1. Roles: Data Controller vs. Data Processor
Under the Nigeria Data Protection Act 2023 (NDPA), Nigeria Data Protection Regulation (NDPR), and applicable international standards:
The educational institution determines the purpose and legal basis for collecting student enrollment details, academic grades, attendance logs, and parent financial invoices. The school controls account permissions and student record validity.
SchoolFees.NG acts strictly as an authorized technological intermediary and Data Processor, executing computational bursary workflows, secure invoicing, cloud storage, POS receipt generation, and parent payment reconciliation on behalf of the School.
2. Categories of Information We Process
We collect and process only the minimal necessary data points required to deliver our educational bursary and administrative features:
- A. School Administrative & Staff Data:Proprietor name, official school email, verified telephone numbers, CAC registration details, staff role configurations (Principal, Bursar, Cashier, Teacher), login timestamps, IP addresses, and audit activity traces.
- B. Student Academic & Identity Records:Student full legal name, unique admission/matriculation number, class and class arm placement, gender, date of birth, optional passport photograph (solely for identity badge & report card generation), academic marks (CA1, CA2, Exam scores), and daily roll call attendance.
- C. Parent & Guardian Billing Details:Primary guardian name, verified contact telephone number (for automated WhatsApp/SMS fee alerts and receipt dispatch), email address, transaction reference IDs, and payment verification records.
- D. Financial & Payment Data (PCI-DSS Scoped):SchoolFees.NG does NOT directly store raw card numbers, CVVs, or bank account PINs. All parent electronic card transactions are handled by PCI-DSS Level 1 certified payment processors (Paystack Payments Limited / partnering commercial banks). We store only non-sensitive settlement transaction references, invoice IDs, and dedicated virtual NUBAN records.
3. Protection of Children & Minor Records
Because student data frequently involves minors under 18 years of age, SchoolFees.NG implements enhanced technical and operational guardrails:
Strict Prohibitions on Minor Data:
- No commercial profiling, ad-targeting, or behavioral fingerprinting of students.
- No sale, syndication, or third-party transfer of student names, images, or grades.
- Access to student profiles is restricted exclusively to authenticated school personnel and verified parents linked to that specific child.
- Student photos are encrypted and served through short-lived signed URLs or local offline vaults.
4. AI Processing Policy (Smart Search, Remarks & Auditor)
SchoolFees.NG utilizes enterprise machine intelligence to assist bursars with anomaly detection (e.g. shadow void detection) and teachers with report card remark drafting.
Any data passed to our generative AI remark engine or financial audit models is processed in ephemeral, stateless sessions via isolated enterprise endpoints. School data is NEVER used to train, fine-tune, or improve public foundational AI models. Prompts are purged immediately upon response generation.
5. Data Storage, Security & Encryption Architecture
We implement bank-grade defenses to prevent unauthorized disclosure, leakage, or tampering:
6. Cookies, Authentication & Local Storage
Our platform does not deploy third-party advertising cookies or cross-site tracking pixels. We use only strictly necessary first-party authentication tokens:
- sf_token / sf_session: Encrypted JSON Web Token (JWT) securing authenticated school administrative sessions.
- sf_user: Cached role metadata to prevent repeated latency-inducing permission lookups.
- Local SQLite Database: Embedded exclusively inside the Windows Desktop executable to ensure offline bursary continuity during internet outages.
7. Data Subject Rights & Permanent Erasure
In accordance with the NDPA 2023, school proprietors, staff, and parents retain the following statutory rights:
Right to Access & Portability: Schools may export all student, class, invoice, and payment data in open CSV or PDF format at any time directly from the dashboard.
Right to Rectification: Authorized administrators can edit or correct erroneous names, amounts, or attendance records with automated audit logging.
Right to Erasure (Account Deletion): When a school terminates its license, all operational databases, student records, and cashier logs are queued for permanent, unrecoverable cryptographic destruction after a mandatory 90-day administrative recovery grace period.
8. Contact Our Data Protection Officer (DPO)
If you have inquiries, audit verification requests, or wish to exercise statutory data rights under the Nigeria Data Protection Act, please contact:
Office of the Data Protection Officer
Skoolfin Technologies (SchoolFees.NG)
Email: dpo@schoolfees.ng / support@schoolfees.ng
Website: https://schoolfees.ng
Have Questions Regarding Our Legal Terms?
Our dedicated Data Protection and Legal Compliance desk is available to assist school owners, legal counsel, and educational boards.