Data Processing Agreement

This DPA is entered into between:

• The Controller — the school named at acceptance ([SCHOOL NAME], acting through its authorised representative), which determines the purposes and means of processing the personal data of its students, guardians and staff.
• The Processor— Edsynk Technologies Ltd (“Edsynk”), which processes that data solely to provide the school-management service described in the Terms of Service.

This DPA is entered into pursuant to the Nigeria Data Protection Act (NDPA) 2023 and forms part of the service agreement. Where this DPA and the Terms of Service conflict on a matter of data protection, this DPA prevails.

Terms used here — personal data, processing, data subject, controller, processor — carry the meanings given in the NDPA 2023.

“Student data” means personal data of students, their parents and guardians entered into the platform by or on behalf of the school, including records, results, attendance, contact details and photos.

“Sub-processor”means any third party engaged by Edsynk to process personal data on the school’s behalf (listed in §7).

• Subject matter. Processing of student and staff personal data necessary to provide the Edsynk school-management platform.
• Duration.The term of the school’s service agreement, plus the wind-down period in clause 10 (Return & deletion).
• Nature & purpose. Storage, computation of results, generation of report cards, attendance capture, notification delivery, payment processing and related support — no other purpose.

Data subjects: students (most of whom are children), parents and guardians, and school staff.

Categories of personal data: identification and biodata (name, date of birth, gender, admission number, photo); academic records (scores, grades, remarks, attendance); guardian contact details; staff employment data (roles, contact details); usage logs.

Special categories: the school must not upload special-category data (such as health details) unless the school has established its own lawful basis. When it does, heightened safeguards under this DPA apply.

Edsynk shall:

• process student data only on the school’s documented instructions— including the school’s configuration choices in the app — and for no other purpose;
• never sell student data, never build advertising profiles from it, and never use it to train external AI models.
• inform the school promptly if we believe an instruction breaches the NDPA, and may pause that instruction until it is confirmed or revised.

Edsynk implements and maintains, at minimum:

• Encryption of student data in transit (TLS) and at rest.
• Role-based access controls scoped to each school (tenant isolation), so one school’s users can never read another school’s records.
• Versioned, attributed audit logs on sensitive changes.
• Least-privilege internal access — Edsynk staff reach student data only for authorised support, and such access is logged.
• Encrypted backups on a regular cycle, restore-tested.

The school gives general authorisation for the sub-processors listed in our Privacy Policy (payment processing, messaging/SMS, cloud hosting and storage, error monitoring). In every case:

• Edsynk remains fully responsibleto the school for each sub-processor’s handling of student data.
• Sub-processors are bound by written terms no less protective than this DPA.
• We will give reasonable prior notice of any change to the list; the school may object on reasonable grounds, and we will work in good faith to resolve the objection.

Parents, guardians and staff exercise their NDPA rights through the school as controller. Edsynk will assist the school with access, rectification, erasure, portability and objection requests — with the tools built into the platform (export, correction workflows, audit views) and, where a request requires it, direct assistance within a reasonable timeframe.

If Edsynk becomes aware of a personal data breach affecting the school’s data, we will notify the school without undue delay, and provide what we know: the nature of the breach, the categories and approximate numbers of data subjects and records affected, likely consequences, and measures taken.

We will assist the school with its own notification obligations to the Nigeria Data Protection Commission (NDPC) and to affected individuals, as the NDPA requires.

On termination or expiry of the service agreement, Edsynk will, at the school’s choice, return student data in a portable format and/or delete it, subject to any retention period required by Nigerian law. Backups containing deleted data are overwritten on the normal backup cycle.

Throughout the term, the export tools remain available to the school — including during any suspension for non-payment (see Terms of Service).

Edsynk will make available, on written request, information reasonably necessary to demonstrate compliance with this DPA, and will allow for audits — conducted by the school or an independent auditor bound by confidentiality — no more than once per year, at the school’s cost, on reasonable notice, and without disrupting the service.

Edsynk keeps processing on infrastructure appropriate for Nigerian schools. Where any processing or backup involves a transfer outside Nigeria (for example a sub-processor’s regional infrastructure), Edsynk ensures an adequate level of protection through safeguards permitted under the NDPA, including contractual data-protection terms with the recipient, and remains liable to the school for the transfer.

Each party’s liability under this DPA follows the liability provisions of the Terms of Service. This DPA takes effect on acceptance at setup, lasts as long as Edsynk processes personal data for the school, and survives termination to the extent of any continuing processing obligations.

This DPA is governed by the laws of the Federal Republic of Nigeria.

This DPA is accepted electronically by the school’s authorised representative during onboarding, or signed in counterpart as below. The electronic acceptance record (who, when, from which account) is retained as evidence of execution.