laws.
• Controller: Refers to the school, educational institution, or entity that determines the purposes and means of processing Student Data via the Services.
• Processor: Refers to SmartEdu Hub in its capacity of handling such Personal Data on behalf of Controllers.
• Student Data: Personal Data specifically relating to students, including educational records, attendance, grades, assessments, and related academic information.

2. Categories of Data Collected

We collect and process the following categories of Personal Data:

• Account Information: Names, email addresses, telephone numbers, school or institutional affiliations, role designations (teacher, student, parent, administrator), and authentication credentials.
• Educational Records: Student enrollment data, attendance records, grades and assessment results, assignment submissions, curricula, lesson plans, and related educational outputs and performance metrics.
• Communication Data: Messages exchanged through the platform, notifications, inquiries, support tickets, and interactions between teachers, students, parents, and administrators.
• Technical Data: IP addresses, device identifiers and types, operating system information, browser types and versions, system logs, session data, and usage analytics including features accessed and time spent on the platform.
• Financial and Billing Data: Payment information, subscription details, transaction records, and billing addresses (collected and processed securely via third-party payment providers in compliance with PCI-DSS standards).
• Profile and Preference Data: User settings, language preferences, notification preferences, and customization options selected by Users.

3. Purpose of Processing

SmartEdu Hub processes Personal Data for the following purposes:

• To deliver, administer, maintain, and provide access to the Services and their features.
• To fulfil contractual obligations towards schools, teachers, parents, students, and other Users.
• To facilitate communication and collaboration between teachers, students, parents, and school administrators.
• To track and report on student academic progress, attendance, and performance.
• To comply with statutory, regulatory, and legal requirements imposed by competent authorities.
• To safeguard the security, integrity, stability, and lawful use of the Services.
• To enhance, optimise, develop, and improve the Services through aggregated and anonymised analytics.
• To provide customer support, respond to inquiries, and resolve technical issues.
• To communicate with Users regarding system updates, service announcements, administrative matters, or lawful marketing communications (where express consent is obtained).
• To prevent fraud, unauthorised access, and other illegal or harmful activities.

4. Lawful Basis for Processing

SmartEdu Hub processes Personal Data based on the following lawful grounds:

• Performance of a Contract: Where Processing is necessary for the execution and performance of subscription agreements, service agreements, or terms of use with schools, institutions, or individual Users.
• Legal Obligation: Where Processing is mandated or required by applicable legislation, court orders, regulatory directives, or governmental authorities.
• Legitimate Interest: Where Processing is required for the efficient operation, improvement, security, or protection of the Services, fraud prevention, network security, or internal administration, provided such interest does not override the fundamental rights and freedoms of the data subject.
• Consent: Where Processing relates to optional activities such as direct marketing communications, non-essential analytics cookies, or other purposes requiring explicit consent under applicable law. Consent may be withdrawn at any time without affecting the lawfulness of Processing based on consent before its withdrawal.

5. Disclosure and Transfer of Data

SmartEdu Hub may disclose or transfer Personal Data in the following circumstances:

• Within Educational Institutions: To authorised administrators, teachers, support staff, or school representatives acting in their capacity as Controllers or authorised personnel with legitimate access rights.
• Service Providers: To duly engaged third-party service providers including cloud hosting providers, data storage facilities, payment processors, email service providers, analytics platforms, and communication gateways, subject to binding data processing agreements that impose confidentiality and security obligations equivalent to those contained in this Policy.
• Legal and Regulatory Authorities: To regulatory bodies, governmental agencies, law enforcement, judicial authorities, or other competent bodies upon valid legal demand, court order, subpoena, or where disclosure is required to comply with applicable law or protect the rights and safety of SmartEdu Hub, Users, or third parties.
• Business Transfers: In the event of merger, acquisition, corporate restructuring, sale of assets, or similar transactions, Personal Data may be transferred to successor entities, subject to lawful safeguards and confidentiality obligations.
• International Transfers: Where Personal Data is transferred to countries outside your jurisdiction, including transfers outside the European Economic Area, United Kingdom, or United States, SmartEdu Hub shall implement adequate safeguards such as Standard Contractual Clauses, Binding Corporate Rules, or equivalent mechanisms recognised under applicable data protection laws to ensure an adequate level of protection.

6. Data of Children and Minors

SmartEdu Hub recognises the sensitive nature of Student Data, particularly data relating to children and minors. Such data shall be processed exclusively under the lawful authority of schools, educational institutions, or parents/legal guardians, and in strict accordance with applicable child protection laws including:

• The Children's Online Privacy Protection Act (COPPA) in the United States
• The General Data Protection Regulation (GDPR) provisions on children's data in the European Union and United Kingdom
• Other applicable child data protection regulations

Direct registration and account creation by children below the age of thirteen (13) is prohibited unless facilitated by a school, parent, or legal guardian. Schools and institutions warrant that they have obtained all necessary parental or guardian consents prior to providing Student Data to SmartEdu Hub.

7. Data Retention and Deletion

SmartEdu Hub shall retain Personal Data strictly for the duration necessary to achieve the Processing purposes specified in this Policy and in compliance with applicable statutory retention periods. Retention periods vary based on data type and legal requirements:

• Account data is retained for the duration of the active subscription plus a reasonable period for backup and audit purposes.
• Educational records may be retained for longer periods as required by educational regulations or institutional policies.
• Technical logs and security data are typically retained for shorter periods necessary for system security and troubleshooting.
• Financial records are retained in accordance with applicable tax and accounting regulations.

Upon expiry of applicable retention periods, Personal Data shall be securely deleted, anonymised, or otherwise irreversibly destroyed using industry-standard methods, save where extended retention is mandated by law, valid court order, or contractual obligation.

8. Security Measures

SmartEdu Hub shall employ robust technical and organisational measures consistent with industry standards to ensure the confidentiality, integrity, availability, and resilience of Personal Data, including but not limited to:

• Encryption of data in transit using TLS/SSL protocols and data at rest using AES-256 or equivalent encryption standards
• Multi-factor authentication and strong password policies for user accounts
• Role-based access controls and principle of least privilege to limit data access
• Regular vulnerability assessments, penetration testing, and security audits
• Intrusion detection and prevention systems, firewall protection, and DDoS mitigation
• Secure backup and disaster recovery procedures to ensure business continuity
• Staff training on data protection principles and confidentiality obligations
• Incident response procedures for timely detection and remediation of security breaches

Notwithstanding these measures, Users acknowledge that no system can be entirely immune from all potential security breaches or unauthorised access. SmartEdu Hub disclaims liability for security incidents arising from factors beyond its reasonable control, including but not limited to user negligence, compromised credentials, or sophisticated cyberattacks exploiting zero-day vulnerabilities.

9. Rights of Data Subjects

Subject to applicable law, Users have the following rights with respect to their Personal Data:

• Right of Access: The right to obtain confirmation as to whether Personal Data is being processed and, where applicable, to access such data and receive information about the Processing.
• Right to Rectification: The right to request correction of inaccurate, incomplete, or outdated Personal Data without undue delay.
• Right to Erasure ("Right to be Forgotten"): The right to request deletion of Personal Data, subject to legal or contractual retention requirements and legitimate grounds for continued Processing.
• Right to Restriction of Processing: The right to request limitation of Processing under certain circumstances, such as during verification of data accuracy or assessment of legitimate grounds.
• Right to Object: The right to object to Processing based on legitimate interests or for direct marketing purposes.
• Right to Data Portability: The right to receive Personal Data in a structured, commonly used, and machine-readable format and to transmit such data to another controller where technically feasible.
• Right to Withdraw Consent: Where Processing is based on consent, the right to withdraw such consent at any time, without prejudice to the lawfulness of Processing conducted prior to withdrawal.
• Right to Lodge a Complaint: The right to file a complaint with a competent data protection authority or supervisory body if you believe your data protection rights have been violated.

Requests to exercise these rights may be submitted to the Data Protection Officer at the contact details provided in Section 11 below. SmartEdu Hub will respond to verified requests within the timeframes required by applicable law, typically within thirty (30) days of receipt.

10. Liability and Indemnification

Users acknowledge and agree that SmartEdu Hub acts primarily as a Processor with respect to Student Data and educational records, and that the primary responsibility for lawful collection, consent management, and provision of such data lies with the Controller (i.e., the relevant school, educational institution, or parent/legal guardian).

Accordingly, schools, institutions, and Users warrant and represent that:

• They have obtained all requisite parental, guardian, or legal consents for the collection and processing of Student Data
• All Personal Data provided to SmartEdu Hub has been collected lawfully and in compliance with applicable data protection laws
• They have the legal authority and right to share such Personal Data with SmartEdu Hub for the purposes outlined in this Policy

Schools and institutions agree to indemnify, defend, and hold harmless SmartEdu Hub, its officers, directors, employees, and agents against any claims, penalties, fines, liabilities, damages, costs, or expenses (including reasonable legal fees) arising from or relating to unlawful or unauthorised collection, provision, or processing of Personal Data, breach of data protection obligations, or failure to obtain necessary consents.

11. Contact Information and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy, data protection practices, or wish to exercise your data subject rights, please contact us at: Support.

We will make every reasonable effort to respond to your inquiry or request within the timeframes prescribed by applicable law.

12. Amendments and Updates

SmartEdu Hub reserves the right to amend, update, or revise this Policy from time to time to reflect changes in applicable law, regulatory requirements, technology, industry practices, or business operations. Substantive or material modifications shall be notified to Users via:

• Prominent notice displayed within the Services or on our website
• Electronic communication sent to the registered email address associated with your account
• In-platform notifications or announcements upon login

The revised Policy will take effect on the date specified in the notice. Continued use of the Services after receiving notice of such modifications shall constitute acknowledgment and acceptance of the revised Policy. If you do not agree with the amended Policy, you must discontinue use of the Services and may request deletion of your Personal Data in accordance with Section 9 above.

We encourage Users to periodically review this Policy to stay informed about how we protect and process your Personal Data.

13. Cookies and Tracking Technologies

SmartEdu Hub uses cookies and similar tracking technologies to enhance user experience, analyze usage patterns, and improve the Services. For detailed information about our use of cookies, including types of cookies used, purposes, and how to manage cookie preferences, please refer to our separate Cookies Policy.