Data Processing Agreement

THIS DATA PROCESSING AGREEMENT ("DPA") is made on the date it is accepted by the School's Authorised Signatory BETWEEN:

(1) [School legal name], of [School address], [registration number, if any] (the "Controller" or "School"); and

(2) EDULEDGA INNOVATIONS LIMITED, a company incorporated in Nigeria with registration number RC 9591803, whose registered office is at BDPA, Benin City, Edo State, Nigeria (the "Processor" or "EduLedga").

(A) The Parties have entered into the EduLedga School SaaS Agreement (the "Principal Agreement"), under which EduLedga provides the EduLedga platform to the School, supported by the EduLedga Service Level Agreement (the "SLA").

(B) In providing the platform, EduLedga processes personal data on behalf of the School. Section 29(2) of the Nigeria Data Protection Act 2023 ("NDPA") requires a written agreement between a controller and a processor, and Article 34 of the NDPC General Application and Implementation Directive 2025 ("GAID") specifies its contents.

(C) This DPA sets out the Parties' obligations and follows the structure of Article 34(2)(a) to (t) GAID.

IT IS AGREED as follows:

1.1 Terms defined in the NDPA (including "personal data", "sensitive personal data", "processing", "data controller", "data processor", "data subject" and "personal data breach") have the same meaning in this DPA. Capitalised terms not defined here have the meaning in the Principal Agreement. In addition:

2.1 EduLedga shall, in accordance with section 29(1) NDPA:

(a) comply with the principles and obligations in the NDPA applicable to a data controller, as they relate to its processing of School Personal Data (section 29(1)(a));

(b) assist the School, by appropriate technical and organisational measures, to honour data subject rights under Part VI NDPA (section 29(1)(b));

(c) implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of School Personal Data as required by Part VII NDPA (section 29(1)(c));

(d) provide the School with information reasonably required to comply and demonstrate compliance with the NDPA (section 29(1)(d)); and

(e) notify the School when a new Sub-processor is engaged (section 29(1)(e)).

2.2 The School, as controller, shall comply with its obligations under the NDPA, including determining lawful bases, giving notices to data subjects, obtaining consents (including guardian consent for children under section 31 NDPA and media consent), conducting a DPIA where required (Article 28 GAID), and ensuring its Instructions are lawful.

3.1 As set out under "Parties" above. Contact points for this DPA:

4.1 This DPA forms part of the Principal Agreement and the SLA described in Recital (A). In case of conflict on data protection matters, this DPA prevails.

5.1 EduLedga shall process School Personal Data only for the purpose of providing school-management services to the School under the Principal Agreement, including statutory reporting support, and for no other purpose. Specific purposes are listed in Schedule 1.

5.2 EduLedga shall not sell School Personal Data, use it for advertising or marketing, build profiles for EduLedga's own purposes, or use it to train general-purpose AI models.

6.1 School Personal Data is hosted on a virtual private server provided by Hostinger in France. Backups: off-server storage in the European Union. EduLedga's AI Features, other than AI drafting of lesson notes and, where enabled, teacher-reviewed comment suggestions, run on EduLedga's own self-hosted model on the same infrastructure. DeepSeek's API is used for AI drafting of lesson notes and, where enabled, teacher-reviewed comment suggestions. DeepSeek processes data in the People's Republic of China (as stated in DeepSeek's published privacy policy, last updated 10 February 2026). There is no NDPC adequacy decision for China and DeepSeek does not offer data processing terms, so EduLedga does not rely on adequacy or contractual clauses under section 41 NDPA. Lesson-note requests contain no personal data and are not a transfer of personal data under Part VIII NDPA. Comment suggestions are a cross-border transfer of a child's personal data, which EduLedga makes only where the pupil's parent or guardian (or the pupil, if 18 or over) has given and not withdrawn consent after being informed of the possible risks (section 43(1)(a) NDPA; Article 18(1)(e) GAID). The School collects that consent before it enables the feature, and the feature stays off for any pupil without it.

6.2 The School authorises the transfer of School Personal Data to France for this purpose. EduLedga shall ensure that every transfer outside Nigeria complies with Part VIII NDPA (sections 41 to 43) and Article 45 GAID. For France, EduLedga relies on its documented assessment under sections 41(2) and 42 NDPA that France provides an adequate level of protection, by reason of the GDPR, the French Data Protection Act, the supervisory powers of the CNIL, judicial redress and France's international commitments (including Council of Europe Convention 108), supported by Hostinger's data processing terms. EduLedga shall make the assessment available to the School on request and update it if the NDPC issues an adequacy decision, approved transfer instrument or other guidance.

6.3 EduLedga shall not transfer School Personal Data to any other country without recording a lawful basis under sections 41 to 43 NDPA and notifying the School under clause 12.

7.1 The categories of data subjects, categories of personal data, sensitive personal data, processing operations, duration and frequency are set out in Schedule 1.

8.1 The School is responsible for identifying and documenting the lawful basis under section 25 NDPA (and, for sensitive personal data, section 30 NDPA) for each processing purpose. Indicative bases are listed in Schedule 1.

8.2 EduLedga's lawful basis for processing as processor is the performance of the Principal Agreement on the School's Instructions.

9.1 Instructions. EduLedga shall process School Personal Data only on the School's Instructions, unless required by Nigerian law, in which case EduLedga shall inform the School before processing unless the law prohibits it. EduLedga shall inform the School immediately if, in its opinion, an Instruction infringes the NDPA.

9.2 Personnel. EduLedga shall ensure that persons authorised to process School Personal Data are bound by confidentiality, trained in data protection (Articles 30 and 46 GAID) and access data only as necessary.

9.3 Data subject requests. EduLedga shall forward to the School, within two (2) Business Days, any request received from a data subject concerning School Personal Data, and shall not respond itself except to acknowledge and redirect, unless the School instructs otherwise. EduLedga shall assist the School to respond, including by providing data exports and carrying out corrections, restrictions or deletions within ten (10) Business Days of the School's instruction. Such assistance is provided on written request to hello@eduledga.com (and through any in-platform request tools when available).

9.4 Breach notification. EduLedga shall notify the School without undue delay, and in any event within twenty-four (24) hours, after becoming aware of a Breach, describing (to the extent known): the nature of the Breach; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point (section 40(1) and (4) NDPA). EduLedga shall provide further information in phases as it becomes available (section 40(9) NDPA), respond to all information requests from the School (section 40(1)(b) NDPA), take reasonable steps to contain and remedy the Breach, and assist the School to notify the NDPC within seventy-two (72) hours and affected data subjects where required (section 40(2) and (3) NDPA; Article 33 GAID). EduLedga shall not notify data subjects or the NDPC about a Breach of School Personal Data on the School's behalf without the School's agreement, except where required by law. EduLedga shall make any report to ngCERT required of it under section 21 of the Cybercrimes Act (as amended in 2024). Both Parties shall keep a record of Breaches (section 40(8) NDPA).

9.5 DPIAs and consultation. EduLedga shall provide reasonable assistance with the School's DPIAs and any consultation with the NDPC.

9.6 Audits. EduLedga shall make available to the School information necessary to demonstrate compliance with this DPA, including a summary of its NDPA compliance audit and DPIA. The School may, not more than once in any twelve (12) month period (or following a Breach or a regulator's request), carry out an audit by itself or an independent auditor bound by confidentiality, on at least thirty (30) days' notice, during business hours and so as to minimise disruption; the School bears its own costs.

9.7 Return and deletion. On termination of the Principal Agreement, EduLedga shall make School Personal Data available for export for thirty (30) days and shall then delete it within ninety (90) days of termination (and from backups as they expire), unless Nigerian law requires retention, and shall confirm deletion in writing on request.

9.8 Records. EduLedga shall maintain a record of processing carried out on behalf of the School.

10.1 EduLedga shall implement and maintain the measures in the Security Schedule (Schedule 2). EduLedga may update those measures provided the overall level of security is not reduced.

11.1 DPIA. EduLedga shall maintain a DPIA covering educational records of students, children's accounts, AI Features and predictive insights, cross-border hosting and the DNEMIS module. Article 28(3) GAID makes a DPIA mandatory, and requires it to be filed with the NDPC, for (among others) evaluation or scoring, vulnerable data subjects, educational services processing student or pupil records, and cross-border data transfer; Article 28(4) GAID requires the DPIA to be vetted by an NDPC-accredited DPO. A summary will be provided to the School on request.

11.2 Potential risks identified include: unauthorised access to children's records (mitigated by role-based access, tenant separation and audit trail); over-collection of sensitive data (mitigated by restricted fields and exclusion from AI and exports); misuse by Authorised Users (mitigated by role terms, the AUP and the audit trail); cross-border hosting (mitigated under clause 6); payment fraud and phishing (mitigated by Paystack-hosted payment pages and user education); inaccurate AI output or predictive indicators (mitigated by mandatory human review and section 37 NDPA safeguards); and service unavailability (mitigated by backups and the SLA).

11.3 The audit trail currently records changes to records (who changed what and when) but not every view of a record. EduLedga shall notify the School when read-access logging is added.

12.1 The School gives general authorisation for EduLedga to engage the Sub-processors listed in Schedule 3.

12.2 EduLedga shall give the School at least thirty (30) days' notice by email to the School's Authorised Signatory before engaging a new or replacement Sub-processor. The School may object on reasonable data protection grounds within that period. If the Parties cannot resolve the objection, the School may terminate the affected Services without penalty and receive a pro-rata refund of prepaid Fees for the unused part of the Term.

12.3 EduLedga shall impose on each Sub-processor, by written contract, data protection obligations no less protective than this DPA (section 29(1) and (2) NDPA), conduct due diligence (Article 34(3) GAID) and remain liable for its Sub-processors.

12.4 AI. DeepSeek is engaged only for AI drafting of lesson notes and, where enabled, teacher-reviewed comment suggestions and is listed in Schedule 3. EduLedga shall: (a) send DeepSeek only the minimum curriculum content needed for a lesson note, with no pupil records; (b) for comment suggestions, send only the pupil's first name, average score, class position, attendance rate and strongest and weakest subjects, and only for pupils for whom the School has confirmed parent/guardian consent under section 43(1)(a) NDPA; (b1) not send DeepSeek any other School Personal Data unless and until EduLedga has given notice under clause 12.2, completed a further DPIA and recorded a transfer basis under sections 41 to 43 NDPA; (c) not itself use School Personal Data to train any general-purpose model and, because DeepSeek's terms give no guarantee on training, minimise the data sent to DeepSeek as set out in this clause; and (d) run all other AI Features, including analytics and predictive insights, on its own self-hosted model.

13.1 EduLedga's registration with the Nigeria Data Protection Commission (NDPC) is ongoing. The registration number will be provided to the School on request once issued. EduLedga shall provide evidence of registration to the School on request and maintain it during the term.

13.2 The School shall register with the NDPC where required (schools are among the categories listed in Schedule 7 GAID) and provide evidence to EduLedga on request.

14.1 EduLedga shall keep School Personal Data confidential and shall not disclose it to any third party except Sub-processors under clause 12, or as required by law (in which case clause 9.1 applies). Disclosure to a government education authority under the DNEMIS module shall occur only on the School's specific written instruction for each submission and only after the authority's written authorisation, as described in the DNEMIS/EMIS Government Data Sharing Notice.

15.1 This DPA takes effect on acceptance and continues for as long as EduLedga processes School Personal Data, surviving termination of the Principal Agreement until deletion is complete.

16.1 EduLedga shall not: (a) process School Personal Data for its own purposes; (b) access a School's tenant except to provide support, maintain security or comply with law, with such access logged; (c) combine School Personal Data with data from other Schools except as irreversibly anonymised aggregates; (d) send School Personal Data to any external AI provider (including DeepSeek) except under clause 12.4; (e) display advertising to students; or (f) make any solely automated decision with legal or similarly significant effects on a data subject (section 37 NDPA).

17.1 Each Party shall indemnify the other against fines, penalties, compensation and reasonable costs to the extent arising from its own breach of this DPA or the NDPA, subject to the limitations of liability in the Principal Agreement (including the enhanced cap for breach of this DPA), and save that neither Party is required to indemnify the other for losses caused by the other's own breach.

18.1 EduLedga shall maintain insurance as described in clause 13 of the Principal Agreement.

19.1 Clause 15 of the Principal Agreement applies, except that a force majeure event does not relieve EduLedga of its obligations to notify Breaches and to protect School Personal Data to the extent reasonably possible.

20.1 This DPA is governed by the laws of the Federal Republic of Nigeria. Any dispute arising out of or in connection with this DPA shall be resolved in accordance with clause 16 of the Principal Agreement: escalation, then arbitration seated in Lagos, Nigeria under the Arbitration and Mediation Act 2023 before a sole arbitrator, in English. Nothing prevents either Party from seeking urgent interim relief from a competent court or from engaging with the NDPC.

21.1 This DPA is accepted electronically by the School's Authorised Signatory during School registration, by ticking "I acknowledge the Data Processing Agreement", or by signature below. Until the in-platform acceptance record is available, EduLedga shall keep the signed copy or the email confirming acceptance. Electronic acceptance is valid under section 93 of the Evidence Act 2011.

Schedule 1: DPA Processing Schedule (separate document 3.3).

Schedule 2: Security Schedule (separate document 3.5).

Schedule 3: Sub-processor List (separate document 1.7).