1. Important Legal Roles (Data Controller vs. Data Processor)

Under the Nigeria Data Protection Act (NDPA):

• The School as Data Controller: The school subscribing to Edcrane determines the purpose and legal basis for collecting personal data from its staff, students, and parents. The school is responsible for obtaining all necessary consents, particularly from parents or guardians for minors.
• Edcrane as Data Processor: Edcrane processes this data strictly on behalf of, and according to the instructions of, the subscribing school.

2. Information We Collect

We collect several categories of information to provide a seamless school management experience:

• School Institutional Data: School name, physical address, official email, phone number, registration details, and administrator credentials.
• Staff Data: Names, email addresses, phone numbers, job titles, roles, and employment details.
• Student Data: Names, dates of birth, genders, passport photographs, enrollment numbers, class/grade levels, attendance records, academic grades, and report cards.
• Parent or Guardian Data: Names, phone numbers, email addresses, home addresses, and emergency contact details.
• Technical & Usage Data: IP addresses, login timestamps, device types, browser information, operating systems, and data regarding how you interact with our platform.
• Other Data Provided Directly by You: Any additional information, files, documents, or communications that the School, its staff, parents, or students voluntarily upload, submit, or transmit through the Platform (such as student health notes, transport routes, custom forms, survey responses, or customer support inquiries).

3. How We Use Your Information

We use the collected information for the following specific purposes:

• To set up, operate, and maintain the Edcrane school management ecosystem.
• To manage student enrollment, grading, attendance, and timetables.
• To facilitate seamless communication between schools, teachers, parents, and students.
• To process subscription fees and track school financial records.
• To monitor system performance, troubleshoot software bugs, and optimize user experience.
• To enforce our terms, detect fraudulent logins, and maintain strict data security.

4. Third-Party Tools and Data Sharing

We do not sell, rent, or trade your personal information. To deliver core functionalities, we securely share data with vetted third-party service providers under strict confidentiality agreements:

• Payment Processing: We integrate secure third-party payment gateways to handle tuition fees and software subscriptions. Your financial details (card numbers, PINs) are processed directly by these PCI-DSS compliant providers; Edcrane does not store raw financial data.
• Analytics: We use third-party analytics tools to track software performance, monitor crashes, and understand user behavior. This data is aggregated and does not identify individual students or parents.
• Push Notifications & Alerts: We use third-party communication infrastructure to send automated SMS, emails, and real-time push notifications regarding school announcements, fees, or emergencies.

5. Special Protection for Minors

Edcrane processes data belonging to children under the age of 18. We treat this data with the highest level of security.

• Subscribing schools warrant that they have secured explicit parental or guardian consent before uploading minor student records onto Edcrane, in strict compliance with Nigerian laws.
• We never use student data to build behavioral profiles or target children with commercial advertisements.

6. Data Security and Retention

Security Measures: We implement robust administrative, technical, and physical security measures. This includes HTTPS and AES-256 encryption for data in transit and at rest, secure cloud hosting servers, firewall protections, and strict internal access controls.

Data Retention: We retain school and student data for as long as the school maintains an active subscription with Edcrane. Upon termination or expiration of the school’s contract, we will securely delete the data within a commercially reasonable timeframe, subject to legal record-keeping obligations.

Routine Backups and School Responsibility: While Edcrane performs routine, automated system backups for platform maintenance, disaster recovery, and business continuity, these routine operations do not shift liability. The school retains primary ownership of its information. It is solely the responsibility of the subscribing school to extract, download, and maintain independent external backups of all institutional, staff, student, and financial records. Edcrane shall not be held liable for any data loss resulting from a school's failure to maintain its own independent backups. For detailed information regarding our full limitation of liability, data disclaimers, and operational boundaries, please read our Terms of Service.

7. Your Data Privacy Rights

In accordance with the NDPA, users (exercised directly or through their school administrator) possess the right to:

• Access the personal data stored on the platform.
• Rectify incomplete or inaccurate records.
• Object to specific data processing actions.
• Request Erasure of their data, subject to school policies and legal restrictions.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect regulatory changes or software updates. We will notify subscribing schools of any material changes via email or an in-app banner before the changes take effect. By continuing to use the Service after this Policy has changed, you indicate your agreement to the revised Privacy Policy.

9. Contact Us

If you have any questions, concerns, or data requests regarding this Privacy Policy, please contact our Data Protection Team at:

Edcrane Privacy Office
Email: support@edcrane.com