On this page
| Item | Detail |
|---|---|
| Document | Schedule 1 to the EduLedga Data Processing Agreement |
| Layer | Layer 2: EduLedga ↔ School |
| Parties | [School legal name] (Controller) and EDULEDGA INNOVATIONS LIMITED (Processor) |
| Version | 1.0 |
| Status | Final |
| Effective date | As for the DPA |
- This schedule lists exactly whose data EduLedga processes for the school, what data, why, how and for how long.
- It fulfils the "scope", "purpose" and "lawful basis" items that Article 34 GAID requires in a DPA.
1. SUBJECT MATTER AND DURATION
1.1 Subject matter: provision of the EduLedga school-management platform under the School SaaS Agreement.
1.2 Duration: the term of the School SaaS Agreement plus the thirty (30) day export window and the deletion period of up to ninety (90) days after termination (and backup expiry).
1.3 Frequency: continuous.
2. CATEGORIES OF DATA SUBJECTS
2.1 (a) Students and pupils, including children under 18 and children under 13; (b) applicants for admission and their parents; (c) parents, guardians and emergency contacts; (d) proprietors, directors and governors; (e) principals, headmasters, bursars, teachers, administrators, heads of department, EMIS officers, inspectors and other staff; (f) class monitors (students); (g) visitors to the School's EduLedga-hosted website who submit forms.
3. CATEGORIES OF PERSONAL DATA
| Category | Examples |
|---|---|
| Identity | Name, admission number, staff ID, date of birth, sex, photograph (if uploaded), login username |
| Contact | Email, phone, address, emergency contacts |
| Enrolment and admissions | Class, arm, campus, session, admission application data, interview and assessment results, admission letters, enrolment history |
| Attendance | Daily and period attendance, lateness, absence reasons, teacher attendance; QR check-in data where used |
| Academic | Scores, CBT attempts and answers, grades, positions, report cards, teacher comments, affective and psychomotor ratings, promotion and graduation status, certificates and verification codes |
| Timetable | Class and teacher timetables, subject allocations |
| Financial | Fee items, invoices, instalments, discounts, scholarships, payment status, Paystack references, receipts (no full card data) |
| Communications | Announcements, messages, notification delivery status (in-app, email, SMS, WhatsApp) |
| Staff | Role, qualifications (if recorded), subjects, classes, lesson notes and their approval status |
| AI | Inputs and outputs of AI Features as described in the AI Data Processing Notice |
| Census | Data used to compute Annual School Census returns (aggregated for submission) |
| Website | Content, news, galleries and form submissions on the School website |
| Account and audit | Login records, Role assignments, audit trail of changes |
4. SENSITIVE PERSONAL DATA
4.1 Processed only if the School chooses to record it: health and medical information (including allergies and medical notes), special educational needs and disability, religion, and disciplinary information. The School must have a ground under section 30(1) NDPA. These fields are role-restricted, excluded from AI Features and analytics snapshots, and excluded from exports unless the School expressly selects them.
5. PURPOSES AND PROCESSING OPERATIONS
| Purpose | Processing operations | Indicative lawful basis (School decides) |
|---|---|---|
| Student records and multi-campus administration | Collection (manual and bulk import, including students without email), storage, organisation, retrieval, update | Contract with parents; legal obligation; public interest in education; s.31(4)(b) NDPA |
| Student and parent accounts | Account creation, authentication, access control | Guardian consent for under-18 student accounts (s.31(1) NDPA; Art 18(1)(d) GAID); contract |
| Attendance and safeguarding | Recording, absence alerts to parents, reporting | Contract; legitimate interest; vital interests where relevant |
| Assessment, results and report cards | Score entry, CBT delivery and auto-marking, calculation, report generation, approval and release | Contract; public interest in education |
| Promotion and graduation | Preview and execution of promotion decisions made by staff | Contract (decisions made by people: s.37 NDPA) |
| Timetabling | Scheduling and clash checks | Contract |
| Fees | Invoicing, instalments, Paystack payment initiation, reconciliation, receipts, overdue reminders | Contract; legal obligation (accounting) |
| Communications | In-app, email, SMS and WhatsApp notifications | Contract; legitimate interest |
| Analytics and insights | Dashboards, rule-based and predictive indicators for staff | Legitimate interest (School LIA) |
| AI Features | Lesson notes (DeepSeek API, China; curriculum content only); comment suggestions where enabled (DeepSeek API, China; pupil first name, average, position, attendance rate, best and weakest subjects; teacher-reviewed; parent/guardian consent to transfer under s.43(1)(a) NDPA); questions, student tutor, analytics and predictive insights (EduLedga's self-hosted model) | Contract; guardian consent for students under 18 |
| Admissions | Online application forms, interview and assessment scheduling, letters, enrolment | Pre-contractual steps at the request of the applicant's parent; consent where required |
| School website | Hosting and publishing School content, including images where media consent is held | Legitimate interest; consent for children's images |
| Certificates | Generation and verification | Contract; legitimate interest |
| Statutory returns (DNEMIS) | Computing census figures; export; direct submission only when authorised and instructed | Legal obligation / public interest |
| Support and security | Troubleshooting on request, logging, backups, incident response | Contract; s.39 NDPA |
6. SPECIFIC INSTRUCTIONS
6.1 The School instructs EduLedga: (a) not to activate student logins for under-18s until the School has recorded guardian consent; (b) to apply no optional cookies, advertising or marketing to student accounts; (c) to make no DNEMIS submission without authority authorisation and the School's per-submission instruction; and (d) to treat any additional written instruction from the Authorised Signatory or privacy contact as part of the Instructions.
7. RETENTION
7.1 As configured or instructed by the School during the subscription (suggested defaults are in the Data Retention & Deletion Policy), followed by the export and deletion periods above.
8. LOCATION
8.1 Hostinger VPS, France (EU). Backups: off-server storage in the European Union. Sub-processor locations: see Schedule 3.