Data Processing Agreement

The School is the data controller for staff, student, and parent data entered into the Service, and determines the purposes and means of processing that data (for example, which records to keep, which staff can access them, and which reminders to send).

EduNovtryx is the data processor and processes that data only on the School’s documented instructions, as set out in this DPA and as configured by the School within the Service.

Nature and purpose: hosting, storage, and processing of staff, student, and parent data to provide the school-management functions of the Service — including duty allocation, results and attendance records, fee ledgers, and SMS/email reminders configured by the School.

Categories of data subjects: school staff, students, and parents/guardians.

Categories of data: names, contact details, dates of birth, addresses, academic and attendance records, fee and payment records, and duty/role assignments.

Duration: for as long as the School maintains an active subscription, and thereafter only as necessary to comply with the data retention terms of our Privacy Policy.

EduNovtryx will:

• Process personal data only on the School’s instructions, as configured through the Service, unless required otherwise by law.
• Ensure personnel authorised to process personal data are subject to confidentiality obligations.
• Implement appropriate technical and organisational security measures, including encryption in transit and logical isolation of each School’s data.
• Assist the School, where reasonably possible, in responding to data subject requests (such as access, correction, or deletion requests) relating to data held in the School’s account.
• Notify the School without undue delay after becoming aware of a personal data breach affecting the School’s data.
• Delete or return School data at the end of the subscription, in line with our Privacy Policy, except where retention is required by law.

The School authorises EduNovtryx to engage the following categories of sub-processor to help deliver the Service:

• Cloud hosting and database providers, to store School data.
• Paystack, to process subscription and fee payments on the School’s behalf.
• SMS and email delivery providers, to send reminders and notifications the School configures.

EduNovtryx remains responsible for sub-processors’ compliance with data protection obligations equivalent to those in this DPA, and will impose written data protection terms on each sub-processor.

Where a sub-processor stores or processes data outside Nigeria, EduNovtryx will ensure appropriate safeguards are in place to protect the data to a standard consistent with the NDPR.

On reasonable written request, and no more than once per year unless required following a security incident, EduNovtryx will provide the School with information reasonably necessary to demonstrate compliance with this DPA, and will cooperate with reasonable audit requests, subject to confidentiality safeguards.

Liability under this DPA is subject to the limitation of liability set out in our Terms of Service.

This DPA takes effect when a School begins using the Service and remains in effect for as long as EduNovtryx processes personal data on the School’s behalf under the Terms of Service.

Questions about this DPA, or requests relating to an audit, can be sent to info@novtryx.com.