Introduction
NERSAPP Technology ("NERSAPP", "we", "us" or "our") provides a school management platform designed to support educational administration across Nigeria and other African markets. This Privacy Policy explains how we collect, use, disclose, store and protect information when people and organizations access our websites, applications and related services.
Depending on how NERSAPP is used, information may relate to school owners, administrators, teachers, staff, parents, students and other authorized users. We recognize that school records can contain personal information about children and therefore require careful handling.
We aim to handle personal information in accordance with applicable data-protection laws, including the Nigeria Data Protection Act 2023 where applicable, and other legal obligations relevant to the services we provide.
Our role and the school's role
A school or organization generally determines why it collects and uses the school records it enters into NERSAPP. In these circumstances, the school may act as the data controller, while NERSAPP processes information as necessary to provide the platform and related services. NERSAPP may act as a data controller for certain account, website, security, support and business operations.
The precise roles of each party depend on the processing activity, the applicable agreements and the law. Where a separate data-processing agreement applies, it should be read together with this Policy.
This Policy applies to information handled through NERSAPP websites, applications, accounts and services. A school may also have its own privacy notices explaining how it uses student, parent and staff information.
Information We Collect
The information we handle depends on the services a school uses, the features enabled for an account and the information users choose or are authorized to submit.
Personal and account information
This may include names, email addresses, phone numbers, gender, dates of birth, addresses, profile pictures, account identifiers, login credentials and, where necessary for a specific school process, identification details.
School and academic information
This may include school and organization details, student and staff records, class and course information, attendance, timetables, assessment scores, academic results, report cards, comments, disciplinary records and other information entered or generated through school administration features.
Financial and transaction information
This may include invoices, fee records, payment status, transaction references and related financial administration information. Where payments are handled by an external payment provider, payment card details are handled in accordance with that provider's systems and terms. NERSAPP does not intend to store full payment card details as part of its school records.
Device, log and usage information
When you use our websites or services, technical information may be recorded, such as IP address, browser and device details, access timestamps, log entries, pages or features used, diagnostic information and cookie identifiers. This information may help us maintain service functionality, troubleshoot problems and protect accounts.
Support and communication information
If you contact our team, we may process the contact details and information you provide in your enquiry, support request, feedback or correspondence.
How information is obtained
- Directly from you when you register, update an account or contact us.
- From a school or organization that creates accounts or manages records on the platform.
- Automatically through normal website and application operation, including relevant logs and technical data.
- From service providers or integrations where necessary to deliver a requested feature or process a transaction.
We do not require every category of information for every user. Schools and users should only submit information that is relevant and appropriate for their intended use of NERSAPP.
How We Use Your Information
We use information for purposes connected with operating, securing and supporting NERSAPP, including:
- Creating accounts and authenticating authorized users.
- Supporting student enrolment, attendance, grading, academic reporting and school administration.
- Supporting communication between schools, educators, students and parents or guardians.
- Managing invoices, school fees, payment records and related transactions.
- Responding to support requests and helping users resolve technical issues.
- Maintaining platform functionality, diagnosing errors and improving the user experience.
- Detecting, investigating and reducing fraud, abuse, unauthorized access and security threats.
- Sending essential account, service, security and policy notifications.
- Meeting applicable legal obligations and protecting legitimate rights and interests.
Legal grounds for processing
Where applicable law requires a lawful basis, we process personal information on an appropriate basis for the relevant activity. Depending on the circumstances, this may include providing a requested service or performing a contract, complying with a legal obligation, pursuing a legitimate interest that does not override applicable rights, or obtaining consent where consent is required.
The school or organization may be responsible for determining and documenting the lawful basis for records it controls, including student records. Where we rely on consent for a particular activity, consent may be withdrawn subject to applicable law; withdrawal does not automatically make earlier lawful processing invalid.
Service and promotional communications
We may send necessary communications about account activity, security, service availability, support or material policy changes. Where permitted, we may also share product updates, educational resources or other relevant news. Where consent or an opt-out is legally required for promotional messages, we will respect the applicable requirements and available communication preferences.
Data Storage and Security
NERSAPP uses technical and organizational measures intended to protect information against unauthorized access, loss, misuse, alteration and disclosure. The measures appropriate to a particular type of information depend on the nature of the information, the services involved and the risks associated with processing it.
Depending on the service and systems involved, safeguards may include:
- Account authentication, access permissions and administrative controls.
- Secure handling of credentials and other authentication information.
- Encryption or other protective measures for information in transit or storage where implemented and appropriate.
- Logging and monitoring of relevant system and account activity.
- Software maintenance, updates, backups and recovery procedures where provided by the relevant service.
- Use of hosting and other technology providers to support the operation of the platform.
No website, network, storage system or method of electronic transmission can be guaranteed to be completely secure. We work to manage risks appropriate to the services, but cannot promise that unauthorized access, service interruption or data loss will never occur.
Data retention and deletion
We retain information for as long as reasonably necessary for the purpose for which it was collected, to provide the services, maintain appropriate records, resolve disputes, protect the platform or comply with legal obligations. Retention periods can differ by information category and the school's instructions.
When information is no longer required, we will take appropriate steps to delete it, anonymize it or otherwise handle it in accordance with applicable requirements. Backups, security records and information subject to a legal retention requirement may remain for a limited period before deletion or removal from normal use.
Security incidents
If we become aware of a personal-data incident affecting information for which we have responsibility, we will assess and respond to it and take steps appropriate to the circumstances. Notifications to affected people, schools or regulators will be made where required by applicable law and according to the relevant responsibilities of each party.
What schools and users can do
- Keep passwords and authentication details confidential.
- Use appropriate permissions and remove access when it is no longer needed.
- Keep account contact details up to date.
- Report suspected unauthorized access or data exposure promptly.
Your Data Rights
Depending on applicable law, the nature of the processing and any lawful exceptions, you may have rights relating to your personal information, including the right to:
- Request access to personal information held about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of personal information in circumstances where deletion is legally required or otherwise permitted.
- Object to, or request restriction of, certain processing activities where the law provides that right.
- Withdraw consent where processing is based on consent.
- Request a copy of certain information in a portable format where applicable.
- Raise a complaint with the relevant data-protection authority where permitted by law.
How to make a request
Send your request to hello@nersapp.africa. Please explain your request and provide enough information for us to understand and verify it. We may need to confirm your identity or authority before disclosing, correcting or deleting personal information.
If your information is held in a school's NERSAPP account, contact the school or its authorized administrator as well. The school may control the relevant records and may need to approve or carry out changes. NERSAPP will handle requests according to its role, the applicable service arrangements and legal requirements.
We will respond within the timeframe required by applicable law. Some requests may be limited where we have a lawful reason to retain information, need to protect another person's rights or are subject to a legal obligation.
Children's Privacy
NERSAPP is designed to support school administration, and some school records necessarily relate to children and students. We recognize the importance of handling children's personal information with appropriate care, access restrictions and safeguards.
Schools and organizations using NERSAPP are responsible for ensuring that they have the lawful authority to collect and submit student information, provide required notices and obtain any consent or authorization required by applicable law. Parents and guardians should be involved where the law or circumstances require it.
NERSAPP does not knowingly collect personal information directly from children in circumstances where such collection requires guardian consent or another authorization and that authorization has not been obtained. The legal requirements depend on the child's age, the type of processing and applicable law; this statement should not be understood as a universal age threshold for every service or situation.
Protecting student records
- Schools should only submit student information necessary for legitimate educational and administrative purposes.
- Access to academic, contact, attendance and disciplinary records should be restricted to appropriately authorized users.
- Parents or guardians with concerns about a student's information should contact the school and may also contact NERSAPP where appropriate.
If you believe a child's personal information has been submitted to NERSAPP improperly or without required authorization, contact us at hello@nersapp.africa
Third-Party Links and Integrations
NERSAPP may link to or integrate with third-party websites, payment services, communication tools and other external systems. These services may be operated independently of NERSAPP and may have their own privacy policies, terms and data-handling practices.
When you use an external service, review its privacy information and terms where appropriate. Information submitted directly to a third party may be governed by that provider's policies as well as any applicable agreement with NERSAPP.
We take reasonable care when choosing services needed to operate our platform, but we do not control every aspect of an independent third party's systems, policies or availability. Our responsibility for a provider's processing will depend on our relationship with that provider, the relevant agreements and applicable law.
If a school enables an integration, the school should consider what information will be shared, why the integration is needed and whether the relevant permissions and notices are in place.
Changes to This Policy
We may update this Privacy Policy as NERSAPP's services, technology, operational practices or legal obligations change.
The updated version will be published on this page with a revised "Last updated" date. Where a change is material and notification is required or appropriate, we will communicate it through a suitable channel, which may include email, an in-platform notice or a notice on our website.
The updated Policy applies from its stated effective date, subject to applicable law and any notice or consent requirements. Where required, we will seek consent or take other necessary steps before applying changes to processing that depends on it.
We encourage schools and users to review this page periodically so they can understand how information is handled.
Contact Us
If you have questions about this Privacy Policy, want to make a privacy request, or have a concern about how personal information is handled, please contact NERSAPP Technology.
Contact our team at the email address below. For school records, you may also need to contact your school's authorized administrator.
hello@nersapp.africaBy accessing or using NERSAPP, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is the required legal basis for a particular processing activity, that consent will be handled in accordance with applicable law.
