Privacy Policy

Edsynk is operated by Edsynk Technologies Ltd, a company registered in Nigeria with its base in Bauchi. We provide software that schools use to manage students, results, attendance, communication and payments.

An important distinction runs through this entire policy:

That relationship is written down formally in the Data Processing Agreement each school accepts at onboarding.

For Edsynk’s own business contacts — for example a proprietor who signs up, or a visitor to this website — Edsynk acts as the data controller. This policy covers both roles and says which is which where it matters.

We process personal data in line with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR), under the supervision of the Nigeria Data Protection Commission (NDPC).

We rely on the following lawful bases:

• Performance of a contract — to deliver the service your school has subscribed to (storing records, computing results, sending notifications).
• Consent — where a parent, guardian or staff member has agreed to a specific, optional use of their data, which they may withdraw at any time.
• Legitimate interest — for keeping the platform secure, preventing fraud and forgery, and improving reliability — balanced against the rights of the people whose data we hold.
• Legal obligation — where Nigerian law requires a record to be kept or disclosed.

For children’s records, the responsibility for establishing the appropriate basis (including any consent) sits with the school as controller; Edsynk acts on the school’s documented instructions.

Most students on Edsynk are minors. Their data is collected and held on behalf of the school, which has a direct relationship with the child and their family. Edsynk never markets to children and never builds advertising profiles of them.

Parental and guardian rights — to see a child’s records, to correct them, or to ask questions — are exercised through the school, which knows the family and can verify identity properly. The parent portal in Edsynk exists to give families that visibility directly, but the school remains the gatekeeper of who is connected to which child.

We collect only what a school needs to run. Depending on how your school configures Edsynk, this may include:

• Student records — name, class, admission number, date of birth, gender, photo, and the biodata your school chooses to keep.
• Results and assessment data — continuous-assessment and exam scores, grades, positions, traits, and teacher and principal remarks.
• Attendance — daily or session attendance marked by staff.
• Guardian and contact details — names, phone numbers and email addresses of parents or guardians, so the school can reach them.
• Staff data — names, roles, login credentials and the actions staff take in the system.
• Payment metadata — what was paid, when, by whom and the reference. We do not store full card numbers; card payments are handled by our payment providers (see Sub-processors).
• Usage and technical logs — log-in times, device and browser type, IP address and audit records of changes, kept for security and troubleshooting.

We do not collect special-category data (such as health or religious belief) except where a school deliberately records it as part of its own legitimate operation — for example, subjects taught at an Islamiyyah school — and only as the controller directs.

We use personal data for one purpose: to deliver the service the school pays for. Concretely, that means computing and sealing results, building broadsheets and report cards, marking attendance, notifying parents, processing payments and keeping audit logs.

Three commitments matter enough to state plainly:

Protecting children’s records is the most important thing we do. Our safeguards include:

• Encryption in transit and at rest — data moves over TLS and is encrypted on our servers and in backups.
• Role-based access controls— staff see only what their role allows; a subject teacher cannot browse another class’s records.
• Audit logs — sensitive changes (such as editing a published result) are versioned and attributed, so nothing is changed silently.
• Least-privilege internal access — Edsynk staff access customer data only when needed for support and only with appropriate authorisation, and such access is logged.

We host on reputable cloud infrastructure and select hosting regions to keep latency low and meet our obligations under Nigerian law. No system is perfectly secure, but we work continuously to reduce risk and respond quickly when issues arise.

To run the service we rely on a small number of trusted providers who process data on our behalf, under contract and only for the purposes below:

• Paystack — processing card and bank payments. Payment details go to them directly; Edsynk does not store full card data.
• SMS & messaging providers (Termii) — delivering notifications, result alerts and one-time codes to guardians and staff.
• Cloud hosting & database (Vercel, Neon) — hosting the application, databases and encrypted backups.
• File storage (Cloudflare R2) — storing school logos, photos and uploaded documents.
• Error monitoring (Sentry) — capturing technical faults so we can fix them; configured to minimise personal data in reports.

We use only sub-processors that offer appropriate protections, and we remain responsible to the school for their handling of data. We will give schools reasonable notice of any material change to this list.

We will never hold children’s data hostage. If an account is suspended — for example for non-payment — it becomes read-only rather than deleted, and export remains available throughout. A billing dispute will never cut a school off from its own records.

We keep personal data for as long as the school (as controller) instructs, plus any minimum period Nigerian law requires. Academic records often need to be kept for years so that transcripts and historical results stay verifiable.

When a school offboards, or asks us to delete specific records, we delete or return the data on the school’s verified instruction, subject to any legal retention obligation. Backups containing deleted data are overwritten on our normal backup cycle.

Under the NDPA 2023 and NDPR, data subjects have the right to:

• Access — ask what personal data is held about you or your child.
• Rectification — have inaccurate data corrected.
• Erasure — ask for data to be deleted, where no legal duty requires us to keep it.
• Portability — receive your data in a portable format.
• Objection — object to certain processing, and withdraw consent you have given.

How to exercise them: for a student’s records, contact the school in the first instance — as controller, it verifies identity and acts on requests. For data Edsynk controls directly, or if the school directs a request to us, write to privacy@edsynk.ng. We respond within the timeframe set by the NDPA.

If a personal data breach occurs, we act quickly to contain it and assess the risk. Where the law requires, we notify the affected school without undue delay so it can meet its own obligations as controller, and we notify the Nigeria Data Protection Commission (NDPC) within the timeframe set by the NDPA. Where a breach is likely to result in high risk to individuals, affected people are informed through the appropriate route.

We aim to keep data on infrastructure appropriate for Nigerian schools. Where any processing or backup involves a transfer outside Nigeria — for example a sub-processor’s regional infrastructure — we ensure an adequate level of protection through appropriate safeguards permitted under the NDPA, such as contractual data-protection terms with the recipient.

Questions about this policy, or about how your or your child’s data is handled, are welcome.

• Privacy team — privacy@edsynk.ng
• For students — contact your school, which holds your records as data controller.
• Company — Edsynk Technologies Ltd, Bauchi, Nigeria.

If you believe your rights under the NDPA have not been respected, you may also lodge a complaint with the Nigeria Data Protection Commission (NDPC).