Privacy Policy

SchoolMadeEasy is a school management service run by Bravehat Consulting Ltd (“we”, “us”). Schools use it to manage admissions, attendance, results, fees, communication and staff records.

Each school decides what information it records about its students, parents and staff and why. For that information the school is the data controller and we act as its data processor: we only handle it to provide the service to the school. For the details of the people who register and manage a school account, and for visitors to this website, we are the data controller.

This policy is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR). If your question is about a particular school's records, please contact that school first.

• Students: name, admission number, date of birth, gender, class, photo, address, state of origin, attendance, scores, report cards, behaviour and discipline notes, health and medical notes (such as allergies or blood group, where the school records them), fees and payments, library, hostel and transport records, and documents the school uploads.
• Parents and guardians: name, relationship to the child, phone and WhatsApp number, email, address, occupation, payment history, messages, absence reports and portal settings.
• Staff: name, contact details, role, subjects and classes, employment details, qualifications, attendance, leave, appraisals, and payroll and bank details where the school uses payroll.
• School account users: login email, a protected (hashed) password, role, and a log of important actions taken in the app.
• Admission applicants: the details and documents submitted through a school's online application form.

Information is used to run the school: admitting and enrolling students, keeping attendance and academic records, producing report cards, billing and receipting fees, paying staff, keeping children safe, and keeping parents informed.

The legal bases are the school's contract with parents and staff, the school's legal obligations, the legitimate interests of running a school, and, where needed (for example optional newsletters or progress emails), consent. Parents can change their email preferences at any time in the Parent Portal.

We do not sell personal data and we do not use it for advertising.

Most students are under 18. Their information is provided by the school or by a parent or guardian, and a parent or guardian acts for the child when exercising the rights below. Schools should only record what they need, and should take extra care with health, discipline and photo records. Students who are given a portal login can only see their own tests and results.

Inside a school, people only see what their role allows (for example, parents see only their own children). Each school's data is kept separate from every other school.

To provide the service we use a small number of trusted service providers, who may only use the data on our instructions:

• Cloud hosting, database and file storage providers.
• An email delivery service, for receipts, notices and other school emails.
• An SMS and WhatsApp messaging provider, when the school switches this on.
• Online payment providers (such as Paystack or Flutterwave), when the school uses online payment.
• An AI service that powers the staff-only AI Assistant, which receives the question and the school summary needed to answer it.

We may also disclose information where the law requires it, for example to a regulator or court.

Some of our service providers store or process data outside Nigeria. Where this happens we rely on the safeguards allowed under the NDPA, such as contracts that require the provider to protect the data to an adequate standard.

School records are kept for as long as the school uses SchoolMadeEasy, or longer where the school must keep them by law (for example academic and financial records). A school can ask us to export or delete its data when it leaves the service. Login sessions and technical logs are kept only as long as needed to run and secure the service.

• All connections use encryption (HTTPS).
• Passwords are stored in hashed form, never as plain text.
• Access is controlled by role, and important actions are recorded in an audit log.
• Private files such as uploaded documents are stored in protected cloud storage.

Under the NDPA you have the right to:

• be told how your information is used, and get a copy of it;
• have wrong information corrected;
• have information deleted, or its use limited, where the law allows;
• object to some uses, and withdraw consent you have given;
• receive your information in a common electronic format.

For student, parent or staff records, please contact the school first, as it controls those records; we will help the school respond. You can also contact us using the details below. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (NDPC).

We use a cookie to keep you signed in, and the browser's local storage to remember simple settings on your device. We do not use advertising cookies.

Bravehat Consulting Ltd
[registered office address]
Email: [privacy contact email]

We may update this policy from time to time. The date at the top shows when it last changed.