Privacy

Privacy Policy

Last updated: 31 May 2026

This Privacy Policy describes how Codivant Limited ("we", "us", "our") collects, uses, and protects your information when you use the SchoolOS platform operated by us at codivanttech.com and its school subdomains. We are a Nigerian company registered with the Corporate Affairs Commission under registration number 9101806, with our registered office at 29 Pipeline Road, Oke-Agaye, Ijeodo, Ikotun, Lagos State, Nigeria.

This policy is written to be compliant with the Nigeria Data Protection Act 2023 (NDPA) and applies to all personal information we process about school administrators, bursars, teachers, parents, and students.

1. Information we collect

We collect the following categories of personal information through the platform:

• Account information. Name, email address, phone number, role within the school (administrator, bursar, teacher, parent), and an encrypted password hash.
• Student information.Name, admission number, class, date of birth, photo, and other records that the school uploads as part of operating SchoolOS. This information belongs to the school; Codivant Limited acts as the data processor on the school's behalf.
• Parent-child relationships. Which parents are authorised to view information about which students, and which channels (email, SMS, WhatsApp) each parent has opted in to.
• Payment metadata. Invoice amounts, payment dates, payment methods, and receipt numbers. We never receive, store, or have access to full card numbers, CVVs, or bank credentials. Those are handled exclusively by our payment processor (see section 4).
• Audit and security logs. IP addresses, timestamps, and the actions you take in the system are recorded for security and compliance purposes.

2. How we use your information

We use the information described above to:

• Provide the SchoolOS platform to your school.
• Process fee payments on behalf of your school and send you receipts.
• Send transactional notifications (fee reminders, payment receipts, attendance alerts, pickup OTPs) through the channels you have opted into.
• Generate audit logs and security records required by Nigerian financial regulations.
• Operate, secure, and improve the platform. This includes investigating fraud, debugging errors, and developing new features.

3. Lawful basis for processing

Under the NDPA, we process your personal data on one or more of the following lawful bases:

• Contract. To deliver the SchoolOS platform to your school under the agreement between Codivant Limited and the school.
• Legal obligation. To comply with Nigerian financial record-keeping rules, anti-money-laundering law, and tax regulations.
• Consent. For optional notification channels (e.g. WhatsApp messaging) where you have explicitly opted in.
• Legitimate interests. For platform security, fraud prevention, and the ordinary operation of our business.

4. Payment processing with Paystack

5. Other data processors we work with

This list is current as of 31 May 2026. If we add a new sub-processor, we will update this page and notify school administrators at least 30 days in advance. Schools who object to a new sub-processor may terminate their subscription before the change takes effect.

Beyond Paystack (Section 4), the following third parties process limited personal data on our behalf, each under contractual data-protection obligations:

• Railway: cloud hosting for our application servers, database, and Redis cache. Data hosted in US and EU regions.
• Vercel: hosting for the frontend and edge functions. Edge network is global; primary deployment region is the United States.
• Resend: transactional email delivery (receipts, payment notifications, password resets, fee reminders). Infrastructure in the United States.
• Termii: SMS and WhatsApp message delivery. Nigerian provider with infrastructure in Nigeria.
• Cloudflare: DNS, CDN, DDoS protection, and encrypted object storage (R2) for school logos, receipts, and student documents. Cloudflare operates a global edge network; R2 buckets are configured in EU regions.

Lawful basis for cross-border transfers

Where the sub-processors above operate infrastructure outside Nigeria (Railway, Vercel, Resend, Cloudflare), we rely on the following lawful bases under NDPA Section 41:

• The transfer is necessary for the performance of our contract with the school (Section 41(1)(b)).
• Each sub-processor maintains contractual data-protection terms at least equivalent to the NDPA, including the EU Standard Contractual Clauses (SCCs) where applicable.
• Termii is the only sub-processor that holds data within Nigeria. This is where the highest concentration of children's contact data (SMS and WhatsApp numbers) lives, which we consider a deliberate design choice in line with NDPA data-localisation guidance.

What we will never do with your data

We do not sell, rent, or transfer personal data to any party outside the list above. We do not use personal data for advertising or profiling. We do notuse student data, parent contact data, or any personal data processed through SchoolOS to train artificial intelligence or machine-learning models, our own or any third party's.

6. Personal data of children under 18

The majority of personal data processed through SchoolOS concerns children under 18 years of age. The NDPA places additional obligations on the processing of children's data, and we treat this category with the highest care.

Roles

The school is the data controller for student personal data. Each school decides what student information to collect, how to use it, and how long to retain it within its own policies and the applicable legal frameworks. Codivant Limited is the data processor: we process student data only on the documented instructions of the school and only for the purposes of operating SchoolOS.

What student data we process on the school's behalf

• Full name, date of birth, gender, and photograph
• Admission number, class arm, and academic department
• Parent or guardian contact details (linked via the parent-student relationship table)
• Attendance records and gate-pickup logs
• Academic records (CA scores, exam scores, grades, positions, report cards)
• Disciplinary records (where the school records them)
• Fee invoices and payment status (no card details, see Section 4)
• Audit-trail entries linked to actions taken on or by the student

Lawful bases under the NDPA

We process this data on the lawful bases of:

• Contract between the school and the parent or guardian for the provision of education.
• Legal obligation on the school under Nigerian education regulations.
• Legitimate interests of the school in running its operations safely and efficiently.

Where a particular processing activity goes beyond these (e.g. marketing or external benchmarking), the school is responsible for obtaining specific parental consent before instructing us.

Who can see student data

• School staffauthorised by the school's administrator, with permissions scoped to their role (e.g. a Maths teacher sees the scores they entered, not the bursar's invoice records).
• Parents and guardians can see information about their own children only. The platform enforces this at the database level via the student_parents linkage.
• Codivant Limited engineering staff can access production systems only when responding to a documented incident or support request. Every such access is logged in our audit trail and reviewed periodically.

Retention

Student records are retained for the duration of the school's account with Codivant Limited. On account termination, the school may export the data; we then delete or anonymise it within 90 days, subject to:

• Financial records (invoices, payments, receipts): retained for 7 years in line with Nigerian financial record-keeping conventions.
• Academic records(results, report cards): retained in line with the school's own academic-records retention policy and any applicable Nigerian education regulations.

Rights of parents and guardians under the NDPA

As the parent or guardian of a child whose data is processed through SchoolOS, you have the right to:

• Access the personal data we and the school hold about your child.
• Correct inaccurate or incomplete data.
• Request deletionof data that is no longer necessary, subject to the school's own retention policies and the legal retention rules above.
• Objectto processing that goes beyond the school's educational purpose.
• Withdraw consent for any processing that depends on consent (e.g. optional WhatsApp notifications).

How to exercise these rights

The primary route is through the school itself, since the school is the data controller. Contact the school's administrator or bursar through the parent portal, by email, or in person.

If the school cannot resolve your request or you wish to escalate to Codivant Limited as the data processor, email privacy@codivanttech.com. We will acknowledge within 5 business days and respond within 30 days.

If you are not satisfied with the response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at nitda.gov.ng/ndpc or any address the NDPC publishes for complaints.

Technical safeguards specific to children's data

• All data is encrypted in transit (HTTPS) and at rest for document storage.
• Each school operates on its own branded subdomain with database-level data isolation. No school can ever access another school's records.
• Role-based access controls restrict what each staff member can see and do, even within the school.
• All financial mutations and grade edits are recorded in an immutable audit trail.
• We do not show advertising to children, do not run third-party advertising trackers on portal pages, and do not sell student data.

Photographs of children

Schools may upload student photographs for identification (e.g. admission cards, attendance rosters, gate-pickup verification). These photographs are stored in encrypted cloud storage and are accessible only to the school and the parents or guardians of the student concerned. Schools are responsible for obtaining parental consent before uploading photographs and for ensuring the photographs are not used for any purpose other than the identification and safety of the student.

Cross-border transfers of children's data

We do not transfer children's personal data outside Nigeria beyond the sub-processors listed in Section 5, which operate infrastructure in regions chosen for low latency to Nigerian users, under contractual data-protection terms consistent with the NDPA.

7. How long we keep your data

Financial transaction records (invoices, payments, receipts, refunds) are retained for seven (7) years in line with Nigerian financial record-keeping conventions and the requirements of the Federal Inland Revenue Service.

Other personal information is retained for as long as your school maintains an account with Codivant Limited, and is deleted (or, where legally required, anonymised) within 90 days of the school terminating its account, subject to the financial-records retention rule above.

8. Your rights under the NDPA

As a data subject under the NDPA, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Delete personal data we hold about you, subject to the financial-records retention rule above and any other legal obligations.
• Portability. Receive a copy of your personal data in a structured, commonly-used, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent for any processing that is based on consent (e.g. unsubscribe from optional notification channels).

To exercise any of these rights, please email support@codivanttech.com. We will respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we have not handled your data appropriately.

9. Security

We protect your data using industry-standard security measures including encryption in transit (HTTPS), encryption at rest for documents stored in cloud storage, secure password hashing, role-based access controls, audit logs on every financial mutation, and regular security reviews. We also separate every school's data at the database level so no school can ever access another's records.

10. International data transfers

Cross-border transfers of personal data occur through the sub-processors listed in Section 5, each operating under contractual data-protection terms consistent with the NDPA. The specific data location for each sub-processor, and the lawful basis under NDPA Section 41 that authorises each transfer, are set out in Section 5 ("Lawful basis for cross-border transfers").

Termii is the only sub-processor that holds data within Nigeria. All other sub-processors operate infrastructure outside Nigeria (United States or European Union, depending on the provider).

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date at the top of this page will change. For material changes (such as adding a new data processor or changing the lawful basis for any processing activity) we will notify school administrators by email.

12. Contact us