Legal

Privacy Policy

Last updated: 29 October 2026

1. Who we are

SmartSchools is a school management platform operated by KK GLISTER TECHNOLOGY, a Nigerian company registered with the Corporate Affairs Commission under RC 8171020 (“we”, “us”, “our”). Our registered address and contact details are provided at the end of this policy.

For the personal data of students, staff, and parents that a school uploads into SmartSchools, the school is the data controller, and we are a data processor. For the personal data of the people who sign up to use SmartSchools on behalf of a school (school admins) and for the people who visit this website, we are the data controller.

2. Personal data we collect

2.1 School and administrator data

School name, address, email, and phone
Administrator first name, last name, email, and password hash
Billing information (subscription tier, billing period, transaction references, payment history)

2.2 Staff data (entered by the school)

Name, email, phone, gender, date of birth, address
Position, department, employment type, date of hire, salary
Next of kin name and phone
Leave requests and promotions

2.3 Student data (entered by the school)

Admission number, first and last name, gender, date of birth
Class, enrollment history, status
Guardian name and phone
Exam scores, grades, remarks

2.4 Parent and guardian data (entered by the school)

Name, email, phone
Linked children and their results and invoices

2.5 Payment data

Transaction reference, amount, currency, status, and Flutterwave transaction ID. Card details are never stored on our servers — they are handled by Flutterwave.

2.6 Technical data

IP address, browser type, device type, pages visited, and timestamps, collected for security and reliability
Audit logs of actions taken inside the platform

3. How we use personal data

To provide the service — running the school, generating report cards, processing payments, sending account notifications (legal basis: performance of a contract)
To protect the service — fraud prevention, security monitoring, abuse detection (legal basis: legitimate interests)
To send transactional email — verification codes, password resets, invoice receipts (legal basis: performance of a contract)
To comply with the law — record retention required by Nigerian tax and educational regulations (legal basis: legal obligation)

We do not sell personal data. We do not use student data to train AI models. We do not send marketing emails to parents or students without their school’s explicit authorisation.

4. Who we share data with

Personal data is shared only with the third-party service providers needed to run SmartSchools. Each is contractually bound to process data only as we instruct.

Neon — managed PostgreSQL database hosting (United States)
Vercel — application hosting and delivery (United States)
Flutterwave — payment processing (Nigeria)
Resend and Brevo — transactional email delivery
AI model providers — for AI generation features, only the specific content required to generate the requested output is sent. No complete student records are sent to AI providers.

We may also disclose data where legally compelled by a Nigerian court order or the Nigeria Data Protection Commission (NDPC).

5. Children’s data

SmartSchools processes student data on behalf of and under the instruction of the school. The school is responsible for obtaining any parental consent required for the processing of a student’s data. We do not knowingly collect data directly from children under 18, and student accounts do not exist as standalone logins — student data is managed by the school.

6. International transfers

Some of our sub-processors operate outside Nigeria, primarily in the United States. Where data is transferred outside Nigeria, we rely on the adequacy mechanisms recognised under Section 43 of the Nigeria Data Protection Act 2023 and ensure our processors are contractually bound to protect the data to a standard at least equivalent to Nigerian law.

7. Retention

Active accounts — retained while the school remains a customer
After cancellation — retained for 30 days to allow recovery, then deleted
Financial records — retained for 7 years to meet Nigerian tax record-keeping requirements
Audit logs — retained for 12 months
Verification and password-reset tokens — deleted after use or after 15-minute expiry

8. Security

We protect personal data with encryption in transit (HTTPS and TLS-encrypted database connections), password hashing (bcrypt), role-based access controls, and audit logging on every administrative action. Access to production data is limited to engineers who need it to resolve incidents or support requests.

No system is completely secure. If a data breach occurs, we notify affected schools and the NDPC within the timelines required by law.

9. Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data (subject to legal retention)
Object to specific processing
Request a portable copy of your data
Lodge a complaint with the NDPC

For student, staff, and parent data, contact your school first — they are the data controller and can request the change on your behalf. For administrator and website data, contact us at privacy@smartschools.site.

10. Cookies

SmartSchools uses only essential cookies needed for authentication and security. We do not use advertising cookies or third-party tracking.

11. Changes to this policy

If we make material changes, we notify school administrators by email at least 30 days before the change takes effect. The latest version is always at smartschools.site/privacy.

12. Contact

KK GLISTER TECHNOLOGY
RC 8171020
Privacy enquiries: privacy@smartschools.site
General enquiries: support@smartschools.site

To complain about how we handle your personal data, contact the Nigeria Data Protection Commission at ndpc.gov.ng.