Privacy Policy

Nfixa Technologies Ltd. ("Nfixa", "we", "us", or "our"), a company registered in the Federal Capital Territory, Abuja, Nigeria, operates the MySchoolIQ school management platform ("the Service"). This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR). By using MySchoolIQ, you agree to the practices described in this Policy. If you do not agree with this Policy, please discontinue use of the Service immediately.

We collect the following categories of personal data: School & Staff Data: School name, address, registration details, owner and administrator names, email addresses, phone numbers, and profile photographs. Student Data: Full name, date of birth, gender, admission number, class assignment, home address, state of origin, nationality, blood group, medical notes, emergency contact details, and academic records including scores, grades, and results. Guardian & Parent Data: Full name, phone number, email address, relationship to student, and portal access credentials (PIN). Financial Data: Fee payment records, amounts, payment methods, and receipt data. We do not store full card numbers. Payment card processing is handled by Paystack, which operates under its own privacy policy. Usage Data: Log data including IP addresses, browser type, pages visited, actions performed within the platform, and timestamps — used for security, debugging, and service improvement.

We process personal data for the following purposes: - Service Delivery: To provide school management features including student records, fee management, result processing, timetable management, and parent portal access. - Communication: To send SMS notifications, email receipts, and support communications related to your use of the Service. - Security & Compliance: To authenticate users, detect fraud, maintain audit logs, and comply with applicable Nigerian laws. - Product Improvement: To analyse usage patterns (in anonymised or aggregated form) to improve platform features. - Legal Obligations: To comply with court orders, regulatory requirements, or law enforcement requests as required by Nigerian law. We do not use your data for advertising purposes and do not sell personal data to third parties.

Under the NDPA, we process personal data on the following lawful bases: - Contractual Necessity: Processing is necessary to fulfil our service agreement with you. - Legitimate Interests: Processing is necessary for our legitimate interests in operating and improving the platform, provided these interests are not overridden by your rights. - Legal Obligation: Processing is required to comply with applicable laws. - Consent: Where required, we obtain explicit consent before processing certain categories of sensitive data (e.g. medical information about students).

We share personal data only in the following limited circumstances: Service Providers: We share data with trusted third-party service providers necessary to operate the platform, including Termii (SMS delivery), Paystack (payment processing), and cloud infrastructure providers. All providers are contractually bound to protect your data. Legal Requirements: We may disclose data to Nigerian regulatory bodies, law enforcement, or courts when legally required to do so. Business Transfers: In the event of a merger, acquisition, or sale of Nfixa Technologies, personal data may be transferred as part of that transaction. Users will be notified in advance. We do not sell, rent, or trade personal data to any third party for marketing purposes.

We retain personal data for as long as your school account is active or as needed to provide the Service. Specifically: - Student and academic records: Retained for 7 years after the student's last active term, or until the school account is deleted, whichever is later. - Financial records: Retained for 7 years from the date of transaction in compliance with Nigerian tax and financial regulations. - Usage and audit logs: Retained for 2 years. - Deleted accounts: Data is permanently purged within 90 days of account deletion, except where retention is required by law.

As a data subject under the Nigeria Data Protection Act 2023, you have the following rights: - Right of Access: Request a copy of the personal data we hold about you. - Right to Rectification: Request correction of inaccurate or incomplete data. - Right to Erasure: Request deletion of your personal data, subject to legal retention requirements. - Right to Restrict Processing: Request that we limit how we use your data in certain circumstances. - Right to Data Portability: Request your data in a machine-readable format for transfer to another service. - Right to Object: Object to certain types of processing, including profiling. - Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. To exercise any of these rights, email us at privacy@nfixa.com. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include: - Encrypted data transmission (TLS/HTTPS) for all communications - Hashed and salted password storage — we never store plain-text passwords - Role-based access controls limiting data access to authorised users only - Audit logs recording all significant data access and modification events - Regular security assessments and vulnerability monitoring Despite these measures, no system is 100% secure. If you become aware of a security incident, please contact us immediately at security@nfixa.com.

MySchoolIQ uses session cookies solely to maintain your authenticated state within the application. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. You can configure your browser to refuse cookies, but this will prevent you from accessing the authenticated areas of the platform.

MySchoolIQ stores academic records for students, some of whom may be minors. This data is provided and controlled by the school (data controller) under their responsibility to parents and guardians. We do not collect data directly from children. Schools are responsible for obtaining appropriate consents from parents and guardians for the collection and processing of student data.

Your data is primarily stored and processed on servers located within Nigeria or in cloud infrastructure with data residency options. Where data is transferred internationally (e.g. for SMS delivery via Termii), we ensure appropriate safeguards are in place in accordance with NDPA requirements.

We may update this Privacy Policy from time to time. When we make material changes, we will notify school administrators by email and display a prominent notice within the MySchoolIQ platform. Continued use of the Service after notification constitutes acceptance of the updated Policy.

For privacy-related enquiries, requests, or complaints, contact us at: Nfixa Technologies Ltd. FCT, Abuja, Nigeria Email: privacy@nfixa.com Website: www.nfixa.com If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.