Privacy Policy

Nfixa Technologies Ltd. ("Nfixa", "we", "our", or "us") is a technology company registered in Nigeria under CAC registration number RC 9292050, with its registered office at Wallgreen Mall, Plot A138, Hamza Abdullahi Road, Kubwa, FCT. We develop and operate digital products including MySchoolIQ, a school management platform for Nigerian educational institutions. This Privacy Policy explains how we collect, use, disclose, and protect personal information across all Nfixa products and services.

We collect information in the following categories: Account Information: Names, email addresses, phone numbers, usernames, and passwords of school owners, administrators, and teachers who register on our platforms. Student & Guardian Data: Student names, admission numbers, dates of birth, gender, photographs, home addresses, academic records, attendance records, and fee payment history. Guardian names, phone numbers, and relationship details. This data is provided by schools who use our platform and is processed on their behalf. Usage Data: Log data, IP addresses, browser type, device identifiers, pages visited, and actions taken within our applications. Payment Data: Fee payment records and transaction history processed through our platform. We do not store card details or bank account numbers directly. Communications: Support requests, feedback, and any messages you send to us.

We use collected information to: • Provide, maintain, and improve our services • Create and manage user accounts • Process and record school fee payments • Generate academic results and reports • Send notifications about school events, attendance, and results • Respond to support requests and inquiries • Monitor and analyse usage to improve performance • Comply with legal obligations under Nigerian law • Detect and prevent fraud or misuse of our platform

We process personal data under the following legal bases as recognised by the Nigeria Data Protection Act (NDPA) 2023: Contract: Processing necessary to provide the services agreed upon with schools and their staff. Legitimate Interest: Processing for platform security, fraud prevention, and service improvement. Consent: Where we request and obtain your explicit consent, such as for marketing communications or push notifications. Legal Obligation: Where Nigerian law requires us to retain or disclose certain data. For student data (which may include data of minors), schools act as the data controller and Nfixa acts as a data processor. Schools are responsible for obtaining appropriate consent from parents or guardians in accordance with the NDPA and applicable education regulations.

We do not sell your personal data. We may share data with: Service Providers: Cloud infrastructure providers (Railway, Vercel), error monitoring services (Sentry — EU data storage), and communication services we use to operate our platform. All providers are bound by data processing agreements. Schools: Student and guardian data is accessible to authorised school staff (owners, administrators, and teachers) of the school that enrolled the student. Guardians/Parents: Via the MySchoolIQ parent portal, guardians can access their linked children's academic and fee records. Legal Requirements: We may disclose data where required by Nigerian law, court order, or to protect the rights and safety of individuals. We will never share your personal data with third parties for advertising or marketing purposes without your explicit consent.

We retain personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Specifically: • Account data is retained for the duration of the subscription and for 2 years after termination • Student academic records may be retained for up to 7 years to support historical reporting needs • Payment transaction records are retained for 7 years in accordance with Nigerian financial regulations • Support communications are retained for 3 years You may request earlier deletion of your data subject to our legal obligations.

As a data subject under the Nigeria Data Protection Act 2023, you have the following rights: Right of Access: Request a copy of the personal data we hold about you. Right to Rectification: Request correction of inaccurate or incomplete personal data. Right to Erasure: Request deletion of your personal data where it is no longer necessary or where consent is withdrawn. Right to Restrict Processing: Request that we limit how we process your data in certain circumstances. Right to Data Portability: Receive your personal data in a structured, commonly used format. Right to Object: Object to processing based on legitimate interests or for direct marketing. Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, contact us at support@nfixa.com. We will respond within 30 days.

Our MySchoolIQ platform processes data relating to school students, who may be minors. This data is processed under the authority of schools (as data controllers) who are responsible for compliance with parental consent requirements under the NDPA and applicable Nigerian education laws. Nfixa does not directly collect data from children and does not knowingly allow children to create accounts on our platform without school authorisation. Parents and guardians may contact their child's school to request access to, or deletion of, their child's data.

We implement appropriate technical and organisational measures to protect your personal data, including: • Encrypted data transmission (HTTPS/TLS) • Hashed password storage • JWT-based authentication with token blacklisting • Rate limiting and access controls • School-level data isolation (each school's data is logically separated) • Regular security reviews While we take reasonable precautions, no internet transmission is completely secure. We encourage you to use strong passwords and keep your credentials confidential.

We use cookies and similar technologies to maintain your session, remember your preferences, and monitor platform performance. See our Cookie Policy at nfixa.com/legal/cookies for full details.

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or prominent in-app notices at least 14 days before changes take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

For privacy-related enquiries, data subject requests, or complaints: Nfixa Technologies Ltd. Wallgreen Mall, Plot A138, Hamza Abdullahi Road, Kubwa, FCT, Nigeria Email: support@nfixa.com If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.