NDPA Compliance

Nfixa Technologies Ltd. operates primarily as a data processor under the NDPA 2023. Schools and educational institutions that use our products (including MySchoolIQ) are the data controllers — they determine the purposes and means of processing personal data of students, parents, guardians, and staff. As a data processor, Nfixa processes personal data only on the documented instructions of the school (data controller) and does not use that data for any other purpose. We have implemented appropriate technical and organisational measures to protect data as required by the NDPA.

On behalf of schools (as data controllers), we process the following categories of personal data: Students: Full names, admission numbers, dates of birth, gender, class/year group, passport photographs, home addresses, academic results, attendance records Parents/Guardians: Full names, phone numbers, relationship to student, portal login credentials (PIN and admission number) School Staff (Owners, Administrators, Teachers): Full names, email addresses, phone numbers, staff photographs, professional qualifications, employment details, login credentials Financial Records: Fee payment records, payment methods, payment dates, and outstanding balances We do not collect National Identity Numbers (NIN), Bank Verification Numbers (BVN), bank account details, or other sensitive financial identifiers.

Personal data is processed under the following lawful bases recognised by the NDPA 2023: • Performance of a contract: Providing school management services as agreed with subscribing schools • Legitimate interests: Platform security, fraud prevention, and service improvement • Consent: Push notifications and optional communications, where consent is explicitly obtained • Legal obligation: Retention of financial records as required by Nigerian law For data relating to minors (students under 18), schools as data controllers are responsible for ensuring parental/guardian consent is obtained in accordance with Section 34 of the NDPA 2023.

All data subjects (students, parents, guardians, and staff) whose data we process have the following rights: Right of Access (Section 34): Request confirmation of whether we hold your data and receive a copy of it. Right to Rectification (Section 35): Request correction of inaccurate or incomplete personal data. Right to Erasure (Section 36): Request deletion of personal data where it is no longer necessary, or where consent is withdrawn. Right to Restrict Processing (Section 37): Request limitation of processing in certain circumstances. Right to Data Portability (Section 38): Receive your data in a structured, machine-readable format. Right to Object (Section 39): Object to processing based on legitimate interests. To exercise any of these rights, contact the school where your data was registered (the data controller), or contact us at support@nfixa.com if you are unable to reach the school.

We implement the following technical and organisational measures to protect personal data: • Encryption in transit: All data transmitted between users and our servers is encrypted using TLS (HTTPS) • Password security: All passwords are hashed using bcrypt before storage; plaintext passwords are never stored • Access controls: Role-based access ensures each user only accesses data relevant to their role • Data isolation: Each school's data is logically isolated — one school cannot access another's data • Token security: Authentication tokens are blacklisted on logout to prevent reuse • Rate limiting: Login attempts are rate-limited to prevent brute-force attacks • Error monitoring: Sentry is used for error tracking, with data stored in the EU and no personal data intentionally captured • Regular security reviews: Our codebase and infrastructure are reviewed regularly for vulnerabilities

Our primary database and backend services are hosted on Railway (cloud infrastructure). Error monitoring is handled by Sentry with EU data storage. These transfers are conducted under standard contractual clauses and appropriate safeguards in accordance with the NDPA 2023 cross-border data transfer provisions. We do not transfer Nigerian personal data to countries without adequate data protection laws without appropriate safeguards in place.

In the event of a personal data breach that poses a risk to data subjects, Nfixa Technologies Ltd. will: 1. Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, in accordance with Section 40 of the NDPA 2023 2. Notify affected schools (data controllers) without undue delay 3. Provide information on the nature of the breach, data categories affected, likely consequences, and measures taken Affected data subjects will be notified by the school (data controller) as appropriate.

Nfixa Technologies Ltd. has not yet appointed a formal Data Protection Officer (DPO). Data protection responsibilities are currently managed by our senior technical and legal team. We are committed to appointing a qualified DPO as our operations scale, in compliance with NDPC guidance. For all data protection enquiries, please contact: support@nfixa.com

If you have concerns about how we handle your personal data that we have been unable to resolve, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC): Nigeria Data Protection Commission Website: ndpc.gov.ng Email: info@ndpc.gov.ng Phone: +234-800-800-6372